2d5c8e08024bcd18f2bcee72e6eefe4b53a0c40333926061dac3964633e62ea1_NeikiAnalytics[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2d5c8e08024bcd18f2bcee72e6eefe4b53a0c40333926061dac3964633e62ea1_NeikiAnalytics.exe
Size

1.2MB
MD5

89b3edf8c0378876856395d4706e9880
SHA1

87683e8fb65914fc7f843709915f913663b80645
SHA256

2d5c8e08024bcd18f2bcee72e6eefe4b53a0c40333926061dac3964633e62ea1
SHA512

1664840eefea79304ebfe05232b7755cb42108d52d6821f13a0cddf3b4f69a9730c80ef2b37177e62479877a767bf290d90e5ac4677c8316ce1f74949b9d9e28
SSDEEP

24576:kPAI8MVan8oes2/mqkAN7916PqRaCbBVuimMGpi9ZVWN:kPAIbVa8o2WU7/WqRBbBVuUw

Score

1^/10

Malware Config

Signatures

Files

2d5c8e08024bcd18f2bcee72e6eefe4b53a0c40333926061dac3964633e62ea1_NeikiAnalytics.exe
.exe windows:6 windows x64 arch:x64

d18225b587c2543b6d5d073ee1516ad1

Code Sign

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:50

Not After

16/10/2024, 19:50

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:28:fb:4d:71:c1:f6:4a:f8:9c:0f:37:3b:33:db:02:5c:95:83:80:6a:fa:72:86:4d:61:23:01:e3:5c:d8:c3
Signer

Actual PE Digest

ef:28:fb:4d:71:c1:f6:4a:f8:9c:0f:37:3b:33:db:02:5c:95:83:80:6a:fa:72:86:4d:61:23:01:e3:5c:d8:c3

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dbs\sh\odct\0521_205857_1\client\onedrive\Product\FileCoAuth\Desktop\exe\obj\amd64\FileCoAuth.pdb

Imports

loggingplatform

?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z
?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z
?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ
?GetActiveHydrationsCount@QoS@@YAIXZ
??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z
??1TelemetryEvent@@QEAA@XZ
?SetEventExpiration@TelemetryEvent@@QEAAXII@Z
?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z
?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA
?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z
??0TransferScope@ScenarioTracking@@QEAA@QEBVITrace@1@@Z
?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ
??1Scope@ScenarioTracking@@QEAA@XZ
??0Scope@ScenarioTracking@@QEAA@V?$shared_ptr@VIScenario@ScenarioTracking@@@std@@@Z
?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z
?LoggingSetCommonDatapoint@@YAXPEB_W0@Z
??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z
?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z
?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
??1TransferScope@ScenarioTracking@@QEAA@XZ
?LoggingRotateIfNeeded@@YAXXZ
?CaptureTrace@ScenarioTracking@@YA?AV?$unique_ptr@VITrace@ScenarioTracking@@U?$default_delete@VITrace@ScenarioTracking@@@std@@@std@@XZ

api-ms-win-core-winrt-error-l1-1-0

RoTransformError

telemetry

?Report@OCSIScenario@@SAXJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Report@IncomingTelemetry@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00JV?$duration@_JU?$ratio@$00$0DLJKMKAA@@std@@@chrono@3@00V?$optional@_N@3@@Z
??1OCSIScenario@@UEAA@XZ
??0OCSIScenario@@QEAA@XZ

updateringsettings

?GetUpdateRingSettingsManager@@YAPEAVIUpdateRingSettingsManager@@XZ
?GetECSConfigurationManager@@YAPEAVIECSConfigurationManager@@XZ

propsys

PropVariantToUInt32
PropVariantToStringAlloc

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
VerSetConditionMask
NtQueryDirectoryFile
RtlNtStatusToDosError

