FileCoAuth[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

FileCoAuth.exe
Size

1.3MB
MD5

2fe344418b2db1e6bc76553fe1eac4bc
SHA1

15ac54edc772785e1f9c3f38a64d90aae93d1dc6
SHA256

68648567719acf2bba7796cd2fb8fcfee3962569e51b2f840b8e5a3beeff1ec7
SHA512

40279ff8d7c55b19aabeb143e6c42535b9ab37d1bcaabe4a382b2daaffc40bf4555ea8ee38d141bf62873657bc2fcb2a4aa91640001756edb2cf07aff7d5543b
SSDEEP

24576:yFVYnCsIvF9gAWIkHNvc4QX9sOMgbqGfUbv8Baqg4PWeMG9mLQ:yFGnCsI/gfVC4M90jGfUbsaH4Ot0

Score

1^/10

Malware Config

Signatures

Files

FileCoAuth.exe
.exe windows:6 windows x64 arch:x64

a5e48c886a13ecfc9a5018e2b583c0b9

Code Sign

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4f
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2023, 19:50

Not After

16/10/2024, 19:50

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:47:c3:df:05:01:fb:f2:df:d6:64:64:e7:4f:cd:40:c9:75:c2:06:9c:71:77:f9:4f:a2:d2:31:b8:1f:23:4d
Signer

Actual PE Digest

51:47:c3:df:05:01:fb:f2:df:d6:64:64:e7:4f:cd:40:c9:75:c2:06:9c:71:77:f9:4f:a2:d2:31:b8:1f:23:4d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\dbs\sh\odct\0805_201735\client\onedrive\Product\FileCoAuth\Desktop\exe\obj\amd64\FileCoAuth.pdb

Imports

loggingplatform

?GuidToString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBU_GUID@@@Z
?LoggingSetCommonDatapoint@@YAXPEB_W0@Z
??0StructuredEvent@@QEAA@PEBDH0AEBU_GUID@@IIII@Z
?LoggingSetCommonDatapointUserId@@YAXPEB_WW4UserIdType@@@Z
??0Scope@ScenarioTracking@@QEAA@V?$shared_ptr@VIScenario@ScenarioTracking@@@std@@@Z
?StripPrivateInfoFromString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEB_W@Z
?g_pLoggingAPIWrapper@@3PEAVILoggingAPIWrapper@@EA
?NarrowStringToWideString@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PEBD@Z
?LoggingSendTelemetryEvent@@YAXAEAUTelemetryEvent@@QEAUStructuredEventParameter@@@Z
?SetEventExpiration@TelemetryEvent@@QEAAXII@Z
?GetEmptyTelemetryUsageExperimentVector@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??1TelemetryEvent@@QEAA@XZ
??0TelemetryEvent@@QEAA@PEBD0AEBU_GUID@@II00II@Z
?LoggingSanitizeFilename@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBD@Z
?GetLoggingSession@@YA?AV?$shared_ptr@VILoggingSession@@@std@@XZ
?OneDriveAssertWorker@@YAXPEB_WW4OneDriveAssertType@@0I000ZZ
?GetActiveHydrationsCount@QoS@@YAIXZ
?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ
?LoggingRecordAssert@@YAXPEB_W000I0_NI1@Z
?LoggingInitializeForExternalComponent@@YAJPEB_W0_NG11W4TelemetryTransportType@@0K1@Z
?LoggingRotateIfNeeded@@YAXXZ
?LoggingWriteStructuredEvent@@YAXAEBUStructuredEvent@@QEAUStructuredEventParameter@@@Z
??1Scope@ScenarioTracking@@QEAA@XZ

api-ms-win-core-winrt-error-l1-1-0

RoTransformError

telemetry

??0OCSIScenario@@QEAA@XZ
?Report@OCSIScenario@@SAXJAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?Report@IncomingTelemetry@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00JV?$duration@_JU?$ratio@$00$0DLJKMKAA@@std@@@chrono@3@00V?$optional@_N@3@@Z
??1OCSIScenario@@UEAA@XZ

updateringsettings

?GetUpdateRingSettingsManager@@YAPEAVIUpdateRingSettingsManager@@XZ
?GetECSConfigurationManager@@YAPEAVIECSConfigurationManager@@XZ

