e17ab1067eb7355906004f0106193558a2cf825a430621c0189c0094811453c0

Sharing

Copy URL Twitter E-mail

General

Target

e17ab1067eb7355906004f0106193558a2cf825a430621c0189c0094811453c0
Size

6.3MB
MD5

342809f268ef6a01e56370aadee71113
SHA1

457bc65b431caf416547fe1314690cffac599b20
SHA256

e17ab1067eb7355906004f0106193558a2cf825a430621c0189c0094811453c0
SHA512

e15370ada02e4cce2d7cee886310d6bf8f4d6b80170c92d21e1857487532157b2f4df43e9ea9e076504a53b766b8dd264e0f81fadbcce0f140775560a88480c9
SSDEEP

98304:SBY+av9Ux2kbxAlC11k9kszahq/CVXMMrlBWCkKJsv6tWKFdu9CzE+74l9g/:S+kK0YpShWCHJsv6tWKFdu9CzN77

Score

1^/10

Malware Config

Signatures

Files

e17ab1067eb7355906004f0106193558a2cf825a430621c0189c0094811453c0
.dll windows:4 windows x86 arch:x86

84928648910146ec922c3cd11e2c3400

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2d
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

18/09/2017, 00:00

Not After

24/11/2020, 23:59

Subject

CN=The Qt Company Oy,O=The Qt Company Oy,L=Oulu,ST=Oulu,C=FI

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d8:de:03:60:c0:e1:57:e2:42:92:d2:8c:ce:a7:81:68:53:63:68:71
Signer

Actual PE Digest

d8:de:03:60:c0:e1:57:e2:42:92:d2:8c:ce:a7:81:68:53:63:68:71

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

AccessCheck
AllocateAndInitializeSid
BuildTrusteeWithSidW
CopySid
DuplicateToken
FreeSid
GetEffectiveRightsFromAclW
GetLengthSid
GetNamedSecurityInfoW
GetTokenInformation
LookupAccountSidW
MapGenericMask
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegFlushKey
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
SystemFunction036

libgcc_s_dw2-1

_Unwind_Resume
__ctzdi2
__deregister_frame_info
__divdi3
__emutls_get_address
__moddi3
__popcountdi2
__popcountsi2
__register_frame_info
__udivdi3
__udivmoddi4
__umoddi3

kernel32

CancelIoEx
CloseHandle
CompareStringEx
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryW
CreateEventW
CreateFileMappingW
CreateFileW
CreateMutexW
CreateNamedPipeW
CreateProcessW
CreateSemaphoreW
CreateThread
DeleteCriticalSection
DeleteFileW
DeviceIoControl
DuplicateHandle
EnterCriticalSection
FileTimeToSystemTime
FindClose
FindCloseChangeNotification
FindFirstChangeNotificationW
FindFirstFileExW
FindFirstFileW
FindNextChangeNotification
FindNextFileW
FlushFileBuffers
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
GetCommandLineW
GetConsoleWindow
GetCurrencyFormatW
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileType
GetFullPathNameW
GetGeoInfoW
GetLastError
GetLocalTime
GetLocaleInfoW
GetLogicalDrives
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessId
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathW
GetThreadPriority
GetTickCount64
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserGeoID
GetUserPreferredUILanguages
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
GetVolumePathNamesForVolumeNameW
InitializeCriticalSection
IsDBCSLeadByteEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenFileMappingW
OpenProcess
OutputDebugStringW
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
ReadFile
ReadFileEx
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEndOfFile
SetErrorMode
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TzSpecificLocalTimeToSystemTime
UnhandledExceptionFilter
UnmapViewOfFile
UnregisterWaitEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
WriteFileEx

mpr

WNetGetUniversalNameW

msvcrt

___mb_cur_max_func
__argc
__doserrno
__p___argv
__pioinfo
__setusermatherr
_amsg_exit
_close
_endthreadex
_environ
_errno
_exit
_filelengthi64
_fileno
_get_osfhandle
_getdrive
_initterm
_iob
_lock
_lseeki64
_open_osfhandle
_putenv
_read
_snwprintf
_timezone
_tzname
_tzset
_unlock
_vsnprintf
_waccess
_wchmod
_wgetdcwd
_wgetenv_s
_write
abort
acos
asin
atoi
calloc
exit
fclose
feof
fflush
fgetpos
fgets
fprintf
fputc
fputs
fread
free
fsetpos
fwprintf
fwrite
getenv
ispunct
localeconv
localtime
log10
malloc
memchr
mktime
memcmp
memcpy
memmove
memset
puts
raise
rand
realloc
setlocale
srand
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strrchr
vfprintf
wcschr
wcscmp
wcscpy
wcslen

