045122d11b4f790c710f570c5d7ff1d3d47b79aa1167e9524035df2cd5ad9a42N

Sharing

Copy URL Twitter E-mail

General

Target

045122d11b4f790c710f570c5d7ff1d3d47b79aa1167e9524035df2cd5ad9a42N
Size

1.4MB
MD5

fc0ac486714f50a8c05800cb8914d070
SHA1

736d10741209dd88cd320c705db4e44271d6b658
SHA256

045122d11b4f790c710f570c5d7ff1d3d47b79aa1167e9524035df2cd5ad9a42
SHA512

9bdb53b1a1026f205f32e7455f981f344ae9a0dd77dc8cfac38d62787727076d169e3a561b24edf25c61a635970bf22b5abd6e4366b46d0657efa3edd035e2ea
SSDEEP

24576:CD8XWTNA5Aayzh79DoNg6IY5XmFvIDiNF9JaDRjPnGaHTR/NiDG/v4FJvo9:m0PAaS79UXmFKuQGaHYGnQo9

Score

1^/10

Malware Config

Signatures

Files

045122d11b4f790c710f570c5d7ff1d3d47b79aa1167e9524035df2cd5ad9a42N
.dll windows:6 windows x86 arch:x86

7cbb9ade4c6bfdacf008da52547be17e

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

13/01/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:e8:32:2c:5a:0f:3b:81:75:be:2d:de:5b:77:f5:46
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/08/2024, 00:00

Not After

01/08/2025, 23:59

Subject

SERIALNUMBER=4152954,CN=Amazon Web Services\, Inc.,OU=AWS HPC and Visualization - NICE,O=Amazon Web Services\, Inc.,L=Seattle,ST=Washington,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:88:ab:31:d3:89:76:de:50:3a:77:a3:31:6d:bc:38:bc:58:98:26:c1:4e:43:9c:47:cd:a6:ea:b3:2d:42:48
Signer

Actual PE Digest

b8:88:ab:31:d3:89:76:de:50:3a:77:a3:31:6d:bc:38:bc:58:98:26:c1:4e:43:9c:47:cd:a6:ea:b3:2d:42:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\build\Win32\release\glib\_gvsbuild-meson\gio\gio-2.0-0.pdb

