Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

• Samples - 10-09-2024.zip

  .zip
• Samples - 10-09-2024/000d7db645b69db54921146fc2e54c5fac3cd9ac6186a7dff03c40274dadf3f3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\ccu1ww\obj\Release\QQf.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 278KB - Virtual size: 277KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/00c66edc8b41592e299f449a6b7a4e3ab949f7cca0c27bba9a279feacc6e5b6b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  1d:cf:3d:0d:e5:45:58:78:3d:49:ed:0a:fa:e0:0e:92:7b:07:b7:43:96:40:5b:e6:a8:d3:b1:24:d6:89:9b:10

  Signer

  Actual PE Digest

  1d:cf:3d:0d:e5:45:58:78:3d:49:ed:0a:fa:e0:0e:92:7b:07:b7:43:96:40:5b:e6:a8:d3:b1:24:d6:89:9b:10

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\3vjguhrz8e9\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/00edc45884fecf9fdc5e28a5b3ffc86d9dcfa99ecef4657628ade5edc117d2fe.exe

  .exe windows:6 windows x86 arch:x86

  e569e6f445d32ba23766ad67d1e3787f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  kernel32

  GetACP

  GetExitCodeProcess

  LocalFree

  CloseHandle

  SizeofResource

  VirtualProtect

  VirtualFree

  GetFullPathNameW

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  RtlUnwind

  GetCPInfo

  GetStdHandle

  GetModuleHandleW

  FreeLibrary

  HeapDestroy

  ReadFile

  CreateProcessW

  GetLastError

  GetModuleFileNameW

  SetLastError

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  GetVersion

  RaiseException

  FormatMessageW

  SwitchToThread

  GetExitCodeThread

  GetCurrentThread

  LoadLibraryExW

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  VirtualQueryEx

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetFileSize

  GetStartupInfoW

  GetFileAttributesW

  InitializeCriticalSection

  GetSystemWindowsDirectoryW

  GetThreadPriority

  SetThreadPriority

  GetCurrentProcess

  VirtualAlloc

  GetSystemInfo

  GetCommandLineW

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  GetWindowsDirectoryW

  VerSetConditionMask

  GetDiskFreeSpaceW

  FindFirstFileW

  GetUserDefaultUILanguage

  lstrlenW

  QueryPerformanceCounter

  SetEndOfFile

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  CreateFileW

  GetLocaleInfoW

  GetSystemDirectoryW

  DeleteFileW

  GetLocalTime

  GetEnvironmentVariableW

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  TlsGetValue

  GetDateFormatW

  SetErrorMode

  IsValidLocale

  TlsSetValue

  CreateDirectoryW

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  GetUserDefaultLangID

  RemoveDirectoryW

  CreateEventW

  SetThreadLocale

  GetThreadLocale

  comctl32

  InitCommonControls

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  user32

  CreateWindowExW

  TranslateMessage

  CharLowerBuffW

  CallWindowProcW

  CharUpperW

  PeekMessageW

  GetSystemMetrics

  SetWindowLongW

  MessageBoxW

  DestroyWindow

  CharUpperBuffW

  CharNextW

  MsgWaitForMultipleObjects

  LoadStringW

  ExitWindowsEx

  DispatchMessageW

  oleaut32

  SysAllocStringLen

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetLBound

  SafeArrayGetUBound

  VariantInit

  VariantClear

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  SafeArrayCreate

  netapi32

  NetWkstaGetInfo

  NetApiBufferFree

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegQueryValueExW

  AdjustTokenPrivileges

  GetTokenInformation

  ConvertSidToStringSidW

  LookupPrivilegeValueW

  RegCloseKey

  OpenProcessToken

  RegOpenKeyExW

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 718KB - Virtual size: 718KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 27KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 420B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 24B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 93B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 388KB - Virtual size: 388KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/038ae1968e1cc1424184b684200cced6e2ddd84d4d8557fc2a10330cb754f44e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  BlueSapphire_portable.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 167KB - Virtual size: 166KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/03e7cf58928e6b9b686b07e577a770ca0ae6e413a44f1bfcb6f1b971ef0fd5e9.exe

  .exe windows:6 windows x64 arch:x64

  9382cefdeb8af34277d5547343f2ca13

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\BACKUP\VGC BYPASS\x64\Release\fox vanguard bypass.pdb

  Imports

  kernel32

  MultiByteToWideChar

  GetEnvironmentVariableA

  GetStdHandle

  GetFileType

  ReadFile

  PeekNamedPipe

  WaitForMultipleObjects

  GetFileSizeEx

  WideCharToMultiByte

  OutputDebugStringW

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  VerSetConditionMask

  IsDebuggerPresent

  SleepEx

  LeaveCriticalSection

  EnterCriticalSection

  LocalFree

  FormatMessageA

  SetLastError

  GetModuleHandleW

  MoveFileExA

  GetModuleFileNameW

  GetModuleFileNameA

  UnmapViewOfFile

  MapViewOfFile

  CreateFileMappingW

  VirtualProtect

  CreateThread

  GetCurrentProcess

  DeleteCriticalSection

  InitializeCriticalSectionEx

  GetProcessHeap

  HeapSize

  HeapFree

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  SleepConditionVariableSRW

  WakeAllConditionVariable

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  WaitForSingleObjectEx

  GetTickCount

  QueryPerformanceCounter

  VerifyVersionInfoA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  GetSystemDirectoryA

  GetModuleHandleA

  QueryPerformanceFrequency

  HeapReAlloc

  HeapAlloc

  HeapDestroy

  GetLastError

  SetConsoleTitleA

  CreateFileW

  GetConsoleWindow

  Beep

  CloseHandle

  CreateFileA

  Sleep

  GetCurrentProcessId

  user32

  ShowWindow

  GetAsyncKeyState

  MessageBoxA

  advapi32

  CryptDestroyKey

  AddAccessAllowedAce

  GetLengthSid

  GetTokenInformation

  InitializeAcl

  IsValidSid

  SetSecurityInfo

  CopySid

  ConvertSidToStringSidA

  CryptAcquireContextA

  CryptReleaseContext

  CryptGetHashParam

  CryptGenRandom

  CryptCreateHash

  CryptHashData

  CryptEncrypt

  CryptImportKey

  OpenProcessToken

  CryptDestroyHash

  shell32

  ShellExecuteA

  msvcp140

  ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

  ?good@ios_base@std@@QEBA_NXZ

  ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ??Bid@locale@std@@QEAA_KXZ

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

  ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

  ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Xbad_function_call@std@@YAXXZ

  ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??1_Lockit@std@@QEAA@XZ

  ??0_Lockit@std@@QEAA@H@Z

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

  ?uncaught_exception@std@@YA_NXZ

  ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

  ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

  ?_Xout_of_range@std@@YAXPEBD@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ?id@?$ctype@D@std@@2V0locale@2@A

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ

  ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z

  ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  urlmon

  URLDownloadToFileA

  normaliz

  IdnToAscii

  wldap32

  ord32

  ord27

  ord26

  ord22

  ord33

  ord301

  ord50

  ord45

  ord60

  ord46

  ord217

  ord143

  ord35

  ord41

  ord79

  ord30

  ord200

  ord211

  crypt32

  CertFreeCertificateChain

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertFindExtension

  CertAddCertificateContextToStore

  CryptDecodeObjectEx

  PFXImportCertStore

  CryptStringToBinaryA

  CertFreeCertificateContext

  CertFindCertificateInStore

  CertEnumCertificatesInStore

  CertCloseStore

  CertGetNameStringA

  CertOpenStore

  ws2_32

  WSAStartup

  ntohl

  gethostname

  sendto

  recvfrom

  freeaddrinfo

  getaddrinfo

  select

  __WSAFDIsSet

  ioctlsocket

  listen

  htonl

  accept

  WSAIoctl

  closesocket

  recv

  WSASetLastError

  socket

  setsockopt

  ntohs

  htons

  getsockopt

  getsockname

  WSACleanup

  getpeername

  send

  connect

  bind

  WSAGetLastError

  rpcrt4

  RpcStringFreeA

  UuidCreate

  UuidToStringA

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __std_exception_copy

  __std_exception_destroy

  __std_terminate

  _CxxThrowException

  __current_exception_context

  __current_exception

  __C_specific_handler

  strstr

  strrchr

  strchr

  memset

  memmove

  memcpy

  memcmp

  memchr

  api-ms-win-crt-runtime-l1-1-0

  strerror

  abort

  _errno

  terminate

  _invalid_parameter_noinfo_noreturn

  _beginthreadex

  _invalid_parameter_noinfo

  _register_thread_local_exe_atexit_callback

  system

  _resetstkoflw

  _c_exit

  __p___argv

  __p___argc

  exit

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  _cexit

  _seh_filter_exe

  _set_app_type

  _getpid

  _get_initial_narrow_environment

  _initterm

  _initterm_e

  _exit

  __sys_nerr

  api-ms-win-crt-stdio-l1-1-0

  __stdio_common_vfprintf

  fgets

  _lseeki64

  _pclose

  _popen

  __p__commode

  __acrt_iob_func

  __stdio_common_vsprintf

  fread

  fwrite

  _read

  _write

  _close

  _open

  fflush

  fputc

  ftell

  fseek

  feof

  fclose

  _set_fmode

  fopen

  fputs

  __stdio_common_vsscanf

  api-ms-win-crt-filesystem-l1-1-0

  _mkdir

  _unlink

  _access

  _fstat64

  _stat64

  api-ms-win-crt-heap-l1-1-0

  free

  _set_new_mode

  malloc

  realloc

  _callnewh

  calloc

  api-ms-win-crt-convert-l1-1-0

  strtoull

  strtoll

  strtoul

  strtol

  atoi

  strtod

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  localeconv

  api-ms-win-crt-math-l1-1-0

  _dclass

  __setusermatherr

  api-ms-win-crt-string-l1-1-0

  strncpy

  strspn

  isupper

  tolower

  strncmp

  strcspn

  strcmp

  strpbrk

  _strdup

  api-ms-win-crt-time-l1-1-0

  _time64

  _gmtime64

  api-ms-win-crt-utility-l1-1-0

  qsort

  Sections

  .text

  Size: 445KB - Virtual size: 445KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 103KB - Virtual size: 102KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/046360bb55b66aba6570ac8567f02970e818e335012f951ae95bc78c46488e58.exe