netapi32

NetApiBufferFree
NetShareEnum

ole32

CoCreateGuid
CoCreateInstance
CoInitialize
CoTaskMemFree
CoUninitialize

libwinpthread-1

pthread_mutex_lock
pthread_mutex_unlock

shell32

CommandLineToArgvW
SHGetKnownFolderPath

user32

CallNextHookEx
CharNextExA
CreateWindowExW
DefWindowProcW
DestroyWindow
DispatchMessageW
EnumWindows
GetQueueStatus
GetWindowLongW
GetWindowThreadProcessId
KillTimer
MessageBoxW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
PostThreadMessageW
RegisterClassW
RegisterDeviceNotificationW
SetTimer
SetWindowLongW
SetWindowsHookExW
TranslateMessage
UnhookWindowsHookEx
UnregisterClassW
UnregisterDeviceNotification

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

timeKillEvent
timeSetEvent

ws2_32

WSAAsyncSelect
WSACleanup
WSAStartup
gethostname

libstdc++-6

_ZNKSt9exception4whatEv
_ZNSt15__exception_ptr13exception_ptrC1ERKS0_
_ZNSt15__exception_ptr13exception_ptrD1Ev
_ZNSt15__exception_ptreqERKNS_13exception_ptrES2_
_ZNSt18condition_variable4waitERSt11unique_lockISt5mutexE
_ZNSt6locale7classicEv
_ZNSt9bad_allocD1Ev
_ZNSt9exceptionD2Ev
_ZSt17rethrow_exceptionNSt15__exception_ptr13exception_ptrE
_ZSt20__throw_future_errori
_ZSt20__throw_system_errori
_ZSt7nothrow
_ZSt9terminatev
_ZSt9use_facetISt5ctypeIcEERKT_RKSt6locale
_ZTVN10__cxxabiv117__class_type_infoE
_ZTVN10__cxxabiv120__si_class_type_infoE
_ZTVN10__cxxabiv121__vmi_class_type_infoE
_ZTVSt9bad_alloc
_ZdaPv
_ZdaPvj
_ZdlPv
_ZdlPvRKSt9nothrow_t
_ZdlPvj
_Znaj
_ZnajRKSt9nothrow_t
_Znwj
_ZnwjRKSt9nothrow_t
__cxa_allocate_exception
__cxa_begin_catch
__cxa_end_catch
__cxa_guard_abort
__cxa_guard_acquire
__cxa_guard_release
__cxa_pure_virtual
__cxa_rethrow
__cxa_throw
__cxa_throw_bad_array_new_length
__gxx_personality_v0