kernel32

GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetVolumePathNameW
ReadFile
RemoveDirectoryW
SetFileInformationByHandle
SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
ReadDirectoryChangesW
CreateSymbolicLinkW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProductInfo
VerifyVersionInfoW
SetLastError
ReleaseMutex
WaitForMultipleObjects
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessTimes
GetExitCodeProcess
GetDiskFreeSpaceExW
SetProcessShutdownParameters
GetSystemTimes
SetThreadInformation
GetProcessIoCounters
GetPrivateProfileStringW
WritePrivateProfileStringW
SetDllDirectoryW
CopyFileW
MoveFileExW
CreateDirectoryW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetDllDirectoryW
GetTickCount64
SetThreadPriority
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
OutputDebugStringW
InitOnceBeginInitialize
InitOnceComplete
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetLongPathNameW
GetTickCount
CreateEventExW
WaitForMultipleObjectsEx
FindNextFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
CreateProcessW
CreateFileW
QueueUserWorkItem
MoveFileWithProgressW
GetDateFormatW
OpenEventW
GetLocaleInfoW
OpenMutexW
SystemTimeToTzSpecificLocalTime
UnregisterApplicationRestart
DuplicateHandle
GetVolumeInformationW
K32GetModuleFileNameExW
GetUserDefaultLocaleName
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
MoveFileW
LocalAlloc
LoadLibraryW
FreeLibrary
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateMutexW
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
LocalFree
GetCurrentThread
SetFileAttributesW
GetFileAttributesW
CompareStringOrdinal
QueryFullProcessImageNameW
GetCurrentProcess
IsWow64Process
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetCommandLineW
HeapFree
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
FormatMessageW
DebugBreak
WerRegisterFile
GetComputerNameExW
GetLogicalDrives
GetCurrentDirectoryW
InterlockedPushEntrySList
GetDriveTypeW
ReplaceFileW

user32

RegisterClassW
UnregisterPowerSettingNotification
CreateWindowExW
RegisterPowerSettingNotification
GetProcessDefaultLayout
LoadImageW
SendMessageW
FindWindowW
ShowWindow
SetForegroundWindow
AllowSetForegroundWindow
MessageBoxW
AdjustWindowRectEx
SetWindowPos
EmptyClipboard
GetClipboardData
GetWindowLongW
MapWindowPoints
IsHungAppWindow
OpenClipboard
GetLastInputInfo
GetClassInfoExW
LoadIconW
IsWindow
EndDialog
ModifyMenuW
PostThreadMessageW
CloseClipboard
CharNextW
DispatchMessageW
RegisterClassExW
GetClientRect
SendMessageTimeoutW
LoadCursorW
SetCursor
CharUpperW
SetFocus
SetTimer
KillTimer
SystemParametersInfoW
GetSysColor
MsgWaitForMultipleObjectsEx
AppendMenuW
DeleteMenu
RemoveMenu
GetIconInfo
PostQuitMessage
PeekMessageW
GetWindowThreadProcessId
GetClassNameW
GetWindowRect
GetMenuItemCount
TrackPopupMenu
EnumWindows
GetSubMenu
PostMessageW
GetDoubleClickTime
SetMenuDefaultItem
EnableMenuItem
GetLastActivePopup
GetMenuStringW
SetClipboardData
TranslateMessage
RegisterClipboardFormatW
DestroyWindow
GetMessageW

advapi32

CryptGetHashParam
InitializeAcl
CreateProcessWithTokenW
GetUserNameW
GetAce
SetFileSecurityW
CreateProcessAsUserW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
StartServiceW
DeleteAce
AddAce
CheckTokenMembership
RegNotifyChangeKeyValue
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CryptDestroyHash
CryptHashData
CryptCreateHash
ConvertStringSidToSidW
CryptReleaseContext
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
AdjustTokenPrivileges
AccessCheck
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
DuplicateToken
MapGenericMask
IsValidAcl
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCopyTreeW

shell32

SHAppBarMessage
SHQueryUserNotificationState
ShellExecuteW
Shell_NotifyIconW
ord526
SHSetKnownFolderPath
SHGetFolderPathAndSubDirW
SHGetFolderPathW
SHAssocEnumHandlers
ShellExecuteExW
SHParseDisplayName
SHChangeNotify
SHGetKnownFolderPath
SHGetSpecialFolderPathW
SHFileOperationW
CommandLineToArgvW
SHCreateItemFromParsingName
SHGetKnownFolderItem
AssocCreateForClasses
SHBrowseForFolderW
SHGetPathFromIDListW
SHCreateDirectoryExW

ole32

StringFromCLSID
CoImpersonateClient
PropVariantClear
CoAllowSetForegroundWindow
CoGetCallContext
CoRevertToSelf
CLSIDFromString
CoTaskMemFree
CoTaskMemAlloc
CoWaitForMultipleHandles
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoAddRefServerProcess
CoInitializeEx
CoRevokeClassObject
CoResumeClassObjects
CoRegisterClassObject
CoSetProxyBlanket
CoCreateGuid
CreateItemMoniker
GetRunningObjectTable
CoUninitialize
CoCreateInstance
CoGetObject
CreateBindCtx
CoInitializeSecurity
StringFromGUID2

oleaut32

GetErrorInfo
SafeArrayAccessData
SafeArrayUnaccessData
SetErrorInfo
SysStringLen
SysAllocString
RegisterTypeLi
SysFreeString
LoadTypeLi
UnRegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
GetRecordInfoFromTypeInfo