Imports

glib-2.0-0

g_uri_is_valid
g_hostname_is_non_ascii
g_ascii_strncasecmp
g_win32_error_message
g_atomic_pointer_get
g_atomic_pointer_set
g_atomic_pointer_compare_and_exchange
g_atomic_pointer_compare_and_exchange_full
g_atomic_pointer_exchange
g_rw_lock_writer_lock
g_rw_lock_writer_unlock
g_rw_lock_reader_lock
g_rw_lock_reader_unlock
g_bytes_new
g_file_test
g_dgettext
g_list_find
g_hash_table_steal_all
g_hash_table_get_keys_as_array
g_mapped_file_new
g_mapped_file_get_bytes
g_mapped_file_unref
g_variant_get_size
g_variant_get_data
g_build_path
g_error_new_valist
g_error_copy
g_main_context_push_thread_default
g_main_context_pop_thread_default
g_source_get_context
g_hash_table_replace
g_strchomp
g_ascii_strdown
g_intern_string
g_prefix_error
g_cond_wait_until
g_try_malloc
g_try_realloc
g_source_get_ready_time
g_source_add_poll
g_source_remove_poll
g_source_get_time
g_get_monotonic_time
g_slist_free
g_slist_remove
g_ref_count_init
g_ref_count_inc
g_ref_count_dec
g_main_context_new
g_main_loop_new
g_main_loop_run
g_main_loop_quit
g_main_loop_unref
g_list_remove_link
g_list_sort
g_random_int_range
g_environ_getenv
g_snprintf
g_slist_free_1
g_main_context_iteration
g_child_watch_source_new
g_spawn_async_with_pipes_and_fds
g_spawn_check_wait_status
g_spawn_close_pid
g_source_get_name
g_thread_pool_new
g_thread_pool_push
g_thread_pool_unprocessed
g_thread_pool_set_sort_function
g_thread_pool_move_to_front
g_thread_pool_set_max_threads
g_list_find_custom
g_list_length
g_thread_pool_free
g_atomic_int_compare_and_exchange
g_variant_new_strv
g_thread_pool_new_full
g_byte_array_unref
g_byte_array_append
g_slist_concat
g_slist_last
g_strstr_len
g_strrstr_len
g_byte_array_ref
g_main_context_acquire
g_main_context_release
g_once_impl
g_dngettext
g_close
g_byte_array_sized_new
g_strlcpy
g_string_sized_new
g_direct_equal
g_sequence_new
g_sequence_free
g_sequence_get_length
g_sequence_sort
g_sequence_get_begin_iter
g_sequence_get_end_iter
g_sequence_get_iter_at_pos
g_sequence_append
g_sequence_insert_before
g_sequence_insert_sorted
g_sequence_remove
g_sequence_remove_range
g_sequence_get
g_sequence_iter_is_end
g_sequence_iter_next
g_sequence_iter_prev
g_sequence_iter_get_position
g_sequence_iter_move
g_ptr_array_insert
g_atomic_int_set
g_realloc_n
g_list_sort_with_data
g_direct_hash
g_utf8_to_utf16
g_utf16_to_utf8
g_utf8_casefold
g_variant_new_int32
g_shell_quote
g_shell_parse_argv
g_spawn_async
g_ptr_array_extend_and_steal
g_error_new_literal
g_hash_table_get_values
g_hash_table_get_values_as_ptr_array
g_source_remove
g_timeout_add
g_variant_get_child_value
g_assertion_message_error
g_rmdir
g_usleep
g_node_new
g_node_destroy
g_node_insert_before
g_node_traverse
g_node_children_foreach
g_node_n_children
g_idle_add
g_strjoin
g_variant_type_dup_string
g_variant_new_string
g_variant_get_boolean
g_variant_get_byte
g_variant_get_int16
g_variant_get_uint16
g_variant_get_int32
g_variant_get_uint32
g_variant_get_int64
g_variant_get_uint64
g_variant_print_string
g_variant_parse
g_tree_foreach
g_convert
g_ptr_array_new_full
g_quark_from_string
g_get_prgname
g_set_prgname
g_variant_new_int64
g_variant_new_double
g_variant_new_bytestring
g_variant_new_bytestring_array
g_variant_builder_new
g_variant_builder_unref
g_variant_dict_new
g_variant_dict_insert_value
g_variant_dict_end
g_variant_dict_unref
g_option_context_new
g_option_context_set_summary
g_option_context_set_description
g_option_context_free
g_option_context_set_help_enabled
g_option_context_set_ignore_unknown_options
g_option_context_parse_strv
g_option_context_add_group
g_option_context_set_main_group
g_option_group_new
g_option_group_unref
g_option_group_add_entries
g_option_group_set_translation_domain
g_slice_copy
g_win32_get_command_line
g_variant_ref
g_variant_dup_bytestring
g_variant_dup_bytestring_array
g_strsplit
g_variant_get_child
g_variant_builder_add_value
g_variant_type_string_is_valid
g_hash_table_contains
g_variant_type_free
g_variant_type_copy
g_variant_get_type
g_variant_equal
g_variant_parse_error_quark
g_quark_to_string
g_hash_table_ref
g_variant_get_va
g_variant_check_format_string
g_variant_new_va
g_timeout_source_new_seconds
g_tree_unref
g_tree_insert
g_tree_remove
g_tree_lookup
g_tree_lookup_extended
g_tree_nnodes
g_get_user_config_dir
g_checksum_new
g_checksum_free
g_checksum_update
g_checksum_get_digest
g_mkdir_with_parents
g_key_file_new
g_key_file_unref
g_key_file_free
g_key_file_load_from_file
g_key_file_load_from_data
g_key_file_to_data
g_key_file_get_groups
g_key_file_get_keys
g_key_file_get_value
g_key_file_set_value
g_key_file_remove_key
g_key_file_remove_group
g_variant_type_equal
g_variant_print
g_tree_new_full
g_get_user_data_dir
g_win32_get_system_data_dirs_for_module
g_hash_table_iter_remove
g_strjoinv
g_string_insert_len
g_string_append_len
g_markup_parse_context_new
g_markup_parse_context_free
g_markup_parse_context_parse
g_markup_parse_context_end_parse
g_variant_is_container
g_variant_new_array
g_variant_lookup_value
g_variant_get_fixed_array