Exports

Exports

_Z10forcepointR11QTextStream
_Z10noshowbaseR11QTextStream
_Z10qHBNewFacePvPF8HB_ErrorS_jPhPjE
_Z10qRandomCpuPvi
_Z10qShapeItemP14HB_ShaperItem_
_Z10qTerminatev
_Z10qvsnprintfPcjPKcS_
_Z10scientificR11QTextStream
_Z11noforcesignR11QTextStream
_Z11qHBFreeFaceP11HB_FaceRec_
_Z11qHBLoadFaceP11HB_FaceRec_
_Z11qUncompressPKhi
_Z11qWinAppInstv
_Z11qt_assert_xPKcS0_S0_i
_Z11qt_int_sqrtj
_Z12noforcepointR11QTextStream
_Z12qAppFileNamev
_Z12qFreeAlignedPv
_Z12qSharedBuildv
_Z13lowercasebaseR11QTextStream
_Z13qErrnoWarningPKcz
_Z13qErrnoWarningiPKcz
_Z13qFlagLocationPKc
_Z13uppercasebaseR11QTextStream
_Z14qAddPreRoutinePFvvE
_Z14qDecodeDataUrlRK4QUrlR7QStringR10QByteArray
_Z14qFloatDistancedd
_Z14qFloatDistanceff
_Z14qMallocAlignedjj
_Z14qWinAppCmdShowv
_Z14qt_cbor_tag_id8QCborTag
_Z15lowercasedigitsR11QTextStream
_Z15qAddPostRoutinePFvvE
_Z15qFloatToFloat16P8qfloat16PKfi
_Z15qIsEffectiveTLDRK10QStringRef
_Z15qReallocAlignedPvjjj
_Z15qTopLevelDomainRK7QString
_Z15qWinAppPrevInstv
_Z15qt_error_stringi
_Z15uppercasedigitsR11QTextStream
_Z16qGlobalQHashSeedv
_Z16qt_check_pointerPKci
_Z17qFloatFromFloat16PfPK8qfloat16i
_Z17qFormatLogMessage9QtMsgTypeRK18QMessageLogContextRK7QString
_Z17qt_localeFromLCIDm
_Z17qt_message_output9QtMsgTypeRK18QMessageLogContextRK7QString
_Z18qDetectCpuFeaturesv
_Z18qInstallMsgHandlerPFv9QtMsgTypePKcE
_Z18qRemovePostRoutinePFvvE
_Z18qSetMessagePatternRK7QString
_Z19qCalculateBlockSizejjj
_Z19qSetGlobalQHashSeedi
_Z19qcoreVariantHandlerv
_Z20processOpenModeFlags6QFlagsIN9QIODevice12OpenModeFlagEE
_Z20qEnvironmentVariablePKc
_Z20qEnvironmentVariablePKcRK7QString
_Z20qt_qFindChild_helperPK7QObjectRK7QStringRK11QMetaObject6QFlagsIN2Qt15FindChildOptionEE
_Z21qDeleteInEventHandlerP7QObject
_Z21qRegisterResourceDataiPKhS0_S0_
_Z21qt_call_post_routinesv
_Z21qt_cbor_simpletype_id15QCborSimpleType
_Z21qt_regexp_toCanonicalRK7QStringN7QRegExp13PatternSyntaxE
_Z22qInstallMessageHandlerPFv9QtMsgTypeRK18QMessageLogContextRK7QStringE
_Z23qUnregisterResourceDataiPKhS0_S0_
_Z23qt_qFindChildren_helperPK7QObjectRK18QRegularExpressionRK11QMetaObjectP5QListIPvE6QFlagsIN2Qt15FindChildOptionEE
_Z23qt_qFindChildren_helperPK7QObjectRK7QRegExpRK11QMetaObjectP5QListIPvE6QFlagsIN2Qt15FindChildOptionEE
_Z23qt_qFindChildren_helperPK7QObjectRK7QStringRK11QMetaObjectP5QListIPvE6QFlagsIN2Qt15FindChildOptionEE
_Z24qGlobalPostedEventsCountv
_Z24qcoreStateMachineHandlerv
_Z24qt_subtract_from_timeoutii
_Z25qEnvironmentVariableIsSetPKc
_Z26qCalculateGrowingBlockSizejjj
_Z26qt_QMetaEnum_debugOperatorR6QDebugiPK11QMetaObjectPKc
_Z27qEnvironmentVariableIsEmptyPKc
_Z28qEnvironmentVariableIntValuePKcPb
_Z29qRegisterStaticPluginFunction13QStaticPlugin
_Z29qt_applicationName_noFallbackv
_Z2wsR11QTextStream
_Z30qt_QMetaEnum_flagDebugOperatorR6QDebugji
_Z30qt_QMetaEnum_flagDebugOperatorR6QDebugyPK11QMetaObjectPKc
_Z32qt_register_signal_spy_callbacksRK21QSignalSpyCallbackSet
_Z3binR11QTextStream
_Z3bomR11QTextStream
_Z3decR11QTextStream
_Z3hexR11QTextStream
_Z3octR11QTextStream
_Z4endlR11QTextStream
_Z4leftR11QTextStream
_Z4qInfv