  .exe .js windows:4 windows x64 arch:x64 polyglot

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 363KB - Virtual size: 363KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/049eaf34a048a80c4bdac29dbe453169f2b0927caec3e397c1b9eff016b9b415.exe

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Code Sign

  6e:dd:4f:25:e7:31:7d:39:81:57:31:34:cf:c1:dc:a0

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  07-03-2019 19:37

  Not After

  03-03-2034 19:37

  Subject

  CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5b:f5:02:da:d2:e9:da:26:11:f0:8f:10:b7:05:db:fd

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA ECC R2,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  15-11-2022 19:52

  Not After

  15-11-2023 19:52

  Subject

  SERIALNUMBER=LC1336587,CN=Software Technologies\, LLC,O=Software Technologies\, LLC,L=Chesterfield,ST=Missouri,C=US,1.3.6.1.4.1.311.60.2.1.3=#13025553,1.3.6.1.4.1.311.60.2.1.2=#13084d6973736f757269,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7f:a3:2b:28:b1:c9:ab:6c

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  14-02-2019 18:08

  Not After

  12-02-2027 18:08

  Subject

  CN=SSL.com EV Root Certification Authority ECC,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  fe:50:41:35:e7:11:78:14:f3:51:38:4c:1d:ec:93:99:d6:b7:c7:d2

  Signer

  Actual PE Digest

  fe:50:41:35:e7:11:78:14:f3:51:38:4c:1d:ec:93:99:d6:b7:c7:d2

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 266KB - Virtual size: 265KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $TEMP/Fifty
• $TEMP/Visitor
• OliverAspects/Ibm
• OliverAspects/Radius
• ProgrammersDiscretion/Adaptive
• ProgrammersDiscretion/Bright
• ProgrammersDiscretion/Buy
• ProgrammersDiscretion/Danger
• ProgrammersDiscretion/Faqs
• ProgrammersDiscretion/Founder
• ProgrammersDiscretion/Hd
• ProgrammersDiscretion/Specialist
• ProgrammersDiscretion/Vessel
• ThisElder/Abilities
• ThisElder/Pork
• ThisElder/Reaction
• Samples - 10-09-2024/052dca4820559afcefaa0fc6769f8095e160d887a1e08e9393e4da9d3fa2a7eb.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 924KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 370KB - Virtual size: 372KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 384KB - Virtual size: 388KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 392KB - Virtual size: 391KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/053bb9bc1549cd2dc4e84b8d53735171ed1e62810cedb71c48210fe1487b8fb5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1024B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/057459c5c8e79e46b8d507c2d498d54fd7a72528682f91668efdd3097aed7b41.exe

  .exe windows:5 windows x86 arch:x86

  332197ba5fd76061827e542a2853acf2

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetCommandLineW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  CreateDirectoryW

  GetTempPathW

  WaitForSingleObject

  Sleep

  GetExitCodeProcess

  CreateProcessW

  FreeLibrary

  LoadLibraryExW

  CloseHandle

  GetCurrentProcess

  LoadLibraryA

  LocalFree

  FormatMessageW

  MultiByteToWideChar

  WideCharToMultiByte

  SetEndOfFile

  GetProcAddress

  GetModuleFileNameW

  SetDllDirectoryW

  GetStartupInfoW

  GetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetModuleHandleW

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  RaiseException

  GetCommandLineA

  ReadFile

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetFullPathNameW

  RemoveDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  SetStdHandle

  SetConsoleCtrlHandler

  DeleteFileW

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  CompareStringW

  LCMapStringW

  GetCurrentDirectoryW

  FlushFileBuffers

  GetFileAttributesExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStringTypeW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  HeapReAlloc

  WriteConsoleW

  DecodePointer

  advapi32

  ConvertSidToStringSidW

  GetTokenInformation

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  Sections

  .text

  Size: 132KB - Virtual size: 132KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 51KB - Virtual size: 50KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 60KB - Virtual size: 60KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• main.pyc
• Samples - 10-09-2024/05d5d2f7e1270d38d47870c349d22a7e02c9682ba123b1b5e8ae1aa4e3554087.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3d:60:fb:dd:1d:9e:77:ad:ac:24:39:d5:26:e7:79:8b:7f:d9:11:29:d3:a2:92:ff:9e:d0:dd:34:c5:9f:1f:db

  Signer

  Actual PE Digest

  3d:60:fb:dd:1d:9e:77:ad:ac:24:39:d5:26:e7:79:8b:7f:d9:11:29:d3:a2:92:ff:9e:d0:dd:34:c5:9f:1f:db

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\80f0tic\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/06510b52e07e89b5781f4ee3c7b4d94ff84c03931b3d7d93224294860feaccf4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  87:d2:94:e2:f3:92:ce:1c:90:bf:29:35:f9:4c:8f:1f:b7:f2:bf:6c:d3:f0:bf:ea:ef:15:a2:1c:ab:ef:c8:10

  Signer

  Actual PE Digest

  87:d2:94:e2:f3:92:ce:1c:90:bf:29:35:f9:4c:8f:1f:b7:f2:bf:6c:d3:f0:bf:ea:ef:15:a2:1c:ab:ef:c8:10

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\1v4akz\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/07257929fa0d479e0bdd3b93d4f97279b671ceabca49c1c43c86f691a9bd8388.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 56KB - Virtual size: 56KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0794c35f0d5670d54f488f94c3fc3738de8f7362dc6c402d285063f1bf7a0fc9.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/07b8972ecab0d6a49d2319054d81a2b239a107b9f746f204bd47ed26f1cdafe9.exe

  .exe windows:5 windows x86 arch:x86

  190e11c840566a4470035f661fce6f44

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FillConsoleOutputCharacterA

  SearchPathW

  SetPriorityClass

  GetConsoleAliasesLengthW

  CopyFileExW

  GetNumaProcessorNode

  GetConsoleAliasExesLengthA

  InterlockedIncrement

  OpenJobObjectA

  QueryDosDeviceA

  GetComputerNameW

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetTickCount

  GetConsoleAliasesA

  GetUserDefaultLangID

  GetEnvironmentStrings

  LoadLibraryW

  GetConsoleMode

  Sleep

  CopyFileW

  WriteConsoleOutputA

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetBinaryTypeA

  GetModuleFileNameW

  GetStartupInfoW

  GetCommandLineW

  DisconnectNamedPipe

  CreateDirectoryA

  InterlockedExchange

  GetLastError

  GetProcAddress

  SetStdHandle

  SearchPathA

  BuildCommDCBW

  OpenWaitableTimerW

  LocalAlloc

  WritePrivateProfileStringA

  FindAtomA

  FoldStringW

  WaitForMultipleObjects

  GetDefaultCommConfigA

  SetConsoleTitleW

  GetModuleHandleA

  GetShortPathNameW

  SetCalendarInfoA

  GlobalReAlloc

  SetFileAttributesW

  GetVolumeInformationW

  CreateFileA

  DebugActiveProcess

  HeapFree

  HeapAlloc

  MultiByteToWideChar

  ExitProcess

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapCreate

  VirtualFree

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  HeapReAlloc

  WriteFile

  GetStdHandle

  GetModuleFileNameA

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  HeapSize

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  LoadLibraryA

  InitializeCriticalSectionAndSpinCount

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  GetFileType

  GetStartupInfoA

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  RtlUnwind

  LCMapStringA

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeA

  GetStringTypeW

  GetLocaleInfoA

  GetConsoleCP

  FlushFileBuffers

  ReadFile

  CloseHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  SetFilePointer

  user32

  SetFocus

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 143KB - Virtual size: 142KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 996KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 117KB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/08d54acc0e22ba91e89824ee3b838f5527abeb53e36996e3d92e93f7c27dd77d.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:c5:30:70:3a:21:0e:c1:d6:f8:3c:b4:fe:11:18:c5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  22-09-2022 00:00

  Not After

  19-10-2023 23:59

  Subject

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:da:1b:c3:6f:66:0f:ad:fb:79:4b:0e:6a:18:24:bd:19:35:e7:d3:54:79:cd:09:ea:8a:b7:3f:77:fb:80:af

  Signer

  Actual PE Digest

  0f:da:1b:c3:6f:66:0f:ad:fb:79:4b:0e:6a:18:24:bd:19:35:e7:d3:54:79:cd:09:ea:8a:b7:3f:77:fb:80:af

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\0hpdarhozk5\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 309KB - Virtual size: 308KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/08d9eaf252fa4748877ece4835cdc473ae13918d04331a0b7001e75babc03b97.exe

  .exe windows:5 windows x86 arch:x86

  2eabe9054cad5152567f0699947a2c5b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrcpy

  Sections

  Size: 79KB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Size: 512B - Virtual size: 2.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  lvgxkjvi

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  vaystkph

  Size: 1024B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .taggant

  Size: 8KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/094ca29b78b7698bb8be3e85576bf943e5612d3c21c99c72fb058d1f912f68df.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 715KB - Virtual size: 714KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/09ac6376b07a7b513e3250e66dda03697803dc861dab52ed3a297046b6f1e065.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 376KB - Virtual size: 375KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/09ff4bcebea6598159b1341704093ab1ff7e2a1eecd0cdc38cb865edb5a35b62.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  jXCQ.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 691KB - Virtual size: 691KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0a46c8374fee9c1acf462dfae07f72f4443583202bb93dd943f1775c7bac024b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0a53cea941f54b99aee485e52ed96a805dc19a4e76472952c31dc5a11bf70469.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 432KB - Virtual size: 431KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0a937e816b3a0554c42c27c18914a02d869dca6bf137c39691588322d5f5f436.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 92KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 61KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 6KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/0b3e1e30dae8e83d9e3832c6cb382dcfce5634a3f0d1610c575d890db11c77c7.exe

  .exe windows:5 windows x86 arch:x86

  bf95d1fc1d10de18b32654b123ad5e1f

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  09:34:4c:eb:47:db:da:41:bd:0d:58:2c:92:18:17:8a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  28-04-2022 00:00

  Not After

  29-04-2025 23:59

  Subject

  SERIALNUMBER=0111-01-089911,CN=LINE Corporation,OU=IT Service Center,O=LINE Corporation,L=Shinjuku-ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:34:4c:eb:47:db:da:41:bd:0d:58:2c:92:18:17:8a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  28-04-2022 00:00