g_variant_iter_new
g_variant_builder_clear
g_variant_compare
g_regex_new
g_regex_split
g_regex_replace_literal
g_variant_new_byte
g_variant_new_int16
g_variant_new_uint16
g_variant_new_uint32
g_variant_new_uint64
g_variant_new_handle
g_variant_new_object_path
g_variant_new_signature
g_variant_get_handle
g_variant_get_double
g_variant_dup_strv
g_variant_get_bytestring
g_variant_type_peek_string
g_variant_dup_string
g_get_real_time
g_variant_is_floating
g_variant_classify
g_variant_new_objv
g_variant_dup_objv
g_variant_get_normal_form
g_variant_new_from_data
g_random_int
g_hash_table_get_keys_as_ptr_array
g_string_insert
g_uri_unescape_segment
g_strchug
g_string_set_size
g_propagate_prefixed_error
g_get_home_dir
g_compute_checksum_for_string
g_file_set_contents_full
g_ascii_strtoll
g_open
g_unlink
g_int_hash
g_ptr_array_remove_index
g_ptr_array_remove
g_atomic_int_and
g_atomic_int_or
g_thread_self
g_hash_table_steal_all_keys
g_hash_table_foreach_remove
g_strv_contains
g_string_prepend_c
g_variant_is_object_path
g_atomic_ref_count_inc
g_atomic_ref_count_dec
g_array_sized_new
g_hash_table_get_keys
g_variant_type_new
g_variant_type_is_tuple
g_variant_type_is_dict_entry
g_variant_type_is_variant
g_variant_type_element
g_variant_type_first
g_variant_type_next
g_variant_type_key
g_variant_type_value
g_variant_type_string_get_depth_
g_variant_is_signature
g_variant_new_variant
g_variant_new_fixed_array
g_variant_new_dict_entry
g_variant_byteswap
g_ptr_array_sort_values
g_ptr_array_foreach
g_parse_debug_string
g_thread_new
g_variant_type_new_tuple
g_queue_new
g_queue_free_full
g_queue_get_length
g_slist_length
g_markup_error_quark
g_markup_parse_context_get_element_stack
g_markup_parse_context_get_position
g_markup_printf_escaped
g_markup_collect_attributes
g_variant_new_tuple
g_ptr_array_set_free_func
g_list_foreach
g_hash_table_steal_all_values
g_setenv
g_unsetenv
g_timeout_add_seconds_once
g_io_channel_unref
g_io_channel_shutdown
g_io_channel_set_close_on_unref
g_io_channel_read_line
g_io_channel_unix_new
g_spawn_error_quark
g_spawn_command_line_async
g_base64_encode
g_filename_from_utf8
g_filename_to_uri
g_filename_display_name
g_get_filename_charsets
g_path_skip_root
g_canonicalize_filename
g_rename
g_mkdir
g_lstat
g_remove
g_get_user_cache_dir
g_get_user_special_dir
g_checksum_get_string
g_filename_display_basename
g_access
g_chmod
g_sequence_sort_changed
g_mkstemp_full
g_win32_ftruncate
g_fsync
g_filename_from_uri
g_hostname_is_ip_address
g_mapped_file_get_length
g_mapped_file_get_contents
g_file_set_contents
g_string_free_to_bytes
g_variant_store
g_queue_free
g_ptr_array_sized_new
g_bytes_new_from_bytes
g_variant_get_variant
g_date_time_add_seconds
g_locale_from_utf8
g_strconcat
g_str_equal
g_realloc
g_date_time_to_unix
g_date_time_get_microsecond
g_date_time_add
g_date_time_new_from_iso8601
g_date_time_new_from_unix_utc
g_hash_table_add
g_hash_table_destroy
g_source_add_child_source
g_hash_table_new_full
g_file_get_contents
g_uri_split_with_user
g_strdup_vprintf
g_hostname_to_ascii
g_source_is_destroyed
g_main_current_source
g_hash_table_unref
g_hash_table_remove_all
g_uri_join
g_uri_split_network
g_list_copy_deep
g_list_reverse
g_getenv
g_dir_close
g_dir_read_name
g_dir_open
g_rec_mutex_unlock
g_rec_mutex_lock
g_file_error_from_errno
g_string_prepend
g_variant_get_data_as_bytes
g_variant_lookup
g_variant_get_strv
g_variant_get_string
g_variant_get_type_string
g_list_concat
g_idle_add_full
g_slist_append
g_variant_take_ref
g_slist_free_full
g_bytes_get_size
g_bytes_new_with_free_func
g_string_append_uri_escaped
g_idle_source_new
g_source_set_callback
g_source_set_priority
g_list_delete_link
g_cond_signal
g_cond_clear
g_cond_init
g_strv_length
g_stat
g_win32_get_package_installation_directory_of_module
g_printerr
g_utf8_skip
g_uri_escape_string
g_print
g_str_has_suffix
g_sequence_is_empty
g_str_has_prefix
g_utf8_get_char
g_list_free
g_hash_table_lookup_extended
g_hash_table_foreach
g_date_time_unref
g_time_zone_unref
g_time_zone_new_local
g_atomic_int_inc
g_ptr_array_free
g_ptr_array_new
g_array_sort
g_array_remove_index
g_array_append_vals
g_variant_new_take_string
g_atomic_int_add
g_atomic_int_dec_and_test
g_array_set_size
g_array_insert_vals
g_array_free
g_array_new
g_uri_unescape_string
g_main_context_invoke_full
g_list_remove
g_list_prepend
g_malloc0
g_get_current_dir
g_build_filename_valist
g_build_filenamev
g_dir_make_tmp
g_file_open_tmp
g_file_error_quark
g_bytes_ref
g_bytes_get_data
g_bytes_new_static
g_bytes_new_take
g_clear_error
g_quark_from_static_string
g_byte_array_set_size
g_byte_array_free
g_byte_array_new
g_variant_builder_close
g_variant_builder_open
g_variant_is_of_type
g_list_insert_sorted
g_list_append
g_variant_new_parsed
g_strdup_printf
g_ascii_table
g_strcmp0
g_string_insert_c
g_string_append
g_strndup
g_ascii_strcasecmp
g_ascii_xdigit_value
g_ascii_tolower
g_str_hash
g_path_get_dirname
g_path_get_basename
g_path_is_absolute
g_build_filename
g_log_set_debug_enabled
g_variant_builder_add