propsys

PropVariantToStringAlloc
PropVariantToUInt32

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
VerSetConditionMask
NtQueryDirectoryFile

kernel32

GetFileAttributesExW
GetFileInformationByHandle
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetVolumePathNameW
ReadFile
RemoveDirectoryW
SetFileInformationByHandle
SetFilePointer
GetCompressedFileSizeW
FindFirstFileNameW
IsDebuggerPresent
SetHandleInformation
CreatePipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
DeviceIoControl
LoadLibraryExW
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
ReadDirectoryChangesW
CreateSymbolicLinkW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetProductInfo
VerifyVersionInfoW
SetLastError
GetLongPathNameW
WaitForMultipleObjects
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetProcessTimes
GetDiskFreeSpaceExW
CreateProcessW
SetProcessShutdownParameters
GetSystemTimes
SetThreadInformation
GetProcessIoCounters
GetPrivateProfileStringW
WritePrivateProfileStringW
SetDllDirectoryW
CopyFileW
MoveFileExW
ReplaceFileW
GetComputerNameW
RegisterApplicationRestart
GetFileInformationByHandleEx
OpenFileById
GetDllDirectoryW
WerRegisterFile
GetTickCount64
GetComputerNameExW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DuplicateHandle
UnregisterApplicationRestart
SystemTimeToTzSpecificLocalTime
OpenMutexW
GetLocaleInfoW
OpenEventW
GetTickCount
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
CreateFileW
OutputDebugStringW
InitOnceBeginInitialize
CreateEventExW
WaitForMultipleObjectsEx
FindNextFileW
LCMapStringW
WideCharToMultiByte
MultiByteToWideChar
K32GetModuleFileNameExW
GetExitCodeProcess
CreateDirectoryW
QueueUserWorkItem
MoveFileWithProgressW
GetDateFormatW
GetUserDefaultLocaleName
GetUserDefaultLCID
GetUserGeoID
LCIDToLocaleName
MoveFileW
LocalAlloc
LoadLibraryW
FreeLibrary
GetVersionExW
GetSystemTimeAsFileTime
GetSystemTime
OpenProcess
TerminateProcess
GetCurrentProcessId
CreateMutexW
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
LocalFree
GetCurrentThread
SetFileAttributesW
GetFileAttributesW
CompareStringOrdinal
QueryFullProcessImageNameW
GetCurrentProcess
IsWow64Process
AcquireSRWLockExclusive
InitializeSRWLock
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
RaiseException
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
DecodePointer
HeapAlloc
CreateThread
CloseHandle
SetEvent
GetLastError
Sleep
CreateEventW
WaitForSingleObject
InitializeCriticalSectionEx
GetModuleFileNameW
GetCommandLineW
HeapFree
DebugBreak
FormatMessageW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentDirectoryW
InterlockedPushEntrySList
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
ReleaseMutex
InitOnceComplete

user32

SetFocus
LoadImageW
GetWindowRect
GetLastActivePopup
AllowSetForegroundWindow
MessageBoxW
AdjustWindowRectEx
SetWindowPos
TrackPopupMenu
GetSubMenu
EmptyClipboard
GetClipboardData
GetDoubleClickTime
GetWindowLongW
MapWindowPoints
IsHungAppWindow
SetMenuDefaultItem
EnableMenuItem
PostThreadMessageW
TranslateMessage
CharNextW
DispatchMessageW
SetClipboardData
CharUpperW
GetMessageW
SetTimer
KillTimer
GetLastInputInfo
GetProcessDefaultLayout
LoadIconW
RegisterClassExW
GetClientRect
SystemParametersInfoW
GetSysColor
PostMessageW
EnumWindows
GetClassNameW
GetWindowThreadProcessId
PeekMessageW
PostQuitMessage
MsgWaitForMultipleObjectsEx
OpenClipboard
GetMenuStringW
RemoveMenu
ShowWindow
DestroyWindow
CreateWindowExW
DeleteMenu
AppendMenuW
ModifyMenuW
EndDialog
IsWindow
SetForegroundWindow
RegisterClassW
UnregisterPowerSettingNotification
RegisterPowerSettingNotification
FindWindowW
SendMessageTimeoutW
LoadCursorW
SendMessageW
CloseClipboard
GetClassInfoExW
GetIconInfo
RegisterClipboardFormatW
GetMenuItemCount
SetCursor