_Z5fixedR11QTextStream
_Z5flushR11QTextStream
_Z5qFreePv
_Z5qHash11QStringViewj
_Z5qHash13QLatin1Stringj
_Z5qHashRK10QByteArrayj
_Z5qHashRK10QCborArrayj
_Z5qHashRK10QCborValuej
_Z5qHashRK10QJsonArrayj
_Z5qHashRK10QJsonValuej
_Z5qHashRK10QStringRefj
_Z5qHashRK11QJsonObjectj
_Z5qHashRK14QVersionNumberj
_Z5qHashRK18QRegularExpressionj
_Z5qHashRK4QUrlj
_Z5qHashRK5QDatej
_Z5qHashRK5QTimej
_Z5qHashRK5QUuidj
_Z5qHashRK7QLocalej
_Z5qHashRK7QRegExpj
_Z5qHashRK7QStringj
_Z5qHashRK8QCborMapj
_Z5qHashRK9QBitArrayj
_Z5qHashRK9QDateTimej
_Z5qHashRK9QMimeTypej
_Z5qHashRK9QUrlQueryj
_Z5qHashdj
_Z5qHashej
_Z5qHashfj
_Z5qQNaNv
_Z5qSNaNv
_Z5qdtoadPiS_
_Z5qrandv
_Z5resetR11QTextStream
_Z5rightR11QTextStream
_Z6centerR11QTextStream
_Z6qIsInf8qfloat16
_Z6qIsInfd
_Z6qIsInff
_Z6qIsNaN8qfloat16
_Z6qIsNaNd
_Z6qIsNaNf
_Z6qbswapILi2EEPvPKviS0_
_Z6qbswapILi4EEPvPKviS0_
_Z6qbswapILi8EEPvPKviS0_
_Z6qsrandj
_Z6qtTrIdPKci
_Z7qMallocj
_Z7qMemSetPvij
_Z7qgetenvPKc
_Z7qputenvPKcRK10QByteArray
_Z7qstrcmpPKcS0_
_Z7qstrcmpRK10QByteArrayPKc
_Z7qstrcmpRK10QByteArrayS1_
_Z7qstrcpyPcPKc
_Z7qstrdupPKc
_Z7qstrtodPKcPS0_Pb
_Z7qt_hash11QStringViewj
_Z8qAppNamev
_Z8qMemCopyPvPKvj
_Z8qReallocPvj
_Z8qstricmpPKcS0_
_Z8qstrncpyPcPKcj
_Z8qstrntodPKciPS0_Pb
_Z8showbaseR11QTextStream
_Z9decodeMSGRK6tagMSG
_Z9forcesignR11QTextStream
_Z9qBadAllocv
_Z9qChecksumPKcj
_Z9qChecksumPKcjN2Qt12ChecksumTypeE
_Z9qCompressPKhii
_Z9qHashBitsPKvjj
_Z9qIsFinite8qfloat16
_Z9qIsFinited
_Z9qIsFinitef
_Z9qsnprintfPcjPKcz
_Z9qstrnicmpPKcS0_j
_Z9qstrnicmpPKciS0_i
_Z9qt_assertPKcS0_i
_Z9qunsetenvPKc
_ZN10QArrayData10deallocateEPS_jj
_ZN10QArrayData11shared_nullE
_ZN10QArrayData19reallocateUnalignedEPS_jj6QFlagsINS_16AllocationOptionEE
_ZN10QArrayData8allocateEjjj6QFlagsINS_16AllocationOptionEE
_ZN10QByteArray10fromBase64ERKS_
_ZN10QByteArray10fromBase64ERKS_6QFlagsINS_12Base64OptionEE
_ZN10QByteArray10setRawDataEPKcj
_ZN10QByteArray11fromRawDataEPKci
_ZN10QByteArray11reallocDataEj6QFlagsIN10QArrayData16AllocationOptionEE
_ZN10QByteArray14toLower_helperERKS_
_ZN10QByteArray14toLower_helperERS_
_ZN10QByteArray14toUpper_helperERKS_
_ZN10QByteArray14toUpper_helperERS_
_ZN10QByteArray14trimmed_helperERKS_
_ZN10QByteArray14trimmed_helperERS_
_ZN10QByteArray17simplified_helperERKS_
_ZN10QByteArray17simplified_helperERS_
_ZN10QByteArray19fromPercentEncodingERKS_c
_ZN10QByteArray4chopEi
_ZN10QByteArray4fillEci
_ZN10QByteArray5clearEv
_ZN10QByteArray6appendEPKc
_ZN10QByteArray6appendEPKci
_ZN10QByteArray6appendERKS_
_ZN10QByteArray6appendEc
_ZN10QByteArray6expandEi
_ZN10QByteArray6insertEiPKc
_ZN10QByteArray6insertEiPKci
_ZN10QByteArray6insertEiRKS_
_ZN10QByteArray6insertEic
_ZN10QByteArray6insertEiic
_ZN10QByteArray6numberEdci
_ZN10QByteArray6numberEii
_ZN10QByteArray6numberEji
_ZN10QByteArray6numberExi
_ZN10QByteArray6numberEyi
_ZN10QByteArray6removeEii
_ZN10QByteArray6resizeEi
_ZN10QByteArray6setNumEdci
_ZN10QByteArray6setNumExi
_ZN10QByteArray6setNumEyi
_ZN10QByteArray7fromHexERKS_
_ZN10QByteArray7prependEPKc
_ZN10QByteArray7prependEPKci
_ZN10QByteArray7prependERKS_
_ZN10QByteArray7prependEc