gobject-2.0-0

g_type_add_instance_private
g_type_class_adjust_private_offset
g_value_init
g_type_add_interface_static
g_value_peek_pointer
g_cclosure_marshal_VOID__STRING
g_signal_new
g_signal_emitv
g_signal_emit
g_type_interface_add_prerequisite
g_type_register_static_simple
g_type_class_peek_parent
g_flags_register_static
g_enum_register_static
g_value_unset
g_signal_lookup
g_type_default_interface_peek
g_object_remove_weak_pointer
g_object_add_weak_pointer
g_error_get_type
g_cclosure_marshal_generic
g_closure_set_marshal
g_closure_unref
g_closure_sink
g_closure_ref
g_object_set_qdata
g_signal_handler_is_connected
g_value_get_double
g_value_set_double
g_value_get_uint64
g_value_set_uint64
g_value_get_int64
g_value_set_int64
g_value_get_uchar
g_value_set_uchar
g_value_get_schar
g_value_set_schar
g_flags_get_value_by_nick
g_flags_get_first_value
g_type_check_value_holds
g_object_weak_unref
g_object_weak_ref
g_value_get_variant
g_value_take_variant
g_type_fundamental
g_variant_type_get_gtype
g_value_dup_variant
g_param_spec_variant
g_variant_dict_get_type
g_signal_accumulator_first_wins
g_signal_handler_find
g_signal_connect_closure_by_id
g_cclosure_new
g_value_take_string
g_object_set_data
g_value_get_gtype
g_value_set_gtype
g_param_spec_gtype
g_value_take_boxed
g_object_run_dispose
g_type_class_peek_static
g_value_set_static_string
g_date_time_get_type
g_ptr_array_get_type
g_byte_array_get_type
g_signal_handlers_disconnect_matched
g_value_copy
g_signal_connect_object
g_type_children
g_param_spec_flags
g_value_get_flags
g_value_set_flags
g_value_take_object
g_io_condition_get_type
g_value_get_boxed
g_object_notify_by_pspec
g_source_set_dummy_callback
g_object_thaw_notify
g_object_freeze_notify
g_value_get_string
g_signal_accumulator_true_handled
g_object_class_find_property
g_object_new
g_object_set_property
g_object_get_property
g_object_notify
g_value_get_int
g_array_get_type
g_strv_get_type
g_value_get_ulong
g_value_set_ulong
g_param_spec_ulong
g_signal_emit_by_name
g_object_set_data_full
g_object_get_data
g_boxed_free
g_boxed_copy
g_type_module_unuse
g_type_module_use
g_type_module_get_type
g_weak_ref_set
g_value_get_object
g_type_interface_peek_parent
g_value_get_pointer
g_value_set_pointer
g_param_spec_pointer
g_enum_get_value_by_nick
g_type_ensure
g_type_from_name
g_value_set_int
g_param_spec_int
g_type_check_instance_is_fundamentally_a
g_object_set_qdata_full
g_boxed_type_register_static
g_type_name_from_instance
g_object_replace_qdata
g_object_get_qdata
g_type_class_peek
g_weak_ref_get
g_weak_ref_clear
g_weak_ref_init
g_object_class_install_properties
g_object_class_override_property
g_signal_has_handler_pending
g_object_get
g_object_set
g_object_interface_install_property
g_param_spec_enum
g_value_get_enum
g_value_set_enum
g_enum_get_value
g_type_class_unref
g_type_class_ref
g_param_spec_object
g_value_dup_object
g_value_dup_string
g_value_set_string
g_param_spec_string
g_signal_handler_disconnect
g_signal_connect_data
g_closure_invoke
g_param_spec_boxed
g_value_dup_boxed
g_value_set_boxed
g_bytes_get_type
g_param_spec_boolean
g_value_get_uint
g_value_set_uint
g_param_spec_uint
g_object_class_install_property
g_type_name
g_object_new_valist
g_object_newv
g_type_is_a
g_object_ref
g_signal_set_va_marshaller
g_cclosure_marshal_VOID__VOID
g_type_check_instance_is_a
g_type_interface_peek
g_value_set_variant
g_value_get_boolean
g_value_set_boolean
g_value_set_object
g_object_unref

gmodule-2.0-0

g_module_open_full
g_module_close
g_module_error
g_module_symbol
g_module_supported

zlib1

deflateInit_
deflateSetHeader
inflate
inflateEnd
inflateReset
inflateGetHeader
inflateInit_
inflateInit2_
deflate
deflateReset
deflateEnd
deflateInit2_

intl

libintl_fprintf
libintl_bind_textdomain_codeset
libintl_gettext

shlwapi

ord487
StrRetToStrW

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetAdaptersAddresses
if_nametoindex
GetIpForwardTable2
NotifyRouteChange2
CancelMibChangeNotify2

ws2_32

ntohs
gethostbyname
getservbyport
getservbyname
WSASetLastError
WSAGetLastError
WSAStartup
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
listen
recv
inet_ntoa
inet_addr
htons
htonl
inet_ntop
inet_pton
WSAIoctl
WSARecv
WSARecvFrom
WSASend
WSASendTo
gethostbyaddr
send
setsockopt
shutdown
socket
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect

kernel32

UnhandledExceptionFilter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
QueryPerformanceCounter
ReadDirectoryChangesW
GetCurrentThreadId
InitializeSListHead
GetShortPathNameW
GetLongPathNameW
GetFileAttributesExW
SetFileTime
GetVolumePathNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
SetInformationJobObject
AssignProcessToJobObject
GetLastError
GetOverlappedResult
CancelIo
GetCurrentProcessId
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
GetModuleHandleExA
TerminateProcess
GetProcessId
OpenProcess
GetTickCount
ExpandEnvironmentStringsW
CloseHandle
DuplicateHandle
SetEvent
WaitForSingleObject
CreateEventA
WaitForMultipleObjects
GetCurrentProcess
CreateThread
CreateMemoryResourceNotification
QueryMemoryResourceNotification
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
ExitThread
GetSystemDirectoryW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
GetSystemWow64DirectoryW
GetModuleHandleW
GetDriveTypeW
GetLogicalDrives
ReadFile
WriteFile
FlushFileBuffers
GetFinalPathNameByHandleW
SetFileInformationByHandle
SetFilePointerEx
GetFileInformationByHandleEx
CreateFileW
LoadLibraryW
LocalFree
GetStdHandle
GetFileAttributesW
ReleaseMutex
CreateMutexA
Sleep
CreateProcessW
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
OpenFileMappingA
AllocConsole
SetConsoleTitleW
CreateJobObjectW
GetSystemTimeAsFileTime

