8c00aba85104a131dd8a47b8aaaa236a36f4d9db51304d6654d10221ba8d0e8c

Sharing

Copy URL

Twitter E-mail

General

Target

8c00aba85104a131dd8a47b8aaaa236a36f4d9db51304d6654d10221ba8d0e8c
Size

323KB
MD5

cc786fa326a1a462c30a4f7312261204
SHA1

a0141b9ca0d03ead1a10df675ccfac3baad3fabc
SHA256

8c00aba85104a131dd8a47b8aaaa236a36f4d9db51304d6654d10221ba8d0e8c
SHA512

e8a42a40b2037cd87317cc7b09b238d42ec35756c312c73cfc18d5b78e09dadb8aebd58038cb578ac4afa24e98ae40df09a50d283c8ca5890a294f56024e7881
SSDEEP

3072:L1Pxun4j8PS1f9HAYl6pzSQIqMAK3btKAl25/VHGFUIIDg7In++bcgrQr8b1aIxD:5onDw6eQNmsAxQw38bJxu1BnA

Score

1^/10

Malware Config

Signatures

Files

8c00aba85104a131dd8a47b8aaaa236a36f4d9db51304d6654d10221ba8d0e8c
.exe windows:6 windows x64 arch:x64

dccc9e93662e5aced4645cff17be9184

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:1a:fa:b1:33:a9:e1:97:48:49:f2:6c
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

16-04-2024 14:20

Not After

17-04-2027 14:20

Subject

SERIALNUMBER=HRB 147169,CN=Allplan GmbH,O=Allplan GmbH,STREET=Konrad-Zuse-Platz 1,L=München,ST=Bayern,C=DE,1.3.6.1.4.1.311.60.2.1.1=#13084d75656e6368656e,1.3.6.1.4.1.311.60.2.1.2=#130642617965726e,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

07-11-2023 17:13

Not After

09-12-2034 17:13

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20-06-2018 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

10-12-2014 00:00

Not After

10-12-2034 00:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5b:6c:f2:36:63:de:c9:b2:e0:ea:57:e2:78:e4:78:6d:4f:71:61:20:27:68:1f:43:7f:46:07:cf:fe:7e:f7:66
Signer

Actual PE Digest

5b:6c:f2:36:63:de:c9:b2:e0:ea:57:e2:78:e4:78:6d:4f:71:61:20:27:68:1f:43:7f:46:07:cf:fe:7e:f7:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

H:\_CM\output\Release\Bin\NemProjectPilot10.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

toolkitpro2210vc170x64u

?LoadSkin@CXTPSkinManager@@QEAAHPEB_W0@Z
?SetIsProcessShuttingDown@CXTPSkinObject@@SAX_N@Z
?XTPSkinManager@@YAPEAVCXTPSkinManager@@XZ

nemall_commondialogs

?SetAssociationsControllerCallbacks@GUI@Allplan@@YAXXZ

vframes

?GetUnifiedRectangleOfAllDisplays@CMDIPropertiesServices@@SAAEAUtagRECT@@XZ

nemcore_mfcext20

?setSessionLanguageLCID@NGUI_DllResReader@@SAJW4LanguageLCID@1@@Z
?LoadCString@NGUI_DllResReader@@SA?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@AEBVN_STRING@@I@Z
?getLanguageLCID@NGUI_DllResReader@@SAJXZ
?AfxLoadLibrary@NGUI_DllResReader@@SAPEAUHINSTANCE__@@PEB_W@Z

nemcore_tools20

??0XCOLL_CursorException@@QEAA@XZ
??1XCOLL_CursorException@@UEAA@XZ
??0XCOLL_CursorException@@QEAA@AEBV0@@Z
??0XCOLL_CollectionException@@QEAA@AEBV0@@Z
??1XCOLL_OutOfRange@@UEAA@XZ
??0XCOLL_OutOfRange@@QEAA@AEBV0@@Z
??0XCOLL_OutOfRange@@QEAA@KK@Z