  Not After

  29-04-2025 23:59

  Subject

  SERIALNUMBER=0111-01-089911,CN=LINE Corporation,OU=IT Service Center,O=LINE Corporation,L=Shinjuku-ku,ST=Tokyo,C=JP,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024a50

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  35:d8:8f:4b:3d:ae:24:c9:23:44:3c:1c:0f:d8:6b:14:8e:f5:8a:47:87:64:2b:93:6a:fc:d6:e6:8b:46:c4:0e

  Signer

  Actual PE Digest

  35:d8:8f:4b:3d:ae:24:c9:23:44:3c:1c:0f:d8:6b:14:8e:f5:8a:47:87:64:2b:93:6a:fc:d6:e6:8b:46:c4:0e

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  77:42:e5:a8:3d:e5:e9:0e:91:2c:c7:b6:7a:3e:17:93:4b:de:e5:72

  Signer

  Actual PE Digest

  77:42:e5:a8:3d:e5:e9:0e:91:2c:c7:b6:7a:3e:17:93:4b:de:e5:72

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  MulDiv

  lstrlenA

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  FindWindowExW

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  IsWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 26KB - Virtual size: 25KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 452KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 373KB - Virtual size: 373KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• $TEMP/Athletic
• $TEMP/Fda
• $TEMP/Migration
• $TEMP/Promptly
• $TEMP/Psychiatry
• $TEMP/Roll
• $TEMP/Scroll
• $TEMP/Sign
• $TEMP/Tiffany
• KyleSing/Planners
• TitledPrivate/Original
• Samples - 10-09-2024/0b599ef67428ccbef1a017233238ca952da95c7c40135850f7afa4a7d9a521cb.exe

  .exe windows:10 windows x86 arch:x86

  b6df92b17f27e1708240ec29f2498c77

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  ImeBroker.pdb

  Imports

  user32

  PeekMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  AllowSetForegroundWindow

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetSystemMetrics

  CharNextW

  WaitForInputIdle

  msvcrt

  wcsncat_s

  _initterm

  swscanf_s

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  _wcmdln

  _amsg_exit

  __p__commode

  _XcptFilter

  ?what@exception@@UBEPBDXZ

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  tolower

  wcsnlen

  wcsrchr

  wcsncpy_s

  _lock

  _unlock

  __dllonexit

  _onexit

  ??1type_info@@UAE@XZ

  ?terminate@@YAXXZ

  _controlfp

  _except_handler4_common

  _vsnwprintf

  free

  malloc

  memcpy

  vswprintf_s

  wcsncmp

  _wcsnicmp

  _vsnwprintf_s

  ??_V@YAXPAX@Z

  _wtoi

  __wgetmainargs

  memcmp

  _CIlog

  __CxxFrameHandler3

  _CxxThrowException

  _purecall

  memmove

  _CIexp

  memset

  api-ms-win-core-com-l1-1-1

  CoReleaseServerProcess

  CoAddRefServerProcess

  CreateStreamOnHGlobal

  CoInitializeSecurity

  CoInitializeEx

  CoRegisterClassObject

  CoResumeClassObjects

  CoTaskMemFree

  CoRevokeClassObject

  CoUninitialize

  CoCreateInstance

  CoTaskMemAlloc

  api-ms-win-core-synch-l1-2-0

  OpenEventW

  Sleep

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  SetEvent

  ReleaseMutex

  OpenMutexW

  CreateMutexW

  InitOnceComplete

  CreateEventW

  ReleaseSRWLockExclusive

  WaitForSingleObject

  InitOnceBeginInitialize

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-libraryloader-l1-2-0

  LoadResource

  FreeLibrary

  GetModuleHandleA

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  FindResourceExW

  FreeLibraryAndExitThread

  GetModuleFileNameA

  GetModuleHandleW

  LockResource

  SizeofResource

  api-ms-win-core-heap-l1-2-0

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-errorhandling-l1-1-1

  SetErrorMode

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-2

  ResumeThread

  GetCurrentProcessId

  GetCurrentProcess

  CreateThread

  OpenProcessToken

  CreateProcessW

  GetStartupInfoW

  GetExitCodeProcess

  GetCurrentThreadId

  TerminateProcess

  SetPriorityClass

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventWrite

  EventActivityIdControl

  EventUnregister

  EventRegister

  EventSetInformation

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetSystemDirectoryW

  GetSystemTime

  GetTickCount64

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-security-base-l1-2-0

  AllocateAndInitializeSid

  IsValidSid

  GetSidSubAuthority

  GetTokenInformation

  GetSidSubAuthorityCount

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegOpenKeyExW

  RegGetValueW

  RegQueryValueExW

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalAlloc

  GlobalFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysStringLen

  SysAllocString

  api-ms-win-core-localization-l1-2-1

  LCMapStringW

  FormatMessageW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-file-l1-2-1

  SetFileTime

  GetFileSize

  CreateFileW

  GetTempPathW

  CreateDirectoryW

  GetTempFileNameW

  FindFirstFileW

  FindNextFileW

  FindClose

  DeleteFileW

  WriteFile

  SetEndOfFile

  GetFileAttributesW

  SetFilePointer

  api-ms-win-core-memory-l1-1-2

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-core-string-l1-1-0

  CompareStringW

  advapi32

  SetEntriesInAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  shell32

  ord165

  SHGetFolderPathW

  SHCreateDirectoryExW

  ShellExecuteW

  shlwapi

  ord12

  PathFileExistsW

  api-ms-win-appmodel-runtime-l1-1-1

  GetCurrentPackageFullName

  GetPackageFullName

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  api-ms-win-security-trustee-l1-1-1

  BuildExplicitAccessWithNameW

  profapi

  ord104

  Sections

  .text

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0b6cd2b1e18193ba33edbd6a3fc464a6e302f0da7f881dd48aedbf6ba993aa32.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\r3hewjix2vbik\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0b7846217c55d059c76ae8dfa0aec50305daef334b2bb72b63b64d76412bcae2.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0bc7b4a992c8fee7d2f044fd75dca52a4922bbe341aada65bdd80721d8a9e7a4.exe

  .exe windows:10 windows x86 arch:x86

  f80bc97436232f135d9706a88c8c960e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  nslookup.pdb

  Imports

  msvcrt

  exit

  perror

  fclose

  fflush

  sscanf_s

  sprintf_s

  putchar

  gmtime

  strcat_s

  __set_app_type

  system

  strchr

  strcpy_s

  putc

  __setusermatherr

  __getmainargs

  _vsnprintf

  fputc

  _exit

  _cexit

  _amsg_exit

  __p__commode

  fopen

  strncpy_s

  _strnicmp

  fgets

  strncmp

  isspace

  __p__fmode

  memcpy

  malloc

  fread

  _XcptFilter

  free

  printf

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  _initterm

  fputs

  fwrite

  fprintf

  getc

  _write

  realloc

  ferror

  getenv

  __iob_func

  memset

  api-ms-win-core-heap-l1-1-0

  HeapAlloc

  HeapSetInformation

  GetProcessHeap

  HeapFree

  ws2_32

  getprotobynumber

  getservbyport

  WSAGetLastError

  ntohs

  select

  htonl

  gethostname

  getaddrinfo

  WSAStartup

  inet_ntoa

  freeaddrinfo

  send

  closesocket

  socket

  connect

  recv

  htons

  crypt32

  CryptBinaryToStringA

  api-ms-win-core-errorhandling-l1-1-0

  GetLastError

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  SetLastError

  dnsapi

  DnsQueryConfigAllocEx

  DnsFreeConfigStructure

  api-ms-win-core-localization-l1-2-0

  SetThreadUILanguage

  FormatMessageA

  api-ms-win-core-registry-l1-1-0

  RegCloseKey

  api-ms-win-core-processenvironment-l1-1-0

  ExpandEnvironmentStringsA

  mswsock

  s_perror

  api-ms-win-core-heap-l2-1-0

  LocalFree

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentThreadId

  GetCurrentProcess

  TerminateProcess

  GetCurrentProcessId

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleHandleW

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetSystemTimeAsFileTime

  ntdll

  NtQueryValueKey

  RtlInitString

  RtlUnicodeStringToAnsiString

  RtlFreeUnicodeString

  NtOpenKey

  RtlAllocateHeap

  RtlAnsiStringToUnicodeString

  RtlIpv6StringToAddressExA

  RtlIpv4StringToAddressA

  RtlIpv6AddressToStringA

  RtlFreeHeap

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  Sections

  .text

  Size: 47KB - Virtual size: 46KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0c19bad7c0ab86a954f8d5cb8b0fc410bb8a792fa0a63140197db4f65e6af6c5.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0c240bbd2732102296862088a459c4854bea6e8bdfac19a4a9da47b0d6f25900.exe

  .exe windows:5 windows x86 arch:x86

  e3a7c5d6054e45d92305be46e5850ca7

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\webapps\b\build\slave\repo\build\src\out\Release\Uninstall.exe.pdb

  Imports

  gdiplus

  GdipCreateImageAttributes

  GdipBitmapLockBits

  GdipBitmapUnlockBits

  GdipFillRectangle

  GdipFillPath

  GdipDrawImageRectI

  GdipGetImageHeight

  GdipCreateBitmapFromFile

  GdipCreateHBITMAPFromBitmap

  GdipCreateBitmapFromResource

  GdipGetImageWidth

  GdipAlloc

  GdipFillEllipse

  GdipSetSmoothingMode

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipGetSolidFillColor

  GdipCreateBitmapFromStream

  GdipCreateSolidFill

  GdipDeleteBrush

  GdipCloneBrush

  GdipLoadImageFromStreamICM

  GdipLoadImageFromStream

  GdipFree

  GdipSetSolidFillColor

  GdipSetClipRegion

  GdipDeleteRegion

  GdipCreateRegionPath

  GdipAddPathArc

  GdipDeletePath

  GdipCreatePath

  GdiplusShutdown

  GdiplusStartup

  GdipDrawString

  GdipCreateFont

  GdipGetGenericFontFamilySansSerif

  GdipFillRectangleI

  GdipDrawRectangle

  GdipDeletePen

  GdipCreatePen1

  GdipSetStringFormatTrimming

  GdipSetStringFormatLineAlign

  GdipSetStringFormatAlign

  GdipSetStringFormatFlags

  GdipCloneStringFormat

  GdipDeleteStringFormat

  GdipStringFormatGetGenericDefault

  GdipMeasureString

  GdipDeleteFont

  GdipCloneFont

  GdipCreateFontFromLogfontA

  GdipCreateFontFromDC

  GdipReleaseDC

  GdipGetDC

  GdipCreateBitmapFromScan0

  GdipGetImageGraphicsContext

  GdipDisposeImage

  GdipCloneImage

  GdipDrawImageRectRectI

  GdipDrawImageRect

  GdipRotateWorldTransform

  GdipTranslateWorldTransform

  GdipSetImageAttributesColorMatrix

  GdipDisposeImageAttributes

  advapi32

  AdjustTokenPrivileges

  OpenProcessToken

  GetTokenInformation

  SystemFunction036

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegCloseKey

  RegOpenKeyExW

  RegQueryValueExW

  RegSetValueExW

  RegCreateKeyExW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegQueryInfoKeyW

  CreateProcessAsUserW

  LookupPrivilegeValueW

  gdi32

  GetObjectA

  DeleteObject

  CreateBitmap

  CreateCompatibleDC

  DeleteDC

  SelectObject

  BitBlt

  CreateDIBSection

  CreateFontW

  CreateCompatibleBitmap

  CreateFontIndirectW

  CreatePatternBrush

  CreateRoundRectRgn

  GetStockObject

  PatBlt

  SetBkColor

  SetBkMode

  SetTextColor

  GetObjectW

  ExtTextOutW

  SetViewportOrgEx

  SetWindowOrgEx

  CreateRectRgn

  PtInRegion

  kernel32

  IsProcessorFeaturePresent

  InitializeCriticalSection

  FormatMessageW

  SetErrorMode

  RtlCaptureContext

  CreateFileA

  UnhandledExceptionFilter

  DeviceIoControl

  GetVolumePathNamesForVolumeNameW

  GetDriveTypeW

  FindVolumeClose

  FindNextVolumeW

  FindFirstVolumeW

  GetStartupInfoW

  InitializeSListHead

  EncodePointer

  LCMapStringW

  GetLocaleInfoW

  GetStringTypeW

  GetCPInfo

  OutputDebugStringW

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  FlushInstructionCache

  LoadLibraryExA

  RtlUnwind

  GetConsoleCP

  GetConsoleMode

  GetFullPathNameW

  SetStdHandle

  ExitThread

  FreeLibraryAndExitThread

  GetACP

  CreateMutexW

  ReadConsoleW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetTimeZoneInformation

  WriteConsoleW

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SleepEx

  GetFileType

  PeekNamedPipe

  GetSystemDirectoryW

  GetWindowsDirectoryW

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  LocalFree

  lstrcmpiW

  ExpandEnvironmentStringsW

  CreateFileW

  LocalFileTimeToFileTime

  ReadFile

  SetFileAttributesW

  SetFilePointer

  SetFileTime

  WriteFile

  CloseHandle

  HeapAlloc

  HeapFree

  GetProcessHeap

  GetProcAddress

  LoadLibraryExW

  DosDateTimeToFileTime

  lstrlenW

  MultiByteToWideChar

  WideCharToMultiByte

  CreateDirectoryW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindFirstFileExW

  FindNextFileW

  GetFileAttributesW

  GetVolumeInformationW

  GetVolumePathNameW

  RemoveDirectoryW

  GetTempPathW

  GetLastError

  WaitForSingleObject

  GetCurrentProcess

  ExitProcess

  GetExitCodeProcess

  CreateProcessW

  GetModuleFileNameW

  GetModuleHandleW

  LocalAlloc

  SetProcessWorkingSetSize

  EnumResourceNamesW

  DecodePointer

  RaiseException

  HeapDestroy

  HeapReAlloc

  HeapSize

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  GetCommandLineW

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  Sleep

  GetCurrentProcessId

  GetCurrentThreadId

  ProcessIdToSessionId

  FreeLibrary

  SetDllDirectoryW

  GetTickCount

  CreateEventW

  FindResourceExW

  FreeResource

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  GlobalFree

  CompareStringW

  GetDiskFreeSpaceExW

  OpenProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  GetModuleHandleExW

  LoadLibraryW

  GetCurrentDirectoryW

  OutputDebugStringA

  FormatMessageA

  SetCurrentDirectoryW

  GetFileAttributesExW

  GetLongPathNameW

  GetTempFileNameW

  CopyFileW

  MoveFileExW

  GetProcessId

  DuplicateHandle

  TerminateProcess

  GetStdHandle

  SetHandleInformation

  ResumeThread

  AssignProcessToJobObject

  GetVersionExW

  GetNativeSystemInfo

  SetEvent

  ResetEvent

  WaitForMultipleObjects

  QueryPerformanceCounter

  QueryPerformanceFrequency

  GetCurrentThread

  SetThreadPriority

  GetThreadPriority

  GetSystemTimeAsFileTime

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  FlushFileBuffers

  GetFileInformationByHandle

  SetEndOfFile

  SetFilePointerEx

  IsDebuggerPresent

  CreateThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  RtlCaptureStackBackTrace

  SetUnhandledExceptionFilter

  TryEnterCriticalSection

  CreateIoCompletionPort

  GetQueuedCompletionStatus

  PostQueuedCompletionStatus

  VirtualAlloc

  VirtualFree

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  msimg32

  AlphaBlend

  ole32

  CoUninitialize

  CoInitializeEx

  CoInitializeSecurity

  CoSetProxyBlanket

  CoCreateInstance

  CoTaskMemAlloc

  CoTaskMemRealloc

  CoTaskMemFree

  CoInitialize

  CreateStreamOnHGlobal

  oleaut32

  VarUI4FromStr

  SysAllocString

  VariantInit

  SysFreeString

  VariantClear

  psapi

  GetModuleFileNameExW

  GetProcessImageFileNameW

  shell32

  ShellExecuteW

  ord680

  CommandLineToArgvW

  ShellExecuteExW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFolderPathW

  user32

  UpdateWindow

  DrawTextW

  GetMenu

  GetSystemMetrics

  IsWindowEnabled

  EnableWindow

  GetCapture

  SetFocus

  GetWindowTextLengthW

  SetWindowRgn

  GetWindowRgn

  EnumChildWindows

  LoadStringW

  IsDialogMessageW

  LoadImageW

  DestroyCursor

  GetClassNameW

  GetWindowTextW

  RedrawWindow

  SetWindowTextW

  OffsetRect

  CopyRect

  SetRectEmpty

  FillRect

  GetSysColor

  ClientToScreen

  GetCursorPos

  AdjustWindowRectEx

  InvalidateRect

  UnregisterClassW

  GetMessageW

  TranslateMessage

  DispatchMessageW

  PeekMessageW

  DefWindowProcW

  DestroyWindow

  ShowWindow

  SetWindowPos

  CreateDialogParamW

  CharNextW

  GetClientRect

  GetWindowRect

  MessageBoxW

  MapWindowPoints

  GetWindowLongW

  SetWindowLongW

  GetParent

  GetWindow

  MonitorFromWindow

  GetMonitorInfoW

  TrackMouseEvent

  IsWindow

  UpdateLayeredWindow

  MoveWindow

  SetCapture

  ReleaseCapture

  SetTimer

  KillTimer

  GetDC

  ReleaseDC

  SetCursor

  ScreenToClient

  LoadCursorW

  PostMessageW

  RegisterClassExW

  CreateWindowExW

  BeginPaint

  EndPaint

  PtInRect

  PostQuitMessage

  SetForegroundWindow

  SendMessageW

  CallWindowProcW

  GetClassInfoExW

  IsWindowVisible

  GetDlgItem

  GetDlgCtrlID

  wininet

  InternetCloseHandle

  InternetReadFile

  InternetOpenUrlW

  InternetOpenW

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetTime

  ws2_32

  accept

  sendto

  recvfrom

  __WSAFDIsSet

  freeaddrinfo

  getaddrinfo

  WSASetLastError

  setsockopt

  ntohs

  htons

  getsockopt

  listen

  getpeername

  connect

  bind

  send

  recv

  WSAGetLastError

  socket

  closesocket

  WSACleanup

  WSAStartup

  select

  gethostname

  getsockname

  ioctlsocket

  userenv

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  comctl32

  _TrackMouseEvent

  winhttp

  WinHttpGetIEProxyConfigForCurrentUser

  Exports

  Exports

  GetHandleVerifier

  curl_easy_cleanup

  curl_easy_duphandle

  curl_easy_escape

  curl_easy_getinfo

  curl_easy_init

  curl_easy_pause

  curl_easy_perform

  curl_easy_recv

  curl_easy_reset

  curl_easy_send

  curl_easy_setopt

  curl_easy_strerror

  curl_easy_unescape

  curl_escape

  curl_formadd

  curl_formfree

  curl_formget

  curl_free

  curl_getdate

  curl_getenv

  curl_global_cleanup

  curl_global_init

  curl_global_init_mem

  curl_maprintf

  curl_mfprintf

  curl_mprintf

  curl_msnprintf

  curl_msprintf

  curl_multi_add_handle

  curl_multi_assign

  curl_multi_cleanup

  curl_multi_fdset

  curl_multi_info_read

  curl_multi_init

  curl_multi_perform

  curl_multi_remove_handle

  curl_multi_setopt

  curl_multi_socket

  curl_multi_socket_action

  curl_multi_socket_all

  curl_multi_strerror

  curl_multi_timeout

  curl_mvaprintf

  curl_mvfprintf

  curl_mvprintf

  curl_mvsnprintf

  curl_mvsprintf

  curl_share_cleanup

  curl_share_init

  curl_share_setopt

  curl_share_strerror

  curl_slist_append

  curl_slist_free_all

  curl_strequal

  curl_strnequal

  curl_unescape

  Sections

  .text

  Size: 902KB - Virtual size: 902KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gfids

  Size: 1024B - Virtual size: 832B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 2B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0c7aaf640120bd6ee174f9a5db14dd22c689815b3a0965bb951de5a52ca896d4.exe