advapi32

CreateProcessWithTokenW
GetUserNameW
SetFileSecurityW
CreateProcessAsUserW
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
StartServiceW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
QueryServiceStatusEx
QueryServiceStatus
QueryServiceConfigW
InitializeAcl
GetAce
DeleteAce
AddAce
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfig2W
ChangeServiceConfigW
RegDeleteTreeW
RegUnLoadKeyW
RegLoadKeyW
RegEnumKeyW
RegDeleteKeyExW
RegCreateKeyTransactedW
GetAclInformation
FreeSid
DuplicateTokenEx
CreateWellKnownSid
AllocateAndInitializeSid
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegGetValueW
RegSetKeyValueW
RegSetValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegCreateKeyExW
LookupPrivilegeValueW
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
AdjustTokenPrivileges
AccessCheck
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
OpenProcessToken
DuplicateToken
MapGenericMask
IsValidAcl
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegDeleteKeyW
RegOpenKeyExW
RegCopyTreeW
RegNotifyChangeKeyValue
CheckTokenMembership

shell32

SHCreateDirectoryExW
SHCreateItemFromParsingName
CommandLineToArgvW
SHFileOperationW
SHGetSpecialFolderPathW
SHAssocEnumHandlers
SHGetFolderPathW
SHGetFolderPathAndSubDirW
SHGetKnownFolderPath
ord526
ShellExecuteW
SHChangeNotify
SHParseDisplayName
ShellExecuteExW
SHBrowseForFolderW
SHGetPathFromIDListW
SHAppBarMessage
SHGetKnownFolderItem
SHQueryUserNotificationState
AssocCreateForClasses
SHSetKnownFolderPath
Shell_NotifyIconW

ole32

CoWaitForMultipleHandles
CreateBindCtx
CoRevertToSelf
StringFromCLSID
CLSIDFromString
CoSetProxyBlanket
CoCreateGuid
CoImpersonateClient
PropVariantClear
CoAllowSetForegroundWindow
CoTaskMemFree
CreateItemMoniker
GetRunningObjectTable
CoUninitialize
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoReleaseServerProcess
CoGetObject
CoAddRefServerProcess
CoInitializeEx
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoRevokeClassObject
CoGetCallContext
CoInitializeSecurity
StringFromGUID2

oleaut32

SysAllocStringByteLen
UnRegisterTypeLi
LoadTypeLi
SysFreeString
RegisterTypeLi
GetRecordInfoFromTypeInfo
SysStringByteLen
LoadRegTypeLi
SetErrorInfo
GetErrorInfo
SysStringLen
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData

crypt32

CryptBinaryToStringW
CryptStringToBinaryW
CertFindExtension

rpcrt4

RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringBindingComposeW
RpcServerInqBindings
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcEpRegisterW
RpcEpUnregister
RpcServerInqCallAttributesW
UuidToStringW

secur32

GetUserNameExW

shlwapi

SHCreateStreamOnFileW
SHStrDupW
PathFileExistsW
PathFindFileNameW
SHGetValueW
SHRegGetUSValueW
PathIsDirectoryW
PathStripPathW
SHDeleteKeyW
AssocQueryStringW
SHRegGetBoolUSValueW
SHRegGetPathW
SHRegGetValueW
SHSetValueW
SHCreateStreamOnFileEx
SHRegCreateUSKeyW
SHRegCloseUSKey
SHRegSetUSValueW
AssocCreate
UrlEscapeW
PathStripToRootW
UrlCreateFromPathW
SHGetValueA
SHDeleteValueW
StrStrIW
PathIsDirectoryEmptyW
PathRemoveFileSpecW
PathIsPrefixW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetGetConnectedState
InternetCheckConnectionW