user32

GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage

shell32

SHFileOperationW
SHBindToParent
SHGetDesktopFolder
SHCreateShellItemArrayFromIDLists
SHParseDisplayName

ole32

CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
CoUninitialize
CoInitializeEx

advapi32

RegLoadMUIStringW
RegNotifyChangeKeyValue
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetFileSecurityW
GetCurrentHwProfileA
ConvertSidToStringSidA
IsValidSid
GetTokenInformation
GetLengthSid
CopySid
OpenProcessToken
RegQueryInfoKeyW
RegEnumValueW

vcruntime140

memset
strrchr
wcsrchr
wcschr
_except_handler4_common
__std_type_info_destroy_list
strstr
memchr
strchr
memmove
memcpy

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_initterm
_initterm_e
terminate
_configure_narrow_argv
_seh_filter_dll
raise
_initialize_onexit_table
_errno

api-ms-win-crt-string-l1-1-0

_stricmp
_wcsnicmp
strcmp
iswctype
_wcsicmp
_strdup
strcspn
strncpy_s
_wcsdup
strcat_s
strncmp
strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi
mbstowcs

api-ms-win-crt-heap-l1-1-0

calloc
free

api-ms-win-crt-stdio-l1-1-0

freopen
_read
__stdio_common_vsprintf_s
_lseek
_write
__stdio_common_vswprintf
_fileno
_get_osfhandle
_dup
fclose
fopen
fread
__acrt_iob_func
fflush
_close
_pipe
__stdio_common_vswscanf

