62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a

Resubmissions

10/07/2024, 12:56

240710-p6khfs1eng10

10/07/2024, 12:56

240710-p6ft9s1end10

10/07/2024, 12:55

240710-p57llaygpj10

Sharing

Copy URL Twitter E-mail

General

Target
62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a
Size 438KB
Sample240710-p57llaygpj
SHA256 62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a
MD5 9afb4103021c5ec8b2dea2772f39178e
SHA1 bc773e17fc6e7080b4243a9b72ac75292d17bc90
SHA512 82c5fd97d80bd79c0377b1c8ea3a6e2f00f10b7ae14febc0ba9c8e5bd1405c05f62f2c66db1571b0596bd0a459e32dd58c8e9bf894068418d5b40b54b488ef33
SSDEEP 12288:LW7Ck8jvhUX7Arm+PJnGdijUR9MEuqbZv:LWeLaQnhGEYjfhbZv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/Skriveblokkes/libdatrie-1.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a

.exe 438KB
$PLUGINSDIR/System.dll

.dll 11KB
Ansvarshavende.til

8KB
MonitorPlugin.dll

.dll 223KB
Skriveblokkes/battery-level-70-charging-symbolic.svg

.xml 6KB
Skriveblokkes/libdatrie-1.dll

.dll 35KB
Uncrosses.Mol

154KB
location-services-active-symbolic.symbolic.png

.png 257B

62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a

IMPHASH b78ecf47c0a3e24a6f4af114e2d1f5de
SHA256 62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a
MD5 9afb4103021c5ec8b2dea2772f39178e
SHA1 bc773e17fc6e7080b4243a9b72ac75292d17bc90
SHA512 82c5fd97d80bd79c0377b1c8ea3a6e2f00f10b7ae14febc0ba9c8e5bd1405c05f62f2c66db1571b0596bd0a459e32dd58c8e9bf894068418d5b40b54b488ef33
SSDEEP 12288:LW7Ck8jvhUX7Arm+PJnGdijUR9MEuqbZv:LWeLaQnhGEYjfhbZv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d3:19:74:5a:76:59:02:8c:77:50:81:e7:14:ba:0e:cf:81:d1:e2:77:c7:6b:62:06:35:4e:6b:ee:d9:bc:c8:6e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Chains

May 29, 2023

PE Signature issue

Digest

76:ab:10:cf:b9:c0:98:a2:66:af:fe:5b:29:38:11:b9:1e:d4:d6:d5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Chains

Jul 9, 2024

Subject

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Serial Number

1d:25:ed:1d:21:27:9c:31:ca:95:e3:1c:c9:0f:a3:e7:07:be:26:46

Issuer

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Timespan

Jun 30, 2022 - Jun 29, 2025

Subject

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Serial Number

1d:25:ed:1d:21:27:9c:31:ca:95:e3:1c:c9:0f:a3:e7:07:be:26:46

Issuer

OU=Louvers Nonfinishing\ ,O=Subiya,L=Riverside,ST=Utah,C=US,1.2.840.113549.1.9.1=#0c20556e7175657374696f6e696e674044796276616e6473626f6d6265722e61666c

Timespan

Jun 30, 2022 - Jun 29, 2025

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

12505

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA GetFileAttributesA SetFileAttributesA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess GetFullPathNameA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA ReadFile WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA GlobalUnlock GetDiskFreeSpaceA GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59
MD5 2ae993a2ffec0c137eb51c8832691bcb
SHA1 98e0b37b7c14890f8a599f35678af5e9435906e1
SHA512 2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9
SSDEEP 192:vPtkumJX7zB22kGwfy0mtVgkCPOsE1un:k702k5qpdsEQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

MonitorPlugin.dll

IMPHASH ef041f7605c2f0b880a648adcfb0fb41
SHA256 3675aec5dbcd6dbf423b560ab19c05a77c2263feec096ff597151fa175d77b6c
MD5 d49d9a33c97cf82a81b54d5313abd98b
SHA1 1b710bc03f5f40d587acf5ba42a8ce14bd7b853a
SHA512 ad745f628a8cbfe81e08b45160b4f0feff912edeed81311d514efd8230c44e34cfe357d22285a07b1454a4294076da106aa21a95455486080ca4871a265bd38b
SSDEEP 3072:EytEEFPjdWm016tEDl58lnkU6xlhtYntxRfh7CdSCMOKvB8cUvddneB+0TV6n5q4:ECt7dp+7U6xjtAVCdhKvBZjTmah4T
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