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSQueryUserToken
WTSEnumerateSessionsW

msvcp140

?_Random_device@std@@YAIXZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@AEAH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?widen@?$ctype@_W@std@@QEBA_WD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?id@?$collate@_W@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
_Wcsxfrm
_Wcscoll
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_counter
_Query_perf_frequency
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
_Xtime_get_ticks
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
_Cnd_unregister_at_thread_exit
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Cnd_register_at_thread_exit
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
??0task_continuation_context@Concurrency@@AEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xruntime_error@std@@YAXPEBD@Z
??0_Locinfo@std@@QEAA@HPEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getname@_Locinfo@std@@QEBAPEBDXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_Makeloc@_Locimp@locale@std@@CAPEAV123@AEBV_Locinfo@3@HPEAV123@PEBV23@@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?setf@ios_base@std@@QEAAHH@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

userenv

GetDefaultUserProfileDirectoryW
CreateEnvironmentBlock

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
__RTDynamicCast
memset
memmove
memcpy
__C_specific_handler
__current_exception_context
__current_exception
wcsstr
wcsrchr
__std_exception_destroy
__std_type_info_name
strchr
_purecall
__std_terminate
wcschr
_CxxThrowException
__std_type_info_compare
__std_exception_copy

api-ms-win-crt-heap-l1-1-0

realloc
_callnewh
malloc
free
_set_new_mode

api-ms-win-crt-string-l1-1-0

iswxdigit
wcsncmp
iswspace
towupper
towlower
_wcsdup
wcscmp
wcsncpy_s
isxdigit
wcscspn
wcscat_s
strncmp
_strnicmp
wcstok_s
wcscpy_s
isalnum
toupper
tolower
_wcsnicmp
_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo
_errno
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_invalid_parameter_noinfo_noreturn
_cexit
_seh_filter_exe
_set_app_type
_beginthread
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
abort
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-time-l1-1-0

_time64
_localtime64_s

api-ms-win-crt-locale-l1-1-0

_create_locale
localeconv
_free_locale
_configthreadlocale

api-ms-win-crt-stdio-l1-1-0

fgetpos
__p__commode
fgetc
_fseeki64
_set_fmode
fflush
fclose
_get_stream_buffer_pointers
fwrite
setvbuf
ungetc
_wfopen_s
__stdio_common_vswprintf
fread
fputc
__stdio_common_vsprintf
fsetpos

api-ms-win-crt-math-l1-1-0

_dclass
__setusermatherr
ceilf
_dsign

api-ms-win-crt-convert-l1-1-0

atof
strtoull
_strtod_l
strtoll
wcstoll
wcstoul
strtod
_wtoi
atol

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_lock_file
_stat64i32

filesyncsessions

GetSettingsPersistence

gdi32

GetObjectW

Sections

.text
Size: 810KB - Virtual size: 810KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 311KB - Virtual size: 310KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5e48c886a13ecfc9a5018e2b583c0b9

Code Sign

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4fCertificate

Extended Key Usages

61:0c:52:4c:00:00:00:00:00:03Certificate

Key Usages

51:47:c3:df:05:01:fb:f2:df:d6:64:64:e7:4f:cd:40:c9:75:c2:06:9c:71:77:f9:4f:a2:d2:31:b8:1f:23:4dSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

loggingplatform

api-ms-win-core-winrt-error-l1-1-0

telemetry

updateringsettings

propsys

ntdll

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

rpcrt4

secur32

shlwapi

version

wininet

wtsapi32

msvcp140

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

filesyncsessions

gdi32

Sections

.text Size: 810KB - Virtual size: 810KB

.rdata Size: 311KB - Virtual size: 310KB

.data Size: 66KB - Virtual size: 77KB

.pdata Size: 36KB - Virtual size: 36KB

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 8KB - Virtual size: 8KB

33:00:00:05:4f:13:66:3c:8b:d6:7c:df:d5:00:00:00:00:05:4f
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

51:47:c3:df:05:01:fb:f2:df:d6:64:64:e7:4f:cd:40:c9:75:c2:06:9c:71:77:f9:4f:a2:d2:31:b8:1f:23:4d
Signer

.text
Size: 810KB - Virtual size: 810KB

.rdata
Size: 311KB - Virtual size: 310KB

.data
Size: 66KB - Virtual size: 77KB

.pdata
Size: 36KB - Virtual size: 36KB

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 8KB - Virtual size: 8KB