nemcore_system20

??4N_STRING@@QEAAAEAV0@AEBV0@@Z
??0NSYST_RegistryKey@@QEAA@W4NSYST_RegistryStandardKey@@_NAEBVN_STRING@@@Z
??4NSYST_RegistryKey@@QEAAAEAV0@AEBV0@@Z
?setBinaryValue@NSYST_RegistryKey@@QEBA_NAEBVN_STRING@@PEBXK@Z
?getBinaryValue@NSYST_RegistryKey@@QEBA_NAEBVN_STRING@@PEAXPEAK@Z
?deleteValue@NSYST_RegistryKey@@QEBA_NAEBVN_STRING@@@Z
?N_MsgBox@@YAHPEB_WII@Z
??0NSYST_RegistryKey@@QEAA@W4NSYST_RegistryStandardKey@@_N@Z
?data@N_STRING@@QEBAPEB_WXZ
??0NSYST_RegistryKey@@QEAA@XZ
??1N_STRING@@QEAA@XZ
??0N_STRING@@QEAA@PEB_W_K@Z
??0N_STRING@@QEAA@XZ
?getStringValue@NSYST_RegistryKey@@QEBA?AVN_STRING@@AEBV2@AEA_N@Z
??1NCOM_Exception@@UEAA@XZ
?NCOM_ComPtrAssign@@YAPEAUIUnknown@@PEAPEAU1@PEAU1@@Z
??0NCOM_Exception@@QEAA@J@Z
??6NSYST_DumpStream@@QEAAAEAV0@J@Z
?getIntValue@NSYST_RegistryKey@@QEBAJAEBVN_STRING@@@Z
?setIntValue@NSYST_RegistryKey@@QEBA_NAEBVN_STRING@@J@Z
?getInfoString@N_Exception@@QEBA?AVN_STRING@@XZ
?format@N_STRING@@QEAAXPEB_WZZ
??0NSYST_RegistryKey@@QEAA@AEBV0@AEBVN_STRING@@_N@Z
??6NSYST_DumpStream@@QEAAAEAV0@K@Z
??6NSYST_DumpStream@@QEAAAEAV0@PEB_W@Z
??6NSYST_DumpStream@@QEAAAEAV0@AEBVN_STRING@@@Z
?_OnDefaultCatch@N_Exception@@SAXXZ
?_OnCatch@N_Exception@@QEBAXXZ
?mapToDefaultHRESULT@N_Exception@@SAJXZ
??0N_STRING@@QEAA@AEBV0@_K1@Z
??0N_Exception@@QEAA@AEBV0@@Z
??1NCOM_BSTRArray@@QEAA@XZ
?putString@NCOM_BSTRArray@@QEAAXJPEB_W@Z
??0NCOM_BSTRArray@@QEAA@KJ@Z
?transferVariant@NCOM_Array@@QEAAXPEAUtagVARIANT@@@Z
?getStdStream@NSYST_DumpStream@@SAAEAV1@XZ
??0NCOM_Exception@@QEAA@AEBV0@@Z
??1NSYST_RegistryKey@@QEAA@XZ
??BN_BSTR@@QEBAPEA_WXZ
??1N_BSTR@@QEAA@XZ
??0N_BSTR@@QEAA@AEBVN_STRING@@@Z
?getBasicKeyName@NSYST_RegistryKey@@SA?AVN_STRING@@XZ
?getIntValue@NSYST_RegistryKey@@QEBAJAEBVN_STRING@@AEA_N@Z
??0NSYST_RegistryKey@@QEAA@W4NSYST_RegistryRootKey@@@Z

nemall_xp_styles

?getConcreteSkinning@CVisualStylesAbstractSkin@@SAPEAV1@H@Z

nemall_ifw_general

?SetMainFrameWnd@CCopyDataService@@SAXPEAUHWND__@@@Z

nemall_dataresource20

?SetAppInitialized@@YAX_N@Z
?SetALLPLANisInitialized@@YAXXZ
?SetProjectPilotRunning@@YAX_N@Z
IsOGLSupported
GetUnifiedNavigationEnabled
?SetALLTOPisInitialized@@YAXXZ

nemall_utilityhelp

?StartHelp@CNemHelp@@QEAAXPEAUHWND__@@PEB_WW4eNemHelpCMD@@_K@Z
?Instance@CNemHelp@@SAPEAV1@XZ