NSIS installer

installer

Digest

f0:d8:2f:cf:6a:ff:24:66:3e:e9:4e:61:73:27:d0:4e:33:75:99:6b:90:d9:57:74:69:99:f3:61:b1:9c:0c:ab

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=23638777,CN=ASUSTEK COMPUTER INCORPORATION,O=ASUSTEK COMPUTER INCORPORATION,STREET=4F\, NO. 150\, LI-TE RD.\, PEI TOU,L=TAIPEI,ST=TAIPEI,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 10, 2021

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Serial Number

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Timespan

Sep 19, 2018 - Jan 28, 2028

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Serial Number

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning

Timespan

Jun 15, 2016 - Jun 15, 2024

Subject

Serial Number

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 4, 2019 - Jun 4, 2022

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

137416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\SourceCode\GC3.Overclocking\production_V4.2\Service\ServiceSDK\Release\ThrottlePlugin\MonitorPlugin.pdb

kernel32

FlushFileBuffers WriteFile DuplicateHandle GetOverlappedResult lstrlenW WTSGetActiveConsoleSessionId GetPrivateProfileStringW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent CreateThread GetExitCodeProcess TerminateProcess GetCurrentProcess WaitForMultipleObjects Sleep ResetEvent LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy SetFileAttributesW FindResourceW DeleteFileW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount MultiByteToWideChar IsDebuggerPresent SystemTimeToFileTime FileTimeToSystemTime lstrcmpA SetLastError FileTimeToLocalFileTime CreateFileW LocalFree LoadLibraryW GetProcAddress GetModuleFileNameW CreateEventW WaitForSingleObject SetEvent DeleteCriticalSection SizeofResource InitializeCriticalSectionEx GetLastError RaiseException CloseHandle LockResource LoadResource LoadLibraryExW FreeLibrary FindResourceExW GetCurrentProcessorNumberEx OpenProcess GetThreadId CreateProcessW GetFileAttributesW GetCurrentThreadId OutputDebugStringW

user32

wsprintfW RegisterWindowMessageW GetWindowThreadProcessId GetShellWindow

advapi32

OpenProcessToken AdjustTokenPrivileges DuplicateTokenEx GetTokenInformation InitializeSecurityDescriptor SetSecurityDescriptorDacl LookupPrivilegeValueW CreateProcessWithTokenW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW RegDeleteKeyExW CreateProcessAsUserW

shell32

SHGetKnownFolderPath SHGetSpecialFolderPathW

ole32

CoCreateInstance CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

shlwapi

PathFileExistsW PathRemoveFileSpecW PathAddBackslashW PathAppendW StrCmpW

nativegamingcenterhelper

GetCPUVendor One_WMIMethod_INT GetProcessorNameString RetriveSystemInfo CheckXTUImagePath IsXTUServiceRunning HasBeenUsed StartXTUService StartUsed

gpucontrollibrary

?WriteUnlock@CSharedSectionWrapper@@QEAAXXZ ?WriteLock@CSharedSectionWrapper@@QEAAXXZ ??1CSharedSectionWrapper@@QEAA@XZ ??0CSharedSectionWrapper@@QEAA@XZ ?DestroyDevice@DisplayAdapterController@@QEAAJPEAPEAUIDisplayAdapterDevice@@@Z ?CreateDevice@DisplayAdapterController@@QEAAJPEAPEAUIDisplayAdapterDevice@@@Z ?Refresh@DisplayAdapterController@@QEAAXK@Z ?Uninitialize@DisplayAdapterController@@QEAAHPEAX@Z ?Initialize@DisplayAdapterController@@QEAAHPEAXP6AX0@Z@Z ?Get@DisplayAdapterController@@SAPEAV1@XZ ?ReadUnlock@CSharedSectionWrapper@@QEAAXXZ ?ReadLock@CSharedSectionWrapper@@QEAAXXZ