  .exe windows:1 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0c7dba4a1931d61ade581c4414cddea64948bcd740b4db9526a70bf6281b9e80.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 376KB - Virtual size: 375KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0c81f7d71edf18ecab3266e864dfb4d6ff5cd1dfa860e0e429ae35863bbf7130.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0cd3ff4f8b2c265ff55547bacf826e628fe88678efa001bb28ef5f9c65308de8.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0f176b21404c995d449d4abfa9ac7c9614c2ee2f3a204efffa3783dd16832c58.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-04-2024 00:00

  Not After

  10-04-2027 23:59

  Subject

  SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  ae:fe:a3:9f:dc:df:7f:ac:c9:1f:31:c1:04:ee:0d:9f:c5:97:3e:24:60:62:a1:55:be:83:28:76:b1:87:85:72

  Signer

  Actual PE Digest

  ae:fe:a3:9f:dc:df:7f:ac:c9:1f:31:c1:04:ee:0d:9f:c5:97:3e:24:60:62:a1:55:be:83:28:76:b1:87:85:72

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1008KB - Virtual size: 1008KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 200KB - Virtual size: 200KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0f4824bc494dc0898196f7ff2b775a35b25a34bc1758501b8f8f6f56f19829a3.exe

  .exe windows:6 windows x86 arch:x86

  e569e6f445d32ba23766ad67d1e3787f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  kernel32

  GetACP

  GetExitCodeProcess

  LocalFree

  CloseHandle

  SizeofResource

  VirtualProtect

  VirtualFree

  GetFullPathNameW

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  RtlUnwind

  GetCPInfo

  GetStdHandle

  GetModuleHandleW

  FreeLibrary

  HeapDestroy

  ReadFile

  CreateProcessW

  GetLastError

  GetModuleFileNameW

  SetLastError

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  GetVersion

  RaiseException

  FormatMessageW

  SwitchToThread

  GetExitCodeThread

  GetCurrentThread

  LoadLibraryExW

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  VirtualQueryEx

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetFileSize

  GetStartupInfoW

  GetFileAttributesW

  InitializeCriticalSection

  GetSystemWindowsDirectoryW

  GetThreadPriority

  SetThreadPriority

  GetCurrentProcess

  VirtualAlloc

  GetSystemInfo

  GetCommandLineW

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  GetWindowsDirectoryW

  VerSetConditionMask

  GetDiskFreeSpaceW

  FindFirstFileW

  GetUserDefaultUILanguage

  lstrlenW

  QueryPerformanceCounter

  SetEndOfFile

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  CreateFileW

  GetLocaleInfoW

  GetSystemDirectoryW

  DeleteFileW

  GetLocalTime

  GetEnvironmentVariableW

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  TlsGetValue

  GetDateFormatW

  SetErrorMode

  IsValidLocale

  TlsSetValue

  CreateDirectoryW

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  GetUserDefaultLangID

  RemoveDirectoryW

  CreateEventW

  SetThreadLocale

  GetThreadLocale

  comctl32

  InitCommonControls

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  user32

  CreateWindowExW

  TranslateMessage

  CharLowerBuffW

  CallWindowProcW

  CharUpperW

  PeekMessageW

  GetSystemMetrics

  SetWindowLongW

  MessageBoxW

  DestroyWindow

  CharUpperBuffW

  CharNextW

  MsgWaitForMultipleObjects

  LoadStringW

  ExitWindowsEx

  DispatchMessageW

  oleaut32

  SysAllocStringLen

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetLBound

  SafeArrayGetUBound

  VariantInit

  VariantClear

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  SafeArrayCreate

  netapi32

  NetWkstaGetInfo

  NetApiBufferFree

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegQueryValueExW

  AdjustTokenPrivileges

  GetTokenInformation

  ConvertSidToStringSidW

  LookupPrivilegeValueW

  RegCloseKey

  OpenProcessToken

  RegOpenKeyExW

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 718KB - Virtual size: 718KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 27KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 420B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 24B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 93B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/0ffb30938e0b893c0d0462f4330e7624b93f588b6f66574e7d2d31982dd5d037.exe

  .exe windows:6 windows x64 arch:x64

  a06f302f71edd380da3d5bf4a6d94ebd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  TranslateMessage

  ShutdownBlockReasonCreate

  GetWindowThreadProcessId

  SetWindowLongPtrW

  GetWindowLongPtrW

  MsgWaitForMultipleObjects

  ShowWindow

  DestroyWindow

  CreateWindowExW

  RegisterClassW

  DefWindowProcW

  PeekMessageW

  DispatchMessageW

  GetMessageW

  kernel32

  GetTimeZoneInformation

  GetProcessHeap

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  GetStringTypeW

  FormatMessageW

  GetLastError

  GetModuleFileNameW

  LoadLibraryExW

  SetDllDirectoryW

  CreateSymbolicLinkW

  GetProcAddress

  CreateDirectoryW

  GetCommandLineW

  GetEnvironmentVariableW

  ExpandEnvironmentStringsW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  HeapSize

  RemoveDirectoryW

  GetTempPathW

  CloseHandle

  QueryPerformanceCounter

  QueryPerformanceFrequency

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  GetCurrentProcessId

  TerminateProcess

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LocalFree

  SetConsoleCtrlHandler

  GetConsoleWindow

  K32EnumProcessModules

  K32GetModuleFileNameExW

  CreateFileW

  FindFirstFileExW

  GetFinalPathNameByHandleW

  MultiByteToWideChar

  WideCharToMultiByte

  GetFileAttributesExW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  GetDriveTypeW

  IsDebuggerPresent

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  GetModuleHandleW

  RtlUnwindEx

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ReadFile

  GetFullPathNameW

  SetStdHandle

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  GetCommandLineA

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  CompareStringW

  LCMapStringW

  GetCurrentDirectoryW

  FlushFileBuffers

  SetEnvironmentVariableW

  advapi32

  ConvertSidToStringSidW

  GetTokenInformation

  OpenProcessToken

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  Sections

  .text

  Size: 172KB - Virtual size: 172KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 74KB - Virtual size: 74KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 60KB - Virtual size: 59KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• my antivirus.pyc
• Samples - 10-09-2024/105912c9995a1d718c5442349d2cc4bb99426f75ff34554cdfd9a7272eeca398.exe

  .exe windows:5 windows x86 arch:x86

  914685b69f2ac2ff61b6b0f1883a054d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  gdi32

  SetPixel

  GetPixel

  SelectPalette

  SelectObject

  GetTextColor

  BitBlt

  GetDeviceCaps

  CreateSolidBrush

  CreateFontW

  CreateDIBitmap

  user32

  LoadMenuW

  LoadImageW

  CreateDialogParamW

  CreateWindowExW

  DefWindowProcW

  GetDlgItem

  IsDlgButtonChecked

  kernel32

  GetLastError

  GetProcAddress

  GetModuleHandleA

  GetLocaleInfoW

  FreeLibrary

  GetFileAttributesW

  GetCommandLineW

  GetCommandLineA

  Sections

  .text

  Size: 95KB - Virtual size: 95KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 40KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/10eed1464345d7548cbbe6e76ece440f249d9daf5bf13f973f68136d986c7fe5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 695KB - Virtual size: 695KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/11885a82a89f173bfc56ada0cc3dffd97b8b75f267f1a74bf7e4e2c52af88170.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 207KB - Virtual size: 206KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/11c26eb2653365f751e098962ed9b33cc1fc6a768618b3dced03a87d7def0bde.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 295KB - Virtual size: 295KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/123ef10c1c03e2e3c31929cb49c9d70b6dac7d5fbd29de7c25846afe007b2969.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3.8MB - Virtual size: 3.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/13de95a8a6ab504e0060485cc8eaab56531aa1b1a9e567d722774e15ea126640.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 927KB - Virtual size: 927KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1016B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/14534f9ecea0edc1d5fd9a220089cdd04dba9a8cf5b70334c5b15e6ad0a4860c.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 581KB - Virtual size: 581KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/149ea47b6e58c915f4ed35fa9253d966cdb16cc3877ab4de197bfc8c1b1deca6.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 3.2MB - Virtual size: 3.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3.3MB - Virtual size: 3.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 289KB - Virtual size: 451KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 164KB - Virtual size: 163KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/14fc3997df12999343ffb0b798843150b5561ecd178becb72e929458d21f6c5d.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/155e33e24bee428c03b04d04f1b0b106c9192c0067b8f308b3a601d98c222d2e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:8b:08:39:9e:c7:03:62:3c:72:cd:20:77:ad:65:d9

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-08-2023 00:00

  Not After

  07-08-2026 23:59

  Subject

  SERIALNUMBER=HRB 109885,CN=win.rar GmbH,O=win.rar GmbH,L=Berlin,ST=Berlin,C=DE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#130e436861726c6f7474656e62757267,1.3.6.1.4.1.311.60.2.1.2=#13064265726c696e,1.3.6.1.4.1.311.60.2.1.3=#13024445

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  ea:cf:6f:b6:5e:45:a7:8a:2d:b3:29:de:38:31:e1:5a:2e:ad:fe:df:cb:c2:06:64:c1:85:3e:1d:f5:2c:b0:44

  Signer

  Actual PE Digest

  ea:cf:6f:b6:5e:45:a7:8a:2d:b3:29:de:38:31:e1:5a:2e:ad:fe:df:cb:c2:06:64:c1:85:3e:1d:f5:2c:b0:44

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 351KB - Virtual size: 351KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1577ac7107e3034ca42af1f9549c15103c51b019e883c6967247d403a42cd0df.exe

  .exe windows:6 windows x64 arch:x64

  ff1cb75caad3a57b0d550a2df6116f41

  
  

  Code Sign

  56:b6:29:cd:34:bc:78:f6

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  31-05-2017 18:14

  Not After

  30-05-2042 18:14

  Subject

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  56:53:61:d1:9e:29:9f:c4:e2:fa:fe:d7:97:66:78:0d

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  05-09-2024 14:26

  Not After

  05-09-2025 14:26

  Subject

  SERIALNUMBER=08979969,CN=Atgor Investment Ltd,O=Atgor Investment Ltd,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  26-03-2019 17:44