nemall_crashdumpengine

?Init@CrashHandler@Allplan@@QEAAXXZ
?SetProcessExceptionHandlers@CrashHandler@Allplan@@QEAAHH@Z
?GetData@CrashHandler@Allplan@@QEAAPEAVCrashDataCollector@CrashDump@@XZ
?SetCallback@CrashHandler@Allplan@@QEAAX$$QEAV?$function@$$A6AXPEAVCrashDataCollector@CrashDump@@@Z@std@@@Z
?Create@CrashHandler@Allplan@@SAPEAV12@XZ
?IsCrashReportingAllowed@Allplan@@YA_NXZ
?saveItems@Utils@CrashDump@@YA_NPEB_WAEBV?$vector@UCrashDumpItem@CrashDump@@V?$allocator@UCrashDumpItem@CrashDump@@@std@@@std@@@Z
?GetSystemInfoFileName@Utils@CrashDump@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBVCrashDataCollector@2@@Z
?GetCurrentProcessCrashHandler@CrashHandler@Allplan@@SAPEAV12@XZ
?CreateSystemInfo@CrashDataCollector@CrashDump@@QEAAXXZ
?ReleaseCurrentProcessCrashHandler@CrashHandler@Allplan@@SAXXZ
?EmulateCrash@Allplan@@YAHI@Z
?SetCompanyName@CrashDataCollector@CrashDump@@QEAAXPEB_W@Z
?SetApplicationName@CrashDataCollector@CrashDump@@QEAAXPEB_W@Z
?AddStaticCustomInfo@CrashDataCollector@CrashDump@@SA_NAEBUCrashDumpItem@2@@Z
?AddCustomInfo@CrashDataCollector@CrashDump@@QEAA_NAEBUCrashDumpItem@2@@Z
?AddRegistryDump@CrashDataCollector@CrashDump@@QEAA_NPEB_W0@Z
?GetSystemInfo@CrashDataCollector@CrashDump@@QEBAAEBV?$vector@UCrashDumpItem@CrashDump@@V?$allocator@UCrashDumpItem@CrashDump@@@std@@@std@@XZ

nemall_utilitygeneral10

?substitutePathToRealPath@NetManager@@SA_NAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEAV23@@Z
?GetDisplayMonitorInfo@@YAXPEAUHWND__@@AEAV?$vector@UtagMONITORINFOEXW@@V?$allocator@UtagMONITORINFOEXW@@@std@@@std@@@Z
?AllplanController@@YAPEAVIController@Allplan@@XZ
EnforceOwnUnhandledExceptionFilter

nemall_utilityregistry

NSYST_GetResRelease
NSYST_NemRegGetNumber

kernel32

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
QueryPerformanceCounter
GetCurrentProcessId
FindActCtxSectionStringW
GetSystemTimeAsFileTime
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
TerminateProcess
RaiseException
EnterCriticalSection
LeaveCriticalSection
LocalFree
DeactivateActCtx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
ActivateActCtx
QueryActCtxW
CreateActCtxW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
SetLastError
OutputDebugStringA
GetStartupInfoW
GetCurrentThreadId
IsProcessorFeaturePresent
GetCurrentProcess
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleHandleW
FreeLibrary
FindResourceExW
WaitForSingleObject
OutputDebugStringW
GetLongPathNameW
GlobalLock
GlobalSize
GetTempPathW
GetTempFileNameW
GetSystemDefaultLCID
SetThreadLocale
MultiByteToWideChar
GlobalFree
GetProcAddress
SetThreadStackGuarantee
CreateMutexW
ReleaseMutex
CloseHandle
GetCommandLineW
GetModuleFileNameW
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
DecodePointer

user32

UnregisterClassW
RegisterWindowMessageW
GetSysColor
EqualRect
LoadCursorW
GetWindowRect
GetClientRect
EnableWindow
UnionRect
SendMessageW
SetCursor
OffsetRect
CopyRect
LoadIconW
SetTimer
GetClassNameW
GetKeyState
GetFocus
IsWindow
GetWindow
GetLastActivePopup
GetDesktopWindow
UpdateWindow
MessageBoxW
GetPropW
SetPropW
SetForegroundWindow
GetKeyboardState
BringWindowToTop
IsIconic
ShowWindow
wsprintfW
GetDpiForSystem
GetMonitorInfoW
MonitorFromRect
LoadImageW

gdi32

CreateHalftonePalette
GetObjectW
CreatePalette
RealizePalette
GetDIBColorTable
GetDeviceCaps
BitBlt
CreateCompatibleDC