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CertFindExtension

rpcrt4

RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcServerInqBindings
RpcBindingFree
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcStringFreeW
RpcServerRegisterIfEx
RpcServerInqCallAttributesW
UuidToStringW

secur32

GetUserNameExW

shlwapi

SHRegGetBoolUSValueW
SHStrDupW
PathFileExistsW
PathFindFileNameW
SHCreateStreamOnFileEx
SHRegCreateUSKeyW
AssocQueryStringW
SHRegSetUSValueW
AssocCreate
UrlEscapeW
UrlCreateFromPathW
SHGetValueW
SHRegGetUSValueW
PathIsDirectoryW
SHRegCloseUSKey
PathStripPathW
PathStripToRootW
PathIsPrefixW
StrStrIW
PathRemoveFileSpecW
PathIsDirectoryEmptyW
SHDeleteKeyW
SHDeleteValueW
SHGetValueA
SHSetValueW
SHRegGetPathW
SHRegGetValueW
SHCreateStreamOnFileW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

wininet

InternetCheckConnectionW
InternetGetConnectedState

wtsapi32

WTSQueryUserToken
WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW

msvcp140

?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?_Random_device@std@@YAIXZ
_Cnd_do_broadcast_at_thread_exit
_Mtx_current_owns
_Cnd_timedwait
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_detach
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Xtime_get_ticks
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
_Cnd_unregister_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHH@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Incref@facet@locale@std@@UEAAXXZ

userenv

GetDefaultUserProfileDirectoryW
CreateEnvironmentBlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception
wcsstr
wcsrchr
__RTDynamicCast
__std_type_info_compare
__current_exception_context
__C_specific_handler
memcmp
strchr
__std_exception_destroy
__std_exception_copy
_purecall
__std_terminate
wcschr
_CxxThrowException
memcpy
memmove
memset
__std_type_info_name

api-ms-win-crt-heap-l1-1-0

_set_new_mode
malloc
free
realloc
_callnewh

api-ms-win-crt-string-l1-1-0

isalnum
_strnicmp
strncmp
toupper
towlower
towupper
iswxdigit
_wcsnicmp
_wcsdup
wcscmp
_wcsicmp
wcsncmp
iswspace
wcstok_s
wcsncpy_s
wcscat_s
isxdigit
wcscspn
wcscpy_s
tolower

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
terminate
_beginthreadex
abort
_beginthread
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_initialize_onexit_table
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_invalid_parameter_noinfo
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-locale-l1-1-0

_free_locale
localeconv
_configthreadlocale
_create_locale

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf
ungetc
setvbuf
__stdio_common_vswprintf
fwrite
_fseeki64
fsetpos
fread
fputc
fgetpos
fgetc
fflush
fclose
_get_stream_buffer_pointers
_wfopen_s

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr
_dsign
ceilf

api-ms-win-crt-convert-l1-1-0

atol
strtoull
_wtoi
atof
_strtod_l
strtoll
wcstoul
wcstoll
strtod

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file
_stat64i32

filesyncsessions

GetSettingsPersistence

gdi32

GetObjectW

Sections

.text
Size: 791KB - Virtual size: 790KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 300KB - Virtual size: 299KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 50KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d18225b587c2543b6d5d073ee1516ad1

Code Sign

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4fCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

ef:28:fb:4d:71:c1:f6:4a:f8:9c:0f:37:3b:33:db:02:5c:95:83:80:6a:fa:72:86:4d:61:23:01:e3:5c:d8:c3Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

loggingplatform

api-ms-win-core-winrt-error-l1-1-0

telemetry

updateringsettings

propsys

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

filesyncsessions

gdi32

Sections

.text Size: 791KB - Virtual size: 790KB

.rdata Size: 300KB - Virtual size: 299KB

.data Size: 50KB - Virtual size: 61KB

.pdata Size: 35KB - Virtual size: 35KB

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 8KB - Virtual size: 7KB

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4f
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

ef:28:fb:4d:71:c1:f6:4a:f8:9c:0f:37:3b:33:db:02:5c:95:83:80:6a:fa:72:86:4d:61:23:01:e3:5c:d8:c3
Signer

.text
Size: 791KB - Virtual size: 790KB

.rdata
Size: 300KB - Virtual size: 299KB

.data
Size: 50KB - Virtual size: 61KB

.pdata
Size: 35KB - Virtual size: 35KB

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 8KB - Virtual size: 7KB