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-math-l1-1-0

_except1

Exports

Exports

_g_win32_run_session_bus@16
g_action_activate
g_action_change_state
g_action_get_enabled
g_action_get_name
g_action_get_parameter_type
g_action_get_state
g_action_get_state_hint
g_action_get_state_type
g_action_get_type
g_action_group_action_added
g_action_group_action_enabled_changed
g_action_group_action_removed
g_action_group_action_state_changed
g_action_group_activate_action
g_action_group_change_action_state
g_action_group_get_action_enabled
g_action_group_get_action_parameter_type
g_action_group_get_action_state
g_action_group_get_action_state_hint
g_action_group_get_action_state_type
g_action_group_get_type
g_action_group_has_action
g_action_group_list_actions
g_action_group_query_action
g_action_map_add_action
g_action_map_add_action_entries
g_action_map_get_type
g_action_map_lookup_action
g_action_map_remove_action
g_action_map_remove_action_entries
g_action_name_is_valid
g_action_parse_detailed_name
g_action_print_detailed_name
g_app_info_add_supports_type
g_app_info_can_delete
g_app_info_can_remove_supports_type
g_app_info_create_flags_get_type
g_app_info_create_from_commandline
g_app_info_delete
g_app_info_dup
g_app_info_equal
g_app_info_get_all
g_app_info_get_all_for_type
g_app_info_get_commandline
g_app_info_get_default_for_type
g_app_info_get_default_for_type_async
g_app_info_get_default_for_type_finish
g_app_info_get_default_for_uri_scheme
g_app_info_get_default_for_uri_scheme_async
g_app_info_get_default_for_uri_scheme_finish
g_app_info_get_description
g_app_info_get_display_name
g_app_info_get_executable
g_app_info_get_fallback_for_type
g_app_info_get_icon
g_app_info_get_id
g_app_info_get_name
g_app_info_get_recommended_for_type
g_app_info_get_supported_types
g_app_info_get_type
g_app_info_launch
g_app_info_launch_default_for_uri
g_app_info_launch_default_for_uri_async
g_app_info_launch_default_for_uri_finish
g_app_info_launch_uris
g_app_info_launch_uris_async
g_app_info_launch_uris_finish
g_app_info_monitor_get
g_app_info_monitor_get_type
g_app_info_remove_supports_type
g_app_info_reset_type_associations
g_app_info_set_as_default_for_extension
g_app_info_set_as_default_for_type
g_app_info_set_as_last_used_for_type
g_app_info_should_show
g_app_info_supports_files
g_app_info_supports_uris
g_app_launch_context_get_display
g_app_launch_context_get_environment
g_app_launch_context_get_startup_notify_id
g_app_launch_context_get_type
g_app_launch_context_launch_failed
g_app_launch_context_new
g_app_launch_context_setenv
g_app_launch_context_unsetenv
g_application_activate
g_application_add_main_option
g_application_add_main_option_entries
g_application_add_option_group
g_application_bind_busy_property
g_application_command_line_create_file_for_arg
g_application_command_line_get_arguments
g_application_command_line_get_cwd
g_application_command_line_get_environ
g_application_command_line_get_exit_status
g_application_command_line_get_is_remote
g_application_command_line_get_options_dict
g_application_command_line_get_platform_data
g_application_command_line_get_stdin
g_application_command_line_get_type
g_application_command_line_getenv
g_application_command_line_print
g_application_command_line_printerr
g_application_command_line_set_exit_status
g_application_flags_get_type
g_application_get_application_id
g_application_get_dbus_connection
g_application_get_dbus_object_path
g_application_get_default
g_application_get_flags
g_application_get_inactivity_timeout
g_application_get_is_busy
g_application_get_is_registered
g_application_get_is_remote
g_application_get_resource_base_path
g_application_get_type
g_application_hold
g_application_id_is_valid
g_application_mark_busy
g_application_new
g_application_open
g_application_quit
g_application_register
g_application_release
g_application_run
g_application_send_notification
g_application_set_action_group
g_application_set_application_id
g_application_set_default
g_application_set_flags
g_application_set_inactivity_timeout
g_application_set_option_context_description
g_application_set_option_context_parameter_string
g_application_set_option_context_summary
g_application_set_resource_base_path
g_application_unbind_busy_property
g_application_unmark_busy
g_application_withdraw_notification
g_ask_password_flags_get_type
g_async_initable_get_type
g_async_initable_init_async
g_async_initable_init_finish
g_async_initable_new_async
g_async_initable_new_finish
g_async_initable_new_valist_async
g_async_initable_newv_async
g_async_result_get_source_object
g_async_result_get_type
g_async_result_get_user_data
g_async_result_is_tagged
g_async_result_legacy_propagate_error
g_buffered_input_stream_fill
g_buffered_input_stream_fill_async
g_buffered_input_stream_fill_finish
g_buffered_input_stream_get_available
g_buffered_input_stream_get_buffer_size
g_buffered_input_stream_get_type
g_buffered_input_stream_new
g_buffered_input_stream_new_sized
g_buffered_input_stream_peek
g_buffered_input_stream_peek_buffer
g_buffered_input_stream_read_byte
g_buffered_input_stream_set_buffer_size
g_buffered_output_stream_get_auto_grow
g_buffered_output_stream_get_buffer_size
g_buffered_output_stream_get_type
g_buffered_output_stream_new
g_buffered_output_stream_new_sized
g_buffered_output_stream_set_auto_grow
g_buffered_output_stream_set_buffer_size
g_bus_get
g_bus_get_finish
g_bus_get_sync
g_bus_name_owner_flags_get_type
g_bus_name_watcher_flags_get_type
g_bus_own_name
g_bus_own_name_on_connection
g_bus_own_name_on_connection_with_closures
g_bus_own_name_with_closures
g_bus_type_get_type
g_bus_unown_name
g_bus_unwatch_name
g_bus_watch_name
g_bus_watch_name_on_connection
g_bus_watch_name_on_connection_with_closures
g_bus_watch_name_with_closures
g_bytes_icon_get_bytes
g_bytes_icon_get_type
g_bytes_icon_new
g_cancellable_cancel
g_cancellable_connect
g_cancellable_disconnect
g_cancellable_get_current
g_cancellable_get_fd
g_cancellable_get_type
g_cancellable_is_cancelled
g_cancellable_make_pollfd
g_cancellable_new
g_cancellable_pop_current
g_cancellable_push_current
g_cancellable_release_fd
g_cancellable_reset
g_cancellable_set_error_if_cancelled
g_cancellable_source_new
g_charset_converter_get_num_fallbacks
g_charset_converter_get_type
g_charset_converter_get_use_fallback
g_charset_converter_new
g_charset_converter_set_use_fallback
g_content_type_can_be_executable
g_content_type_equals
g_content_type_from_mime_type
g_content_type_get_description
g_content_type_get_generic_icon_name
g_content_type_get_icon
g_content_type_get_mime_dirs
g_content_type_get_mime_type
g_content_type_get_symbolic_icon
g_content_type_guess
g_content_type_guess_for_tree
g_content_type_is_a
g_content_type_is_mime_type
g_content_type_is_unknown
g_content_type_set_mime_dirs
g_content_types_get_registered
g_converter_convert
g_converter_flags_get_type
g_converter_get_type
g_converter_input_stream_get_converter
g_converter_input_stream_get_type
g_converter_input_stream_new
g_converter_output_stream_get_converter
g_converter_output_stream_get_type
g_converter_output_stream_new
g_converter_reset
g_converter_result_get_type
g_credentials_get_native
g_credentials_get_type
g_credentials_is_same_user
g_credentials_new
g_credentials_set_native
g_credentials_to_string
g_credentials_type_get_type
g_data_input_stream_get_byte_order
g_data_input_stream_get_newline_type
g_data_input_stream_get_type
g_data_input_stream_new
g_data_input_stream_read_byte
g_data_input_stream_read_int16
g_data_input_stream_read_int32
g_data_input_stream_read_int64
g_data_input_stream_read_line
g_data_input_stream_read_line_async
g_data_input_stream_read_line_finish
g_data_input_stream_read_line_finish_utf8