_ZN10QByteArray7replaceEPKcRKS_
_ZN10QByteArray7replaceEPKciS1_i
_ZN10QByteArray7replaceERKS_S1_
_ZN10QByteArray7replaceEcRKS_
_ZN10QByteArray7replaceEcc
_ZN10QByteArray7replaceEiiPKc
_ZN10QByteArray7replaceEiiPKci
_ZN10QByteArray7replaceEiiRKS_
_ZN10QByteArray8truncateEi
_ZN10QByteArrayC1EPKci
_ZN10QByteArrayC1EiN2Qt14InitializationE
_ZN10QByteArrayC1Eic
_ZN10QByteArrayC2EPKci
_ZN10QByteArrayC2EiN2Qt14InitializationE
_ZN10QByteArrayC2Eic
_ZN10QByteArrayaSEPKc
_ZN10QByteArrayaSERKS_
_ZN10QCborArray13fromJsonArrayERK10QJsonArray
_ZN10QCborArray14fromStringListERK11QStringList
_ZN10QCborArray15fromVariantListERK5QListI8QVariantE
_ZN10QCborArray5clearEv
_ZN10QCborArray6detachEi
_ZN10QCborArray6insertEiO10QCborValue
_ZN10QCborArray6insertEiRK10QCborValue
_ZN10QCborArray7extractENS_8IteratorE
_ZN10QCborArray8removeAtEi
_ZN10QCborArrayC1ERKS_
_ZN10QCborArrayC1Ev
_ZN10QCborArrayC2ERKS_
_ZN10QCborArrayC2Ev
_ZN10QCborArrayD1Ev
_ZN10QCborArrayD2Ev
_ZN10QCborArrayaSERKS_
_ZN10QCborError16staticMetaObjectE
_ZN10QCborValue11fromVariantERK8QVariant
_ZN10QCborValue13fromJsonValueERK10QJsonValue
_ZN10QCborValue16staticMetaObjectE
_ZN10QCborValue6toCborE6QFlagsINS_14EncodingOptionEE
_ZN10QCborValue6toCborER17QCborStreamWriter6QFlagsINS_14EncodingOptionEE
_ZN10QCborValue7disposeEv
_ZN10QCborValue8fromCborER17QCborStreamReader
_ZN10QCborValue8fromCborERK10QByteArrayP16QCborParserError
_ZN10QCborValueC1E13QLatin1String
_ZN10QCborValueC1E8QCborTagRKS_
_ZN10QCborValueC1ERK10QByteArray
_ZN10QCborValueC1ERK10QCborArray
_ZN10QCborValueC1ERK18QRegularExpression
_ZN10QCborValueC1ERK4QUrl
_ZN10QCborValueC1ERK5QUuid
_ZN10QCborValueC1ERK7QString
_ZN10QCborValueC1ERK8QCborMap
_ZN10QCborValueC1ERK9QDateTime
_ZN10QCborValueC1ERKS_
_ZN10QCborValueC2E13QLatin1String
_ZN10QCborValueC2E8QCborTagRKS_
_ZN10QCborValueC2ERK10QByteArray
_ZN10QCborValueC2ERK10QCborArray
_ZN10QCborValueC2ERK18QRegularExpression
_ZN10QCborValueC2ERK4QUrl
_ZN10QCborValueC2ERK5QUuid
_ZN10QCborValueC2ERK7QString
_ZN10QCborValueC2ERK8QCborMap
_ZN10QCborValueC2ERK9QDateTime
_ZN10QCborValueC2ERKS_
_ZN10QCborValueaSERKS_
_ZN10QEventLoop11qt_metacallEN11QMetaObject4CallEiPPv
_ZN10QEventLoop11qt_metacastEPKc
_ZN10QEventLoop13processEventsE6QFlagsINS_17ProcessEventsFlagEE
_ZN10QEventLoop13processEventsE6QFlagsINS_17ProcessEventsFlagEEi
_ZN10QEventLoop16staticMetaObjectE
_ZN10QEventLoop18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE
_ZN10QEventLoop4exitEi
_ZN10QEventLoop4quitEv
_ZN10QEventLoop5eventEP6QEvent
_ZN10QEventLoop6wakeUpEv
_ZN10QEventLoopC1EP7QObject
_ZN10QEventLoopC2EP7QObject
_ZN10QEventLoopD0Ev
_ZN10QEventLoopD1Ev
_ZN10QEventLoopD2Ev
_ZN10QExceptionD0Ev
_ZN10QExceptionD1Ev
_ZN10QExceptionD2Ev
_ZN10QJsonArray10initializeEv
_ZN10QJsonArray14fromStringListERK11QStringList
_ZN10QJsonArray15fromVariantListERK5QListI8QVariantE
_ZN10QJsonArray6appendERK10QJsonValue
_ZN10QJsonArray6detachEj
_ZN10QJsonArray6insertEiRK10QJsonValue
_ZN10QJsonArray6takeAtEi
_ZN10QJsonArray7compactEv
_ZN10QJsonArray7detach2Ej
_ZN10QJsonArray7prependERK10QJsonValue
_ZN10QJsonArray7replaceEiRK10QJsonValue