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

CommandLineToArgvW
ShellExecuteExW

ole32

GetHGlobalFromStream
CreateStreamOnHGlobal
OleRun
CoInitialize
CoCreateInstance
CoUninitialize
WriteClassStm

oleaut32

VariantChangeType
SysStringLen
VariantClear
VariantInit
SysAllocString
SysFreeString
GetErrorInfo
SetErrorInfo
CreateErrorInfo
SafeArrayGetLBound
SafeArrayGetElement

mfc140u

ord11784
ord8928
ord11763
ord11184
ord10093
ord8993
ord8866
ord11030
ord10067
ord7245
ord2187
ord2270
ord4239
ord956
ord13283
ord1425
ord13601
ord8173
ord3598
ord11806
ord14128
ord11771
ord3071
ord3308
ord3307
ord3951
ord10163
ord11085
ord8901
ord2697
ord13397
ord6000
ord11813
ord7119
ord902
ord13370
ord8668
ord10924
ord10710
ord8733
ord11022
ord10260
ord10858
ord11621
ord11624
ord11622
ord11623
ord6083
ord1386
ord10689
ord11898
ord7366
ord3728
ord2703
ord2715
ord833
ord12250
ord7836
ord13497
ord6129
ord5674
ord286
ord1501
ord1671
ord2903
ord3726
ord12600
ord9941
ord5555
ord13864
ord13136
ord6285
ord446
ord10704
ord8731
ord1089
ord11854
ord7233
ord11901
ord11933
ord7920
ord11921
ord5706
ord3731
ord6614
ord983
ord13545
ord6122
ord14289
ord6123
ord14290
ord6121
ord14288
ord7719
ord12212
ord14088
ord11664
ord11665
ord2011
ord11709
ord11928
ord7668
ord12625
ord3949
ord4011
ord9089
ord7650
ord14210
ord12222
ord12223
ord2439
ord5183
ord8023
ord12544
ord12606
ord10124
ord11929
ord8084
ord1450
ord7393
ord8167
ord2260
ord2193
ord2178
ord4946
ord12240
ord13949
ord2921
ord285
ord1667
ord1670
ord5709
ord14037
ord6256
ord362
ord5517
ord4218
ord1056
ord5749
ord528
ord13767
ord2222
ord265
ord488
ord9043
ord1120
ord4443
ord1369
ord2514
ord4357
ord2573
ord990
ord3203
ord5120
ord8507
ord9159
ord11081
ord11902
ord3713
ord1454
ord11851
ord7394
ord912
ord3967
ord1905
ord1389
ord834
ord2493
ord3842
ord266
ord6542
ord2473
ord438
ord12765
ord1086
ord12746
ord361
ord1055
ord2686
ord5632
ord3274
ord3168
ord972
ord7165
ord13613
ord13612
ord14199
ord11760
ord11780
ord11853
ord3810
ord7883
ord12139
ord8037
ord3722
ord4114
ord4144
ord4110
ord4068
ord4038
ord2598
ord6002
ord13401
ord3212
ord3209
ord9946
ord7913
ord2698
ord14360
ord9976
ord9978
ord9977
ord9975
ord9979
ord5451
ord11414
ord11415
ord8830
ord3718
ord11625
ord8656
ord6729
ord10691
ord8947
ord3173
ord13513
ord11944
ord11940
ord1700
ord1722
ord1748
ord1734
ord1755
ord4776
ord4843
ord4788
ord4806
ord4800
ord4794
ord4853
ord4837
ord4782
ord4859
ord4752
ord4767
ord4828
ord4360
ord5582
ord9384
ord4352
ord2967
ord14211
ord7651
ord14217
ord6631
ord12706
ord13354
ord5723
ord2629
ord3278
ord3279
ord3172
ord11850
ord5080
ord5363
ord5552
ord9041
ord5339
ord5083
ord5229
ord5062
ord7460
ord7461
ord7450
ord5227
ord7922
ord8900
ord1452
ord985
ord3723
ord11859
ord6247
ord3756
ord8521
ord5743
ord11119
ord3828
ord5189
ord11484
ord11489
ord8904
ord4353
ord2510
ord2475
ord6320
ord2212
ord4656
ord7912
ord3879
ord4241
ord1129
ord5726
ord878
ord1438
ord5727
ord13360
ord13351
ord5722
ord1766
ord12142
ord5917
ord4873
ord4872
ord8095
ord3081
ord502
ord6879
ord1489
ord7384
ord2316
ord14209
ord4814
ord10074
ord13199
ord11406
ord7541
ord3812
ord1149
ord3830
ord8961
ord4813
ord8683
ord4724
ord12267
ord11465
ord3089
ord7188
ord4499
ord7813
ord4429
ord1059
ord11719
ord11718
ord365
ord1164
ord1637
ord8206
ord543
ord8409
ord1503
ord1033
ord296
ord7893
ord4181
ord1641
ord6505
ord2350
ord2346
ord1491
ord11405
ord6619
ord2597
ord13358
ord2370

