2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe
Size 3.2MB
Sample240704-bmw59ayake
SHA256 2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29
MD5 4b362951de01e8de774ff98d1fcd04ce
SHA1 5b433fe0dbd449f6a04388fade733f0d1d250252
SHA512 5f1d793e930374fbf3b5cca767605a7ee2cfd48d95eea4f273e7a70e043c19dae3669ab471ec2d0a98d9454eb6edc83ec5335918c26190e04de6770642e1628e
SSDEEP 49152:dsjxBrEi/YD4ocuJ5txUJGvSEmrxlbTT1zVIZZpEkQuPQLAkOWMuG8lAKRRmxvIy:dsjxBrEMYD4ocuEbr1yZERuYLi/imKNE
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe

.exe 3.2MB

2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe

IMPHASH bb63f430314ffea0ccc724724b66a8e8
SHA256 2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29
MD5 4b362951de01e8de774ff98d1fcd04ce
SHA1 5b433fe0dbd449f6a04388fade733f0d1d250252
SHA512 5f1d793e930374fbf3b5cca767605a7ee2cfd48d95eea4f273e7a70e043c19dae3669ab471ec2d0a98d9454eb6edc83ec5335918c26190e04de6770642e1628e
SSDEEP 49152:dsjxBrEi/YD4ocuJ5txUJGvSEmrxlbTT1zVIZZpEkQuPQLAkOWMuG8lAKRRmxvIy:dsjxBrEMYD4ocuEbr1yZERuYLi/imKNE
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

0c:4a:e2:90:c0:ec:67:ef:e7:c7:16:61:0a:59:f1:11:cf:1b:64:57:cc:0b:e5:df:88:c6:83:7c:45:3b:29:e9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=91210242MA0YGH36XJ,CN=DauLue Intention Fly Network Technology Co.\, Ltd.,O=DauLue Intention Fly Network Technology Co.\, Ltd.,L=Dalian,ST=Liaoning,C=CN,1.3.6.1.4.1.311.60.2.1.1=#130644616c69616e,1.3.6.1.4.1.311.60.2.1.2=#13084c69616f6e696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Jun 24, 2024

Subject

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

bb:f0:cc:b5:b7:b8:31:fd:21:ae:32:77:8a:e4:0c:89

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 19, 2021 - May 18, 2036

Subject

Serial Number

02:20:f9:d4:79:65:39:f8:94:30:af:2a:2d:b6:a4:fe

Issuer

CN=Certum Extended Validation Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2024 - Apr 16, 2025

Subject

CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

Serial Number

01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Nov 7, 2023 - Dec 9, 2034

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Serial Number

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jun 20, 2018 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

541023

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BuildAgent\work\che-trunk-git-yandex-ru\win\YandexDiskUploaderSetup\Release\YandexDiskSetup.pdb

kernel32

DeleteCriticalSection GetProcessHeap GetModuleFileNameW GetCurrentThreadId GetCurrentProcess EnterCriticalSection LeaveCriticalSection InitializeCriticalSection SetUnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW GetVersionExW GetNativeSystemInfo GetModuleHandleW CreateMutexW GetSystemTimeAsFileTime GetComputerNameW FreeResource LockResource LoadResource SizeofResource FindResourceW GetTempPathW GlobalAlloc GlobalLock GlobalUnlock GlobalFree FormatMessageW LocalFree Process32FirstW Process32NextW OpenProcess CreateToolhelp32Snapshot WaitForSingleObject CreateEventW SetEvent ResetEvent SetWaitableTimer ReleaseMutex GetExitCodeThread SetLastError InterlockedExchange InterlockedDecrement InterlockedIncrement GetExitCodeProcess TerminateProcess CreateProcessW GetCommandLineW FindResourceExW GetUserDefaultUILanguage CreateDirectoryW RemoveDirectoryW UnlockFile LockFile QueryPerformanceCounter MulDiv lstrlenW CompareStringW GlobalReAlloc lstrcmpiW LoadLibraryExW Sleep lstrcmpW WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW DecodePointer GetOEMCP IsValidCodePage FindFirstFileExW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetConsoleMode GetConsoleCP ExitProcess QueryPerformanceFrequency GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread SetConsoleCtrlHandler RtlUnwind GetUserDefaultLCID GetStringTypeExW LoadLibraryA GetFileType GetStdHandle VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList OutputDebugStringW SystemTimeToFileTime CreateWaitableTimerA OpenEventA CreateEventA WaitForMultipleObjectsEx FormatMessageA AreFileApisANSI DeviceIoControl SetFilePointerEx SetEndOfFile GetEnvironmentVariableW GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent UnhandledExceptionFilter InitializeSListHead WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW EncodePointer TlsFree TlsSetValue TlsGetValue TlsAlloc SwitchToThread GetStringTypeW LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo HeapAlloc RaiseException HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount HeapFree MultiByteToWideChar GetACP WideCharToMultiByte ReadFile FindClose HeapDestroy FindNextFileW FindFirstFileW WriteFile SetFilePointer FlushFileBuffers GetFileSize GetFileAttributesW MoveFileW GetLocalTime GetCurrentProcessId GetModuleHandleA LoadLibraryW GetLastError SetErrorMode FreeLibrary CreateFileW DeleteFileW CloseHandle GetTickCount GetProcAddress GetCommandLineA