xtuwrapperfornativecode

?StartMonitor@XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAAXXZ ?IsMonitorRunning@XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAA_NXZ ?GetMonitorValue@XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAANI@Z ??0XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAA@XZ ?Initialize@XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAA_NXZ ??1XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAA@XZ ?StopMonitor@XTUWrapperForNativeCode@XTUWrapperLibrary@@QEAAXXZ

msvcp140

?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

bcrypt

BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptImportKey BCryptDecrypt BCryptGetProperty

pdh

PdhCloseQuery PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhCollectQueryData PdhOpenQueryW PdhRemoveCounter

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken WTSEnumerateSessionsW

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

externalgpuconfighelper

?GetEGPUID@CDockingController@@QEAAJPEAU_EGC_GPUID@@@Z ?Uninitialize@CDockingController@@QEAAHPEAX@Z ?Initialize@CDockingController@@QEAAHPEAXP6AX0@Z@Z ?Get@CDockingController@@SAPEAV1@XZ ?GetEGPUConfig@CDockingController@@QEAAJPEAPEAU_EGC_BASEINFO@@PEAGPEAK@Z ?GetFanSpeed@CDockingController@@QEAAJPEAK0@Z

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo

crypt32

CryptQueryObject CertGetNameStringW CertFreeCertificateContext CertFindCertificateInStore CertCloseStore CryptMsgGetParam CryptDecodeObject CryptMsgClose

wintrust

WinVerifyTrust

vcruntime140

__std_type_info_destroy_list _purecall memcmp memmove __C_specific_handler wcsstr __std_exception_destroy __std_exception_copy memcpy __CxxFrameHandler3 __std_terminate _CxxThrowException memset

api-ms-win-crt-runtime-l1-1-0

_cexit _initterm _execute_onexit_table _register_onexit_function _initialize_onexit_table _crt_atexit _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _errno _invalid_parameter_noinfo

api-ms-win-crt-string-l1-1-0

wcsncmp wcscpy_s _wcsicmp wcscat_s towlower wmemcpy_s wcsncpy_s _wcsnicmp _stricmp strncpy_s

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers fclose __stdio_common_vsnwprintf_s fflush __stdio_common_vsscanf fgetc fgetpos __stdio_common_vsprintf_s fputc __stdio_common_vswprintf_s fread __stdio_common_vswprintf fsetpos _fseeki64 ungetc setvbuf fwrite

api-ms-win-crt-math-l1-1-0

round

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-time-l1-1-0

clock _time64

Skriveblokkes/libdatrie-1.dll

IMPHASH 1f324cb5ca03bc6de1334d6c51f5137d
SHA256 738f67f45faa07cc387baf390604ee4ce709cbe7c223d9a043ee06f7cb360d5b
MD5 8a54723090530190eb11afcd5b702b1b
SHA1 dfa923ec796a754bd21c4f9e504305848a4cb1b2
SHA512 e0d310458c8259112e07b153edc86fdff29e1b09648fed8d163d44deb3bee1545e7ad37bb00e9255df6514844b21a829750848da42f85fa77bef376ce09750cf
SSDEEP 768:Hm5z53y6m/LHlM6GnPGUvMrsztd/sLLhF3VI:a53y6Gy6GuU5d/OhF3G
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

4912

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

929B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

62548c66d11776c84706553bdd76afd7248d2c3e69b0f47215c0dc307f0dd06a

PE Signature issue

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Ansvarshavende.til

MonitorPlugin.dll

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

nativegamingcenterhelper

gpucontrollibrary

xtuwrapperfornativecode

msvcp140

bcrypt

pdh

wtsapi32

userenv

externalgpuconfighelper

setupapi

crypt32

wintrust

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

generic

Skriveblokkes/battery-level-70-charging-symbolic.svg

Skriveblokkes/libdatrie-1.dll

kernel32

msvcrt

user32

generic

Uncrosses.Mol

location-services-active-symbolic.symbolic.png