_ZN10QJsonArray8removeAtEi
_ZN10QJsonArrayC1EPN12QJsonPrivate4DataEPNS0_5ArrayE
_ZN10QJsonArrayC1ERKS_
_ZN10QJsonArrayC1Ev
_ZN10QJsonArrayC2EPN12QJsonPrivate4DataEPNS0_5ArrayE
_ZN10QJsonArrayC2ERKS_
_ZN10QJsonArrayC2Ev
_ZN10QJsonArrayD1Ev
_ZN10QJsonArrayD2Ev
_ZN10QJsonArrayaSERKS_
_ZN10QJsonArrayixEi
_ZN10QJsonValue11fromVariantERK8QVariant
_ZN10QJsonValue27stringDataFromQStringHelperERK7QString
_ZN10QJsonValue6detachEv
_ZN10QJsonValueC1E13QLatin1String
_ZN10QJsonValueC1ENS_4TypeE
_ZN10QJsonValueC1EPN12QJsonPrivate4DataEPNS0_4BaseERKNS0_5ValueE
_ZN10QJsonValueC1ERK10QJsonArray
_ZN10QJsonValueC1ERK11QJsonObject
_ZN10QJsonValueC1ERK7QString
_ZN10QJsonValueC1ERKS_
_ZN10QJsonValueC1Eb
_ZN10QJsonValueC1Ed
_ZN10QJsonValueC1Ei
_ZN10QJsonValueC1Ex
_ZN10QJsonValueC2E13QLatin1String
_ZN10QJsonValueC2ENS_4TypeE
_ZN10QJsonValueC2EPN12QJsonPrivate4DataEPNS0_4BaseERKNS0_5ValueE
_ZN10QJsonValueC2ERK10QJsonArray
_ZN10QJsonValueC2ERK11QJsonObject
_ZN10QJsonValueC2ERK7QString
_ZN10QJsonValueC2ERKS_
_ZN10QJsonValueC2Eb
_ZN10QJsonValueC2Ed
_ZN10QJsonValueC2Ei
_ZN10QJsonValueC2Ex
_ZN10QJsonValueD1Ev
_ZN10QJsonValueD2Ev
_ZN10QJsonValueaSERKS_
_ZN10QMutexPool11createMutexEi
_ZN10QMutexPool17globalInstanceGetEPKv
_ZN10QMutexPool8instanceEv
_ZN10QMutexPoolC1EN6QMutex13RecursionModeEi
_ZN10QMutexPoolC2EN6QMutex13RecursionModeEi
_ZN10QMutexPoolD1Ev
_ZN10QMutexPoolD2Ev
_ZN10QRingChunk6detachEv
_ZN10QSemaphore10tryAcquireEi
_ZN10QSemaphore10tryAcquireEii
_ZN10QSemaphore7acquireEi
_ZN10QSemaphore7releaseEi
_ZN10QSemaphoreC1Ei
_ZN10QSemaphoreC2Ei
_ZN10QSemaphoreD1Ev
_ZN10QSemaphoreD2Ev
_ZN10QTextCodec11codecForMibEi
_ZN10QTextCodec12codecForHtmlERK10QByteArray
_ZN10QTextCodec12codecForHtmlERK10QByteArrayPS_
_ZN10QTextCodec12codecForNameERK10QByteArray
_ZN10QTextCodec13availableMibsEv
_ZN10QTextCodec14ConverterStateD1Ev
_ZN10QTextCodec14ConverterStateD2Ev
_ZN10QTextCodec14codecForLocaleEv
_ZN10QTextCodec15availableCodecsEv
_ZN10QTextCodec15codecForUtfTextERK10QByteArray
_ZN10QTextCodec15codecForUtfTextERK10QByteArrayPS_
_ZN10QTextCodec17setCodecForLocaleEPS_
_ZN10QTextCodecC1Ev
_ZN10QTextCodecC2Ev
_ZN10QTextCodecD0Ev
_ZN10QTextCodecD1Ev
_ZN10QTextCodecD2Ev
_ZN11QBasicMutex11isRecursiveEv
_ZN11QBasicMutex12lockInternalEi
_ZN11QBasicMutex12lockInternalEv
_ZN11QBasicMutex14unlockInternalEv
_ZN11QBasicTimer4stopEv
_ZN11QBasicTimer5startEiN2Qt9TimerTypeEP7QObject
_ZN11QBasicTimer5startEiP7QObject
_ZN11QChildEventC1EN6QEvent4TypeEP7QObject
_ZN11QChildEventC2EN6QEvent4TypeEP7QObject
_ZN11QChildEventD0Ev
_ZN11QChildEventD1Ev
_ZN11QChildEventD2Ev
_ZN11QDataStream10writeBytesEPKcj
_ZN11QDataStream11readRawDataEPci
_ZN11QDataStream11resetStatusEv
_ZN11QDataStream11skipRawDataEi
_ZN11QDataStream11unsetDeviceEv
_ZN11QDataStream12setByteOrderENS_9ByteOrderE
_ZN11QDataStream12writeRawDataEPKci
_ZN11QDataStream16abortTransactionEv
_ZN11QDataStream16startTransactionEv
_ZN11QDataStream17commitTransactionEv
_ZN11QDataStream19rollbackTransactionEv
_ZN11QDataStream25setFloatingPointPrecisionENS_22FloatingPointPrecisionE
_ZN11QDataStream9readBlockEPci