  Not After

  22-03-2034 17:44

  Subject

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

  Certificate

  Issuer

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  19-02-2024 16:18

  Not After

  16-02-2034 16:18

  Subject

  CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

  Certificate

  Issuer

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  13-11-2019 18:50

  Not After

  12-11-2034 18:50

  Subject

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  d8:ff:3c:5e:b6:5e:e6:66:a0:22:9e:87:ec:54:da:ef:bd:2e:73:77:65:f5:98:5d:a1:37:dc:0e:13:d7:87:34

  Signer

  Actual PE Digest

  d8:ff:3c:5e:b6:5e:e6:66:a0:22:9e:87:ec:54:da:ef:bd:2e:73:77:65:f5:98:5d:a1:37:dc:0e:13:d7:87:34

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  Z:\pomoi\x64\Debug\octopus.pdb

  Imports

  kernel32

  LocalFree

  FindFirstStreamW

  WideCharToMultiByte

  GetFileType

  CreateTimerQueue

  SetEndOfFile

  ReadConsoleW

  ReadFile

  GetProcAddress

  GetCurrentProcess

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  SetThreadPriorityBoost

  HeapCompact

  GetVolumePathNameW

  FindClose

  CreateThreadpoolIo

  FlushFileBuffers

  EnumResourceTypesW

  GetACP

  IsValidCodePage

  CreateTapePartition

  SetEventWhenCallbackReturns

  CreateFileW

  FindFirstFileW

  FormatMessageA

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  EncodePointer

  DecodePointer

  GetLocaleInfoEx

  MultiByteToWideChar

  LCMapStringEx

  GetStringTypeW

  CompareStringEx

  GetCPInfo

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  InterlockedPushEntrySList

  InterlockedFlushSList

  GetLastError

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapAlloc

  HeapSize

  HeapValidate

  GetSystemInfo

  GetStdHandle

  WriteFile

  OutputDebugStringW

  WriteConsoleW

  SetConsoleCtrlHandler

  GetCurrentThread

  CloseHandle

  GetConsoleOutputCP

  GetConsoleMode

  GetFileSizeEx

  SetFilePointerEx

  HeapFree

  HeapReAlloc

  HeapQueryInformation

  GetProcessHeap

  GetTempPathW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetTimeZoneInformation

  FindFirstFileExW

  FindNextFileW

  RtlUnwind

  user32

  SendInput

  GetAltTabInfoW

  GetOpenClipboardWindow

  GetWindowLongPtrW

  GetRawInputData

  GetRegisteredRawInputDevices

  CreateDesktopW

  DdeUninitialize

  GetCaretBlinkTime

  GetWindowModuleFileNameW

  gdi32

  DeleteEnhMetaFile

  EqualRgn

  GetGraphicsMode

  CreateFontIndirectExW

  GetTextColor

  AbortPath

  winspool.drv

  GetPrinterDataW

  advapi32

  RegSaveKeyExW

  RegQueryValueExW

  RegReplaceKeyW

  Sections

  .text

  Size: 8.3MB - Virtual size: 8.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 183KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 72KB - Virtual size: 72KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xpdata

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .arch

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp0

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .xtls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .xdata

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .themida

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .srdata

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .vmp2

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .enigma1

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .dsstext

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .enigma2

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .vmp1

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/15798d7a9a0218cad45d1d94ff04eeee89414ef458f545858dc6cf6f90ca8dfd.exe

  .exe windows:5 windows x86 arch:x86

  f4f7f76aa0a06aa9cec19206195b4f24

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  iphlpapi

  GetAdaptersInfo

  GetNumberOfInterfaces

  GetNetworkParams

  kernel32

  AllocConsole

  GetStdHandle

  CloseHandle

  WideCharToMultiByte

  lstrlenW

  GetCurrentProcess

  WriteConsoleA

  GetModuleFileNameA

  GetLastError

  Sleep

  GetTempPathA

  GetEnvironmentVariableA

  FreeConsole

  InitializeCriticalSection

  SetEnvironmentVariableA

  CompareStringW

  CompareStringA

  GetLocaleInfoW

  CreateFileA

  IsValidLocale

  EnumSystemLocalesA

  GetLocaleInfoA

  GetUserDefaultLCID

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  LCMapStringA

  GetTimeZoneInformation

  LoadLibraryA

  WriteConsoleW

  GetConsoleOutputCP

  MultiByteToWideChar

  InitializeCriticalSectionAndSpinCount

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  RaiseException

  HeapFree

  RtlUnwind

  HeapAlloc

  HeapReAlloc

  FindClose

  FileTimeToSystemTime

  FileTimeToLocalFileTime

  GetDriveTypeA

  FindFirstFileA

  SetEndOfFile

  GetProcessHeap

  GetCommandLineA

  GetModuleHandleW

  GetProcAddress

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  InterlockedIncrement

  SetLastError

  GetCurrentThreadId

  InterlockedDecrement

  HeapCreate

  VirtualFree

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  VirtualAlloc

  SetHandleCount

  GetFileType

  GetStartupInfoA

  WriteFile

  GetConsoleCP

  GetConsoleMode

  FlushFileBuffers

  ReadFile

  SetFilePointer

  ExitProcess

  HeapSize

  GetFullPathNameA

  GetCurrentDirectoryA

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  SetStdHandle

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  CreateFileW

  advapi32

  GetTokenInformation

  OpenProcessToken

  LookupAccountSidA

  ws2_32

  inet_ntoa

  WSAStartup

  gethostname

  inet_addr

  getsockname

  closesocket

  recvfrom

  socket

  sendto

  htonl

  htons

  connect

  WSACleanup

  select

  WSAGetLastError

  netapi32

  NetWkstaUserGetInfo

  NetApiBufferFree

  Sections

  .text

  Size: 125KB - Virtual size: 125KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 22KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/159d1a03e0c4ba22defc9aa86a6ef0d96092a76f14a25fd830777dad19b87813.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 10.7MB - Virtual size: 10.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15.7MB - Virtual size: 15.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 305KB - Virtual size: 502KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 709KB - Virtual size: 709KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/165e9bd344f213ca538d13303d0b143f1f36a453743902dfa767f02056f64440.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 226KB - Virtual size: 226KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/17f831f04db600079e8d78d531ecb8e0e403c2ce5a8a757edd12cd0304f7c2c4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\oyzdt32qp8\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 339KB - Virtual size: 338KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/18398652dfd5d3224ef1be53fa6307596826e17c434f99d68a6c5eaa754972e3.exe

  .exe windows:4 windows x86 arch:x86

  6e7f9a29f2c85394521a08b9f31f6275

  
  

  Code Sign

  5a:1f:94:43:57:ad:66:08:d1:2b:42:39:c5:59:98:37:69:c1:f6:19

  Certificate

  Issuer

  CN=Jozefina Anticreationism Ungarerens\ ,O=Lepidosperma,L=Hattersheim,ST=Hessen,C=DE

  Not Before

  12-08-2024 04:48

  Not After

  12-08-2027 04:48

  Subject

  CN=Jozefina Anticreationism Ungarerens\ ,O=Lepidosperma,L=Hattersheim,ST=Hessen,C=DE

  f7:66:8d:e0:ad:92:a6:a1:a8:cd:9a:53:4e:da:b8:26:70:c4:71:7e:98:84:b9:11:a9:d5:c4:3e:61:a8:72:ae

  Signer

  Actual PE Digest

  f7:66:8d:e0:ad:92:a6:a1:a8:cd:9a:53:4e:da:b8:26:70:c4:71:7e:98:84:b9:11:a9:d5:c4:3e:61:a8:72:ae

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  RegCreateKeyExW

  RegEnumKeyW

  RegQueryValueExW

  RegSetValueExW

  RegCloseKey

  RegDeleteValueW

  RegDeleteKeyW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  SetFileSecurityW

  RegOpenKeyExW

  RegEnumValueW

  shell32

  SHGetSpecialFolderLocation

  SHFileOperationW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  ShellExecuteExW

  SHGetFileInfoW

  ole32

  OleInitialize

  OleUninitialize

  CoCreateInstance

  IIDFromString

  CoTaskMemFree

  comctl32

  ord17

  ImageList_Create

  ImageList_Destroy

  ImageList_AddMasked

  user32

  GetClientRect

  EndPaint

  DrawTextW

  IsWindowEnabled

  DispatchMessageW

  wsprintfA

  CharNextA

  CharPrevW

  MessageBoxIndirectW

  GetDlgItemTextW

  SetDlgItemTextW

  GetSystemMetrics

  FillRect

  AppendMenuW

  TrackPopupMenu

  OpenClipboard

  SetClipboardData

  CloseClipboard

  IsWindowVisible

  CallWindowProcW

  GetMessagePos

  CheckDlgButton

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  SetWindowPos

  PeekMessageW

  SetClassLongW

  GetSystemMenu

  EnableMenuItem

  GetWindowRect

  ScreenToClient

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  FindWindowExW

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  EmptyClipboard

  CreatePopupMenu

  gdi32

  SetBkMode

  SetBkColor

  GetDeviceCaps

  CreateFontIndirectW

  CreateBrushIndirect

  DeleteObject

  SetTextColor

  SelectObject

  kernel32

  GetExitCodeProcess

  WaitForSingleObject

  GetModuleHandleA

  GetProcAddress

  GetSystemDirectoryW

  lstrcatW

  Sleep

  lstrcpyA

  WriteFile

  GetTempFileNameW

  CreateFileW

  lstrcmpiA

  RemoveDirectoryW

  CreateProcessW

  CreateDirectoryW

  GetLastError

  CreateThread

  GlobalLock

  GlobalUnlock

  GetDiskFreeSpaceW

  WideCharToMultiByte

  lstrcpynW

  lstrlenW

  SetErrorMode

  GetVersion

  GetCommandLineW

  GetTempPathW

  GetWindowsDirectoryW

  SetEnvironmentVariableW

  ExitProcess

  CopyFileW

  GetCurrentProcess

  GetModuleFileNameW

  GetFileSize

  GetTickCount

  MulDiv

  SetFileAttributesW

  GetFileAttributesW

  SetCurrentDirectoryW

  MoveFileW

  GetFullPathNameW

  GetShortPathNameW

  SearchPathW

  CompareFileTime

  SetFileTime

  CloseHandle

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalFree

  GlobalAlloc

  GetModuleHandleW

  LoadLibraryExW

  MoveFileExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  lstrlenA

  MultiByteToWideChar

  ReadFile

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  Sections

  .text

  Size: 26KB - Virtual size: 25KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 172KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 196KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Autunites194.Reb
• Gnatproof.Dan
• Paraffinet/fishlet.dam
• Paraffinet/fredskonferencernes.txt
• Paraffinet/geofysikerens.ove
• Paraffinet/metrologies.ret
• Samples - 10-09-2024/1901fefcf83a2db8d2e4a717e382df0bdf8db7e7f48615bdc9a26b45f0b7c0ff.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 210KB - Virtual size: 209KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/198cfb15fb19d39c268055e6162ad0c4145f6e4eb39ca0669717e689d2e25e8c.exe