comctl32

ImageList_AddMasked

shlwapi

PathAddBackslashW
PathCombineW
PathRemoveFileSpecW

msvcp140

?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_type_info_destroy_list
__current_exception_context
__current_exception
__C_specific_handler
memset
__std_type_info_name
wcsrchr
_purecall
memmove
memcpy
_CxxThrowException
__std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wmemcpy_s
wcsnlen
_wcsicmp
wcstok
wcsncpy
wcsncat
wcscpy_s
_wcslwr
_wcsdup

api-ms-win-crt-filesystem-l1-1-0

_wmakepath
_wsplitpath

api-ms-win-crt-heap-l1-1-0

free
_recalloc
malloc
calloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
terminate
_errno
_invalid_parameter_noinfo
_c_exit
_cexit
_seh_filter_exe
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vswprintf
__stdio_common_vswscanf
__stdio_common_vswprintf_s
__stdio_common_vfwprintf
__acrt_iob_func
_set_fmode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?unlock@singleton_module@serialization@boost@@QEAAXXZ

Sections

.text
Size: 156KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dccc9e93662e5aced4645cff17be9184

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

07:1a:fa:b1:33:a9:e1:97:48:49:f2:6cCertificate

Extended Key Usages

Key Usages

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16Certificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51Certificate

Key Usages

5b:6c:f2:36:63:de:c9:b2:e0:ea:57:e2:78:e4:78:6d:4f:71:61:20:27:68:1f:43:7f:46:07:cf:fe:7e:f7:66Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

version

toolkitpro2210vc170x64u

nemall_commondialogs

vframes

nemcore_mfcext20

nemcore_tools20

nemcore_system20

nemall_xp_styles

nemall_ifw_general

nemall_dataresource20

nemall_utilityhelp

nemall_crashdumpengine

nemall_utilitygeneral10

nemall_utilityregistry

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc140u

comctl32

shlwapi

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 156KB - Virtual size: 153KB

.rdata Size: 104KB - Virtual size: 100KB

.data Size: 8KB - Virtual size: 7KB

.pdata Size: 12KB - Virtual size: 10KB

.rsrc Size: 24KB - Virtual size: 23KB

.reloc Size: 4KB - Virtual size: 3KB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

07:1a:fa:b1:33:a9:e1:97:48:49:f2:6c
Certificate

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51
Certificate

5b:6c:f2:36:63:de:c9:b2:e0:ea:57:e2:78:e4:78:6d:4f:71:61:20:27:68:1f:43:7f:46:07:cf:fe:7e:f7:66
Signer

.text
Size: 156KB - Virtual size: 153KB

.rdata
Size: 104KB - Virtual size: 100KB

.data
Size: 8KB - Virtual size: 7KB

.pdata
Size: 12KB - Virtual size: 10KB

.rsrc
Size: 24KB - Virtual size: 23KB

.reloc
Size: 4KB - Virtual size: 3KB