_ZN11QDataStream9readBytesERPcRj
_ZN11QDataStream9setDeviceEP9QIODevice
_ZN11QDataStream9setStatusENS_6StatusE
_ZN11QDataStreamC1EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QDataStreamC1EP9QIODevice
_ZN11QDataStreamC1ERK10QByteArray
_ZN11QDataStreamC1Ev
_ZN11QDataStreamC2EP10QByteArray6QFlagsIN9QIODevice12OpenModeFlagEE
_ZN11QDataStreamC2EP9QIODevice
_ZN11QDataStreamC2ERK10QByteArray
_ZN11QDataStreamC2Ev
_ZN11QDataStreamD1Ev
_ZN11QDataStreamD2Ev
_ZN11QDataStreamlsE8qfloat16
_ZN11QDataStreamlsEPKc
_ZN11QDataStreamlsEa
_ZN11QDataStreamlsEb
_ZN11QDataStreamlsEd
_ZN11QDataStreamlsEf
_ZN11QDataStreamlsEi
_ZN11QDataStreamlsEs
_ZN11QDataStreamlsEx
_ZN11QDataStreamrsER8qfloat16
_ZN11QDataStreamrsERPc
_ZN11QDataStreamrsERa
_ZN11QDataStreamrsERb
_ZN11QDataStreamrsERd
_ZN11QDataStreamrsERf
_ZN11QDataStreamrsERi
_ZN11QDataStreamrsERs
_ZN11QDataStreamrsERx
_ZN11QFileDevice10unsetErrorEv
_ZN11QFileDevice11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QFileDevice11qt_metacastEPKc
_ZN11QFileDevice11setFileTimeERK9QDateTimeNS_8FileTimeE
_ZN11QFileDevice12readLineDataEPcx
_ZN11QFileDevice14setPermissionsE6QFlagsINS_10PermissionEE
_ZN11QFileDevice16staticMetaObjectE
_ZN11QFileDevice18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN11QFileDevice3mapExxNS_14MemoryMapFlagsE
_ZN11QFileDevice4seekEx
_ZN11QFileDevice5closeEv
_ZN11QFileDevice5flushEv
_ZN11QFileDevice5unmapEPh
_ZN11QFileDevice6resizeEx
_ZN11QFileDevice8readDataEPcx
_ZN11QFileDevice9writeDataEPKcx
_ZN11QFileDeviceC1EP7QObject
_ZN11QFileDeviceC1ER18QFileDevicePrivateP7QObject
_ZN11QFileDeviceC1Ev
_ZN11QFileDeviceC2EP7QObject
_ZN11QFileDeviceC2ER18QFileDevicePrivateP7QObject
_ZN11QFileDeviceC2Ev
_ZN11QFileDeviceD0Ev
_ZN11QFileDeviceD1Ev
_ZN11QFileDeviceD2Ev
_ZN11QFinalState11qt_metacallEN11QMetaObject4CallEiPPv
_ZN11QFinalState11qt_metacastEPKc
_ZN11QFinalState16staticMetaObjectE
_ZN11QFinalState18qt_static_metacallEP7QObjectN11QMetaObject4CallEiPPv
_ZN11QFinalState5eventEP6QEvent
_ZN11QFinalState6onExitEP6QEvent
_ZN11QFinalState7onEntryEP6QEvent
_ZN11QFinalStateC1EP6QState
_ZN11QFinalStateC1ER18QFinalStatePrivateP6QState
_ZN11QFinalStateC2EP6QState
_ZN11QFinalStateC2ER18QFinalStatePrivateP6QState
_ZN11QFinalStateD0Ev
_ZN11QFinalStateD1Ev
_ZN11QFinalStateD2Ev
_ZN11QJsonObject10initializeEv
_ZN11QJsonObject10setValueAtEiRK10QJsonValue
_ZN11QJsonObject14fromVariantMapERK4QMapI7QString8QVariantE
_ZN11QJsonObject15fromVariantHashERK5QHashI7QString8QVariantE
_ZN11QJsonObject4findE13QLatin1String
_ZN11QJsonObject4findERK7QString
_ZN11QJsonObject4takeERK7QString
_ZN11QJsonObject5eraseENS_8iteratorE
_ZN11QJsonObject6detachEj
_ZN11QJsonObject6insertERK7QStringRK10QJsonValue
_ZN11QJsonObject6removeERK7QString
_ZN11QJsonObject7compactEv
_ZN11QJsonObject7detach2Ej
_ZN11QJsonObjectC1EPN12QJsonPrivate4DataEPNS0_6ObjectE
_ZN11QJsonObjectC1ERKS_
_ZN11QJsonObjectC1Ev
_ZN11QJsonObjectC2EPN12QJsonPrivate4DataEPNS0_6ObjectE
_ZN11QJsonObjectC2ERKS_
_ZN11QJsonObjectC2Ev
_ZN11QJsonObjectD1Ev
_ZN11QJsonObjectD2Ev
_ZN11QJsonObjectaSERKS_
_ZN11QJsonObjectixE13QLatin1String