g_data_input_stream_read_line_utf8
g_data_input_stream_read_uint16
g_data_input_stream_read_uint32
g_data_input_stream_read_uint64
g_data_input_stream_read_until
g_data_input_stream_read_until_async
g_data_input_stream_read_until_finish
g_data_input_stream_read_upto
g_data_input_stream_read_upto_async
g_data_input_stream_read_upto_finish
g_data_input_stream_set_byte_order
g_data_input_stream_set_newline_type
g_data_output_stream_get_byte_order
g_data_output_stream_get_type
g_data_output_stream_new
g_data_output_stream_put_byte
g_data_output_stream_put_int16
g_data_output_stream_put_int32
g_data_output_stream_put_int64
g_data_output_stream_put_string
g_data_output_stream_put_uint16
g_data_output_stream_put_uint32
g_data_output_stream_put_uint64
g_data_output_stream_set_byte_order
g_data_stream_byte_order_get_type
g_data_stream_newline_type_get_type
g_datagram_based_condition_check
g_datagram_based_condition_wait
g_datagram_based_create_source
g_datagram_based_get_type
g_datagram_based_receive_messages
g_datagram_based_send_messages
g_dbus_action_group_get
g_dbus_action_group_get_type
g_dbus_address_escape_value
g_dbus_address_get_for_bus_sync
g_dbus_address_get_stream
g_dbus_address_get_stream_finish
g_dbus_address_get_stream_sync
g_dbus_annotation_info_get_type
g_dbus_annotation_info_lookup
g_dbus_annotation_info_ref
g_dbus_annotation_info_unref
g_dbus_arg_info_get_type
g_dbus_arg_info_ref
g_dbus_arg_info_unref
g_dbus_auth_observer_allow_mechanism
g_dbus_auth_observer_authorize_authenticated_peer
g_dbus_auth_observer_get_type
g_dbus_auth_observer_new
g_dbus_call_flags_get_type
g_dbus_capability_flags_get_type
g_dbus_connection_add_filter
g_dbus_connection_call
g_dbus_connection_call_finish
g_dbus_connection_call_sync
g_dbus_connection_close
g_dbus_connection_close_finish
g_dbus_connection_close_sync
g_dbus_connection_emit_signal
g_dbus_connection_export_action_group
g_dbus_connection_export_menu_model
g_dbus_connection_flags_get_type
g_dbus_connection_flush
g_dbus_connection_flush_finish
g_dbus_connection_flush_sync
g_dbus_connection_get_capabilities
g_dbus_connection_get_exit_on_close
g_dbus_connection_get_flags
g_dbus_connection_get_guid
g_dbus_connection_get_last_serial
g_dbus_connection_get_peer_credentials
g_dbus_connection_get_stream
g_dbus_connection_get_type
g_dbus_connection_get_unique_name
g_dbus_connection_is_closed
g_dbus_connection_new
g_dbus_connection_new_finish
g_dbus_connection_new_for_address
g_dbus_connection_new_for_address_finish
g_dbus_connection_new_for_address_sync
g_dbus_connection_new_sync
g_dbus_connection_register_object
g_dbus_connection_register_object_with_closures
g_dbus_connection_register_subtree
g_dbus_connection_remove_filter
g_dbus_connection_send_message
g_dbus_connection_send_message_with_reply
g_dbus_connection_send_message_with_reply_finish
g_dbus_connection_send_message_with_reply_sync
g_dbus_connection_set_exit_on_close
g_dbus_connection_signal_subscribe
g_dbus_connection_signal_unsubscribe
g_dbus_connection_start_message_processing
g_dbus_connection_unexport_action_group
g_dbus_connection_unexport_menu_model
g_dbus_connection_unregister_object
g_dbus_connection_unregister_subtree
g_dbus_error_encode_gerror
g_dbus_error_get_remote_error
g_dbus_error_get_type
g_dbus_error_is_remote_error
g_dbus_error_new_for_dbus_error
g_dbus_error_quark
g_dbus_error_register_error
g_dbus_error_register_error_domain
g_dbus_error_set_dbus_error
g_dbus_error_set_dbus_error_valist
g_dbus_error_strip_remote_error
g_dbus_error_unregister_error
g_dbus_escape_object_path
g_dbus_escape_object_path_bytestring
g_dbus_generate_guid
g_dbus_gvalue_to_gvariant
g_dbus_gvariant_to_gvalue
g_dbus_interface_dup_object
g_dbus_interface_get_info
g_dbus_interface_get_object
g_dbus_interface_get_type
g_dbus_interface_info_cache_build
g_dbus_interface_info_cache_release
g_dbus_interface_info_generate_xml
g_dbus_interface_info_get_type
g_dbus_interface_info_lookup_method
g_dbus_interface_info_lookup_property
g_dbus_interface_info_lookup_signal
g_dbus_interface_info_ref
g_dbus_interface_info_unref
g_dbus_interface_set_object
g_dbus_interface_skeleton_export
g_dbus_interface_skeleton_flags_get_type
g_dbus_interface_skeleton_flush
g_dbus_interface_skeleton_get_connection
g_dbus_interface_skeleton_get_connections
g_dbus_interface_skeleton_get_flags
g_dbus_interface_skeleton_get_info
g_dbus_interface_skeleton_get_object_path
g_dbus_interface_skeleton_get_properties
g_dbus_interface_skeleton_get_type
g_dbus_interface_skeleton_get_vtable
g_dbus_interface_skeleton_has_connection
g_dbus_interface_skeleton_set_flags
g_dbus_interface_skeleton_unexport
g_dbus_interface_skeleton_unexport_from_connection
g_dbus_is_address
g_dbus_is_error_name
g_dbus_is_guid
g_dbus_is_interface_name
g_dbus_is_member_name
g_dbus_is_name
g_dbus_is_supported_address
g_dbus_is_unique_name
g_dbus_menu_model_get
g_dbus_menu_model_get_type
g_dbus_message_byte_order_get_type
g_dbus_message_bytes_needed
g_dbus_message_copy
g_dbus_message_flags_get_type
g_dbus_message_get_arg0
g_dbus_message_get_body
g_dbus_message_get_byte_order
g_dbus_message_get_destination
g_dbus_message_get_error_name
g_dbus_message_get_flags
g_dbus_message_get_header
g_dbus_message_get_header_fields
g_dbus_message_get_interface
g_dbus_message_get_locked
g_dbus_message_get_member
g_dbus_message_get_message_type
g_dbus_message_get_num_unix_fds
g_dbus_message_get_path
g_dbus_message_get_reply_serial
g_dbus_message_get_sender
g_dbus_message_get_serial
g_dbus_message_get_signature
g_dbus_message_get_type
g_dbus_message_header_field_get_type
g_dbus_message_lock
g_dbus_message_new
g_dbus_message_new_from_blob
g_dbus_message_new_method_call
g_dbus_message_new_method_error
g_dbus_message_new_method_error_literal
g_dbus_message_new_method_error_valist
g_dbus_message_new_method_reply
g_dbus_message_new_signal
g_dbus_message_print
g_dbus_message_set_body
g_dbus_message_set_byte_order
g_dbus_message_set_destination
g_dbus_message_set_error_name
g_dbus_message_set_flags
g_dbus_message_set_header
g_dbus_message_set_interface
g_dbus_message_set_member
g_dbus_message_set_message_type
g_dbus_message_set_num_unix_fds
g_dbus_message_set_path
g_dbus_message_set_reply_serial
g_dbus_message_set_sender
g_dbus_message_set_serial
g_dbus_message_set_signature
g_dbus_message_to_blob
g_dbus_message_to_gerror
g_dbus_message_type_get_type
g_dbus_method_info_get_type
g_dbus_method_info_ref
g_dbus_method_info_unref
g_dbus_method_invocation_get_connection
g_dbus_method_invocation_get_interface_name
g_dbus_method_invocation_get_message
g_dbus_method_invocation_get_method_info
g_dbus_method_invocation_get_method_name
g_dbus_method_invocation_get_object_path
g_dbus_method_invocation_get_parameters
g_dbus_method_invocation_get_property_info
g_dbus_method_invocation_get_sender
g_dbus_method_invocation_get_type
g_dbus_method_invocation_get_user_data
g_dbus_method_invocation_return_dbus_error
g_dbus_method_invocation_return_error
g_dbus_method_invocation_return_error_literal
g_dbus_method_invocation_return_error_valist
g_dbus_method_invocation_return_gerror
g_dbus_method_invocation_return_value
g_dbus_method_invocation_take_error
g_dbus_node_info_generate_xml
g_dbus_node_info_get_type
g_dbus_node_info_lookup_interface
g_dbus_node_info_new_for_xml
g_dbus_node_info_ref
g_dbus_node_info_unref
g_dbus_object_get_interface
g_dbus_object_get_interfaces
g_dbus_object_get_object_path
g_dbus_object_get_type
g_dbus_object_manager_client_flags_get_type
g_dbus_object_manager_client_get_connection
g_dbus_object_manager_client_get_flags
g_dbus_object_manager_client_get_name
g_dbus_object_manager_client_get_name_owner
g_dbus_object_manager_client_get_type
g_dbus_object_manager_client_new