user32

IsChild UnregisterClassW RegisterWindowMessageW GetClassNameW RedrawWindow GetMessageW TranslateMessage DispatchMessageW SystemParametersInfoW GetSysColor GetSystemMetrics ShowWindow SetForegroundWindow IsWindow GetActiveWindow WaitForInputIdle MessageBoxW SendMessageW GetDC ReleaseDC SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW LoadStringW OffsetRect UnionRect SetWindowTextW InvalidateRect BeginPaint EndPaint GetClientRect PtInRect ScreenToClient GetFocus DrawFocusRect ClientToScreen GetParent LoadImageW FillRect GetSysColorBrush SetCapture GetWindowTextW CreateAcceleratorTableW InvalidateRgn GetDesktopWindow DestroyAcceleratorTable PeekMessageW CharNextW MapDialogRect DialogBoxIndirectParamW EndDialog GetWindowTextLengthW DrawTextW DeleteMenu GetDlgItem DestroyCursor LoadCursorW GetClassInfoExW RegisterClassExW CreateDialogIndirectParamW GetSystemMenu EnableMenuItem SetFocus GetWindow MonitorFromWindow GetMonitorInfoW GetWindowRect MapWindowPoints DestroyWindow IsDialogMessageW PostQuitMessage GetCursorPos GetCursor ReleaseCapture GetCapture SetCursor CreateWindowExW SetTimer AdjustWindowRectEx GetMenu KillTimer SetWindowPos PostMessageW MoveWindow

gdi32

SetTextColor DeleteDC DeleteObject GetObjectW SetBkMode SelectObject GetDeviceCaps CreateSolidBrush CreateCompatibleBitmap CreateCompatibleDC BitBlt CreateFontIndirectW GetStockObject SetWindowOrgEx GetCurrentObject SetViewportOrgEx

shell32

ShellExecuteExW CommandLineToArgvW ShellExecuteW SHBrowseForFolderW ord165 SHGetFolderPathW SHGetPathFromIDListW

ole32

CLSIDFromProgID CoGetClassObject OleLockRunning CoTaskMemAlloc CoTaskMemRealloc CreateStreamOnHGlobal CLSIDFromString StringFromGUID2 CoUninitialize CoInitializeEx OleUninitialize OleInitialize CoTaskMemFree CoCreateGuid CoCreateInstance

oleaut32

SysAllocStringLen LoadTypeLi LoadRegTypeLi OleCreateFontIndirect VarUI4FromStr VariantInit SysStringLen VariantClear SysFreeString SysAllocString

shlwapi

PathFileExistsW PathFindFileNameW ord176

comctl32

InitCommonControlsEx

uxtheme

GetThemeFont OpenThemeData GetThemeColor

psapi

GetModuleFileNameExW

gdiplus

GdipDeleteBrush GdipCreateSolidFill GdipCreateFromHDC GdipDrawImageRectI GdipSetInterpolationMode GdipGetImageGraphicsContext GdipDisposeImage GdipCreateBitmapFromScan0 GdipGetImageWidth GdipGetImageHeight GdipCloneImage GdipAlloc GdipFree GdipLoadImageFromStream GdipFillRectangleI GdiplusStartup GdiplusShutdown GdipDeleteGraphics

rpcrt4

UuidCreate

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpConnect WinHttpOpen WinHttpCloseHandle WinHttpSetTimeouts WinHttpQueryOption WinHttpQueryHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSetOption WinHttpSendRequest WinHttpSetStatusCallback WinHttpReceiveResponse WinHttpCrackUrl

crypt32

CertFreeCertificateContext CertGetCertificateChain CertCreateCertificateChainEngine CertNameToStrW CertFreeCertificateChainEngine CertFreeCertificateChain CryptProtectData

wintrust

WinVerifyTrust

?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA ?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA ??0?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@QAE@XZ ??0?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@QAE@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ ?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ ?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ ?get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ ?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ ?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ ?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ ?instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@A ?instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@A ?instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@A ?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A ?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A ?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A ?instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@A ?instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@A ?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A ?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A ?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A ?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A ?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ ?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z ?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@detail@34@A ?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@634@A ?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A

Sharing

General

Malware Config

Signatures

File Explorer

2de4a8c16d3643a3c58c63f4e7df2836919316635c05718dac1e474b6eb7fe29.exe

PE Signature issue

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

uxtheme

psapi

gdiplus

rpcrt4

version

winhttp

crypt32

wintrust

generic