  .exe windows:6 windows x64 arch:x64

  0f535e6ba576db6e12644a3b2a593597

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetFileType

  GetLogicalDrives

  LockFile

  ReadFile

  ReadFileEx

  RemoveDirectoryA

  SetEndOfFile

  SetFilePointer

  UnlockFile

  WriteFileEx

  GetCompressedFileSizeA

  GetTempPathA

  GetVolumeInformationA

  GetTempFileNameA

  GetQueuedCompletionStatus

  PostQueuedCompletionStatus

  ExitProcess

  SwitchToThread

  GetCurrentThread

  SetThreadPriority

  SetThreadPriorityBoost

  GetThreadPriorityBoost

  ExitThread

  ResumeThread

  SetProcessShutdownParameters

  GetPriorityClass

  GetProcessHandleCount

  GetProcessPriorityBoost

  GetThreadIOPendingFlag

  SetThreadIdealProcessor

  SetProcessWorkingSetSize

  QueueUserWorkItem

  IsProcessInJob

  AssignProcessToJobObject

  TerminateJobObject

  SetInformationJobObject

  GetShortPathNameA

  SetProcessAffinityMask

  GetProcessIoCounters

  SwitchToFiber

  ConvertFiberToThread

  ConvertThreadToFiber

  SetFileShortNameA

  SetTapePosition

  WriteTapemark

  lstrcmpiA

  lstrcpynA

  BackupSeek

  GetLogicalDriveStringsA

  DefineDosDeviceA

  QueryDosDeviceA

  CheckNameLegalDOS8Dot3A

  MoveFileWithProgressA

  ReplaceFileA

  ReadDirectoryChangesW

  FindNextVolumeA

  GetFileSizeEx

  FindNextVolumeMountPointA

  FindVolumeMountPointClose

  SetVolumeMountPointA

  GetVolumePathNamesForVolumeNameA

  GetNumaProcessorNode

  GetNumaNodeProcessorMask

  GetTimeFormatA

  GetStringTypeW

  IsValidCodePage

  GetCPInfo

  GetCPInfoExA

  GetCalendarInfoA

  SetCalendarInfoA

  GetNumberFormatA

  GetCurrencyFormatA

  IsValidLanguageGroup

  IsValidLocale

  GetGeoInfoA

  EnumSystemGeoID

  GetUserGeoID

  SetUserGeoID

  ConvertDefaultLocale

  GetSystemDefaultUILanguage

  GetThreadLocale

  GetStringTypeExA

  EnumUILanguagesA

  GetConsoleOutputCP

  SetConsoleMode

  ReadConsoleA

  FillConsoleOutputAttribute

  GenerateConsoleCtrlEvent

  SetConsoleActiveScreenBuffer

  FlushConsoleInputBuffer

  SetConsoleOutputCP

  GetConsoleCursorInfo

  SetConsoleScreenBufferSize

  SetConsoleWindowInfo

  WriteConsoleOutputCharacterA

  WriteConsoleOutputAttribute

  ReadConsoleOutputCharacterA

  WriteConsoleInputA

  WriteConsoleOutputA

  SetConsoleTitleA

  GetNumberOfConsoleMouseButtons

  GetConsoleFontSize

  GetCurrentConsoleFont

  GetConsoleSelectionInfo

  WriteConsoleW

  CloseHandle

  CreateFileW

  SetFilePointerEx

  GetConsoleMode

  FlushFileBuffers

  HeapReAlloc

  HeapSize

  GetFileInformationByHandle

  GetFileAttributesExA

  GetFileAttributesA

  GetDriveTypeA

  GetDiskFreeSpaceExA

  GetDiskFreeSpaceA

  FindCloseChangeNotification

  FindClose

  SearchPathA

  GetCurrentDirectoryA

  GetCommandLineA

  GetEnvironmentStringsW

  GetStdHandle

  FindFirstVolumeMountPointA

  GetModuleHandleA

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  RtlUnwindEx

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  WriteFile

  GetModuleFileNameW

  GetCurrentProcess

  TerminateProcess

  GetModuleHandleExW

  HeapAlloc

  HeapFree

  FindFirstFileExW

  FindNextFileW

  GetACP

  GetOEMCP

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  FreeEnvironmentStringsW

  SetStdHandle

  winspool.drv

  AbortPrinter

  WritePrinter

  ScheduleJob

  FindClosePrinterChangeNotification

  FindNextPrinterChangeNotification

  FindFirstPrinterChangeNotification

  ReadPrinter

  comdlg32

  PageSetupDlgA

  CommDlgExtendedError

  PrintDlgExA

  PrintDlgA

  ChooseFontA

  ReplaceTextA

  FindTextA

  ChooseColorA

  GetFileTitleA

  GetSaveFileNameA

  GetOpenFileNameA

  advapi32

  DecryptFileA

  GetUserNameA

  version

  VerFindFileA

  VerInstallFileA

  GetFileVersionInfoSizeA

  VerQueryValueA

  GetFileVersionInfoA

  gdiplus

  GdiplusStartup

  dxgi

  CreateDXGIFactory

  Sections

  .text

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1a47093f546eb1bb3f2e04053d5332b5711807ad470140378ff0c610593dba66.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1ae0e91e99f6e5a4b7069475776674569baf99d331a940c300913ee7c6649166.exe