Sections

.text
Size: 915KB - Virtual size: 915KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cbb9ade4c6bfdacf008da52547be17e

Code Sign

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31Certificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0d:e8:32:2c:5a:0f:3b:81:75:be:2d:de:5b:77:f5:46Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

b8:88:ab:31:d3:89:76:de:50:3a:77:a3:31:6d:bc:38:bc:58:98:26:c1:4e:43:9c:47:cd:a6:ea:b3:2d:42:48Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

glib-2.0-0

gobject-2.0-0

gmodule-2.0-0

zlib1

intl

shlwapi

dnsapi

iphlpapi

ws2_32

kernel32

user32

shell32

ole32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 915KB - Virtual size: 915KB

.rdata Size: 361KB - Virtual size: 360KB

.data Size: 512B - Virtual size: 5KB

.rsrc Size: 1024B - Virtual size: 872B

.reloc Size: 113KB - Virtual size: 113KB

0f:d1:bb:ca:79:6b:d7:f8:dd:4c:82:e1:0a:9a:96:31
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0d:e8:32:2c:5a:0f:3b:81:75:be:2d:de:5b:77:f5:46
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

b8:88:ab:31:d3:89:76:de:50:3a:77:a3:31:6d:bc:38:bc:58:98:26:c1:4e:43:9c:47:cd:a6:ea:b3:2d:42:48
Signer

.text
Size: 915KB - Virtual size: 915KB

.rdata
Size: 361KB - Virtual size: 360KB

.data
Size: 512B - Virtual size: 5KB

.rsrc
Size: 1024B - Virtual size: 872B

.reloc
Size: 113KB - Virtual size: 113KB