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 505KB - Virtual size: 505KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 279KB - Virtual size: 278KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

84928648910146ec922c3cd11e2c3400

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2dCertificate

Extended Key Usages

Key Usages

d8:de:03:60:c0:e1:57:e2:42:92:d2:8c:ce:a7:81:68:53:63:68:71Signer

Headers

File Characteristics

Imports

advapi32

libgcc_s_dw2-1

kernel32

mpr

msvcrt

netapi32

ole32

libwinpthread-1

shell32

user32

userenv

version

winmm

ws2_32

libstdc++-6

Exports

Exports

Sections

.text Size: 3.6MB - Virtual size: 3.6MB

.data Size: 4KB - Virtual size: 4KB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.eh_fram Size: 505KB - Virtual size: 505KB

.bss Size: - Virtual size: 15KB

.edata Size: 279KB - Virtual size: 278KB

.idata Size: 11KB - Virtual size: 10KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.rsrc Size: 1024B - Virtual size: 824B

.reloc Size: 97KB - Virtual size: 96KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

06:e9:57:9a:ab:76:3e:72:07:99:89:c6:89:d2:b4:2d
Certificate

d8:de:03:60:c0:e1:57:e2:42:92:d2:8c:ce:a7:81:68:53:63:68:71
Signer

.text
Size: 3.6MB - Virtual size: 3.6MB

.data
Size: 4KB - Virtual size: 4KB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.eh_fram
Size: 505KB - Virtual size: 505KB

.bss
Size: - Virtual size: 15KB

.edata
Size: 279KB - Virtual size: 278KB

.idata
Size: 11KB - Virtual size: 10KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.rsrc
Size: 1024B - Virtual size: 824B

.reloc
Size: 97KB - Virtual size: 96KB