  .exe windows:4 windows x86 arch:x86

  246ac99c1627b850614c6662b91ce9ef

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  oleaut32

  SysFreeString

  SysReAllocStringLen

  SysAllocStringLen

  SafeArrayPtrOfIndex

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayCreate

  VariantChangeType

  VariantCopy

  VariantClear

  VariantInit

  advapi32

  RegQueryValueExA

  RegOpenKeyExA

  RegCloseKey

  RegQueryValueExA

  RegOpenKeyExA

  RegFlushKey

  RegCloseKey

  user32

  GetKeyboardType

  DestroyWindow

  LoadStringA

  MessageBoxA

  CharNextA

  CreateWindowExA

  WindowFromPoint

  WaitMessage

  UpdateWindow

  UnregisterClassA

  UnhookWindowsHookEx

  TranslateMessage

  TranslateMDISysAccel

  TrackPopupMenu

  SystemParametersInfoA

  ShowWindow

  ShowScrollBar

  ShowOwnedPopups

  SetWindowsHookExA

  SetWindowPos

  SetWindowPlacement

  SetWindowLongW

  SetWindowLongA

  SetTimer

  SetScrollRange

  SetScrollPos

  SetScrollInfo

  SetRect

  SetPropA

  SetParent

  SetMenuItemInfoA

  SetMenu

  SetForegroundWindow

  SetFocus

  SetCursor

  SetClassLongA

  SetCapture

  SetActiveWindow

  SendMessageW

  SendMessageA

  ScrollWindow

  ScreenToClient

  RemovePropA

  RemoveMenu

  ReleaseDC

  ReleaseCapture

  RegisterWindowMessageA

  RegisterClipboardFormatA

  RegisterClassA

  RedrawWindow

  PtInRect

  PostQuitMessage

  PostMessageA

  PeekMessageW

  PeekMessageA

  OffsetRect

  OemToCharA

  MsgWaitForMultipleObjects

  MessageBoxA

  MapWindowPoints

  MapVirtualKeyA

  LoadStringA

  LoadKeyboardLayoutA

  LoadIconA

  LoadCursorA

  LoadBitmapA

  KillTimer

  IsZoomed

  IsWindowVisible

  IsWindowUnicode

  IsWindowEnabled

  IsWindow

  IsRectEmpty

  IsIconic

  IsDialogMessageW

  IsDialogMessageA

  IsChild

  InvalidateRect

  IntersectRect

  InsertMenuItemA

  InsertMenuA

  InflateRect

  GetWindowThreadProcessId

  GetWindowTextA

  GetWindowRect

  GetWindowPlacement

  GetWindowLongW

  GetWindowLongA

  GetWindowDC

  GetTopWindow

  GetSystemMetrics

  GetSystemMenu

  GetSysColorBrush

  GetSysColor

  GetSubMenu

  GetScrollRange

  GetScrollPos

  GetScrollInfo

  GetPropA

  GetParent

  GetWindow

  GetMessagePos

  GetMenuStringA

  GetMenuState

  GetMenuItemInfoA

  GetMenuItemID

  GetMenuItemCount

  GetMenu

  GetLastActivePopup

  GetKeyboardState

  GetKeyboardLayoutNameA

  GetKeyboardLayoutList

  GetKeyboardLayout

  GetKeyState

  GetKeyNameTextA

  GetIconInfo

  GetForegroundWindow

  GetFocus

  GetDesktopWindow

  GetDCEx

  GetDC

  GetCursorPos

  GetCursor

  GetClientRect

  GetClassLongA

  GetClassInfoA

  GetCapture

  GetActiveWindow

  FrameRect

  FindWindowA

  FillRect

  EqualRect

  EnumWindows

  EnumThreadWindows

  EnumChildWindows

  EndPaint

  EnableWindow

  EnableScrollBar

  EnableMenuItem

  DrawTextA

  DrawMenuBar

  DrawIconEx

  DrawIcon

  DrawFrameControl

  DrawEdge

  DispatchMessageW

  DispatchMessageA

  DestroyWindow

  DestroyMenu

  DestroyIcon

  DestroyCursor

  DeleteMenu

  DefWindowProcA

  DefMDIChildProcA

  DefFrameProcA

  CreatePopupMenu

  CreateMenu

  CreateIcon

  ClientToScreen

  CheckMenuItem

  CallWindowProcA

  CallNextHookEx

  BeginPaint

  CharNextA

  CharLowerA

  CharToOemA

  AdjustWindowRectEx

  ActivateKeyboardLayout

  kernel32

  GetACP

  Sleep

  VirtualFree

  VirtualAlloc

  GetCurrentThreadId

  InterlockedDecrement

  InterlockedIncrement

  VirtualQuery

  WideCharToMultiByte

  MultiByteToWideChar

  lstrlenA

  lstrcpynA

  LoadLibraryExA

  GetThreadLocale

  GetStartupInfoA

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameA

  GetLocaleInfoA

  GetCommandLineA

  FreeLibrary

  FindFirstFileA

  FindClose

  ExitProcess

  ExitThread

  CreateThread

  CompareStringA

  WriteFile

  UnhandledExceptionFilter

  RtlUnwind

  RaiseException

  GetStdHandle

  TlsSetValue

  TlsGetValue

  LocalAlloc

  GetModuleHandleA

  lstrcpyA

  WriteFile

  WaitForSingleObject

  VirtualQuery

  VirtualAlloc

  Sleep

  SizeofResource

  SetThreadLocale

  SetFilePointer

  SetEvent

  SetErrorMode

  SetEndOfFile

  ResumeThread

  ResetEvent

  ReadFile

  QueryPerformanceFrequency

  QueryPerformanceCounter

  MulDiv

  LockResource

  LoadResource

  LoadLibraryA

  LeaveCriticalSection

  InitializeCriticalSection

  GlobalFindAtomA

  GlobalDeleteAtom

  GlobalAddAtomA

  GetVersionExA

  GetVersion

  GetTickCount

  GetThreadLocale

  GetTempPathA

  GetStdHandle

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameA

  GetLocaleInfoA

  GetLocalTime

  GetLastError

  GetFullPathNameA

  GetFileSize

  GetFileAttributesA

  GetExitCodeThread

  GetDiskFreeSpaceA

  GetDateFormatA

  GetCurrentThreadId

  GetCurrentProcessId

  GetCPInfo

  FreeResource

  InterlockedIncrement

  InterlockedExchange

  InterlockedDecrement

  FreeLibrary

  FormatMessageA

  FindResourceA

  FindFirstFileA

  FindClose

  EnumCalendarInfoA

  EnterCriticalSection

  DeleteCriticalSection

  CreateThread

  CreateFileA

  CreateEventA

  CompareStringA

  CloseHandle

  Sleep

  gdi32

  UnrealizeObject

  StretchBlt

  SetWindowOrgEx

  SetViewportOrgEx

  SetTextColor

  SetStretchBltMode

  SetROP2

  SetPixel

  SetDIBColorTable

  SetBrushOrgEx

  SetBkMode

  SetBkColor

  SelectPalette

  SelectObject

  SaveDC

  RestoreDC

  RectVisible

  RealizePalette

  PatBlt

  MoveToEx

  MaskBlt

  LineTo

  IntersectClipRect

  GetWindowOrgEx

  GetTextMetricsA

  GetTextExtentPoint32A

  GetSystemPaletteEntries

  GetStockObject

  GetRgnBox

  GetPixel

  GetPaletteEntries

  GetObjectA

  GetDeviceCaps

  GetDIBits

  GetDIBColorTable

  GetDCOrgEx

  GetCurrentPositionEx

  GetClipBox

  GetBrushOrgEx

  GetBitmapBits

  ExcludeClipRect

  DeleteObject

  DeleteDC

  CreateSolidBrush

  CreatePenIndirect

  CreatePalette

  CreateHalftonePalette

  CreateFontIndirectA

  CreateDIBitmap

  CreateDIBSection

  CreateCompatibleDC

  CreateCompatibleBitmap

  CreateBrushIndirect

  CreateBitmap

  BitBlt

  version

  VerQueryValueA

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  comctl32

  _TrackMouseEvent

  ImageList_SetIconSize

  ImageList_GetIconSize

  ImageList_Write

  ImageList_Read

  ImageList_DragShowNolock

  ImageList_DragMove

  ImageList_DragLeave

  ImageList_DragEnter

  ImageList_EndDrag

  ImageList_BeginDrag

  ImageList_Remove

  ImageList_DrawEx

  ImageList_Draw

  ImageList_GetBkColor

  ImageList_SetBkColor

  ImageList_Add

  ImageList_SetImageCount

  ImageList_GetImageCount

  ImageList_Destroy

  ImageList_Create

  Sections

  .text

  Size: 483KB - Virtual size: 482KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 27KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 56B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 19.6MB - Virtual size: 19.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1b10bef23627d776d4038e05f01e77b49e527a45b798824515b20e30f6d8c5a0.exe

  .exe windows:5 windows x86 arch:x86

  270ef27c034d928c4437a4fdbd9809c4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  setsockopt

  ntohs

  recvfrom

  sendto

  htons

  select

  listen

  WSAStartup

  bind

  closesocket

  connect

  socket

  send

  WSACleanup

  ioctlsocket

  accept

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  recv

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_ReplaceIcon

  ImageList_Create

  InitCommonControlsEx

  ImageList_Destroy

  mpr

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  WNetUseConnectionW

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetConnectW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetQueryOptionW

  InternetQueryDataAvailable

  psapi

  EnumProcesses

  GetModuleBaseNameW

  GetProcessMemoryInfo

  EnumProcessModules

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  UnloadUserProfile

  LoadUserProfileW

  kernel32

  HeapAlloc

  Sleep

  GetCurrentThreadId

  RaiseException

  MulDiv

  GetVersionExW

  GetSystemInfo

  MultiByteToWideChar

  WideCharToMultiByte

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  FindNextFileW

  lstrcmpiW

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetProcessHeap

  OutputDebugStringW

  GetLocalTime

  CompareStringW

  CompareStringA

  InterlockedIncrement

  InterlockedDecrement

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  GetTempPathW

  GetTempFileNameW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  SetErrorMode

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  DeviceIoControl

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetComputerNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  GetCurrentProcessId

  GetCurrentThread

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  LoadLibraryExW

  HeapFree

  WaitForSingleObject

  CreateThread

  DuplicateHandle

  GetLastError

  CloseHandle

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  FreeLibrary

  GetModuleFileNameW

  GetFullPathNameW

  ExitProcess

  ExitThread

  GetSystemTimeAsFileTime

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  ResumeThread

  GetStartupInfoW

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  SetLastError

  HeapSize

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetModuleFileNameA

  HeapReAlloc

  HeapCreate

  SetHandleCount

  GetFileType

  GetStartupInfoA

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  LCMapStringW

  LCMapStringA

  RtlUnwind

  SetFilePointer

  GetTimeZoneInformation

  GetTimeFormatA

  GetDateFormatA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetTickCount

  GetStringTypeA

  GetStringTypeW

  GetLocaleInfoA

  GetModuleHandleA

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CreateFileA

  SetEndOfFile

  EnumResourceNamesW

  SetEnvironmentVariableA

  user32

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  ReleaseCapture

  SetCapture

  WindowFromPoint

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  CopyImage

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  PeekMessageW

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  keybd_event

  VkKeyScanA

  GetKeyboardLayoutNameA

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  GetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  GetMenuItemID

  TranslateMessage

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromRect

  GetAsyncKeyState

  LoadImageW

  GetWindowLongW

  gdi32

  DeleteObject

  GetObjectW

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  Rectangle

  GetDeviceCaps

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  SetViewportOrgEx

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegConnectRegistryW

  RegEnumKeyExW

  CloseServiceHandle

  UnlockServiceDatabase

  LockServiceDatabase

  OpenSCManagerW

  InitiateSystemShutdownExW

  AdjustTokenPrivileges

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyExW

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  InitializeSecurityDescriptor

  InitializeAcl

  GetLengthSid

  SetSecurityDescriptorDacl

  CopySid

  LogonUserW

  GetTokenInformation

  GetAclInformation

  GetAce

  AddAce

  GetSecurityDescriptorDacl

  shell32

  DragQueryPoint

  ShellExecuteExW

  SHGetFolderPathW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoInitialize

  CoUninitialize

  CoCreateInstance

  CreateStreamOnHGlobal

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  StringFromCLSID

  IIDFromString

  StringFromIID

  OleInitialize

  CreateBindCtx

  CLSIDFromProgID

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  OleUninitialize

  oleaut32

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SysAllocString

  OleLoadPicture

  SafeArrayGetVartype

  SafeArrayDestroyData

  SafeArrayAccessData

  VarR8FromDec

  VariantTimeToSystemTime

  VariantClear

  VariantCopy

  VariantInit

  SafeArrayDestroyDescriptor

  LoadRegTypeLi

  GetActiveObject

  SafeArrayUnaccessData

  Sections

  .text

  Size: 517KB - Virtual size: 517KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 54KB - Virtual size: 53KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 12KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 248KB - Virtual size: 247KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1bbb78f16e62b424cc5bfe0ec68692944cfe2b781be54b6df1b227c4aaddac73.exe

  .exe windows:10 windows x86 arch:x86

  9e41f63b8143bebfb96200b6d2b13400

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  imecfmui.pdb

  Imports

  advapi32

  EventWrite

  EventRegister

  EventUnregister

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegCloseKey

  RegOpenCurrentUser

  OpenProcessToken

  GetTokenInformation

  IsValidSid

  ConvertSidToStringSidW

  GetSidSubAuthority

  GetSidSubAuthorityCount

  RegOpenKeyExW

  kernel32

  DeleteFileW

  CloseHandle

  GetProcAddress

  CreateFileW

  GetTickCount

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleHandleA

  TerminateProcess

  GetCurrentProcess

  GetTempPathW

  UnhandledExceptionFilter

  GetStartupInfoW

  Sleep

  GetModuleFileNameA

  ExpandEnvironmentStringsW

  FreeLibrary

  GetLastError

  LocalFree

  GetVersionExW

  FindResourceExW

  LoadResource

  FindFirstFileW

  FindNextFileW

  FindClose

  LoadLibraryExW

  GetModuleHandleExW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  CompareStringW

  LockResource

  WriteFile

  gdi32

  GetDeviceCaps

  CreateFontIndirectW

  GetStockObject

  SelectObject

  GetTextExtentPoint32W

  GetObjectW

  user32

  DestroyWindow

  GetWindowLongW

  SetWindowLongW

  SendDlgItemMessageW

  GetDlgItem

  EnableWindow

  MessageBoxW

  SetDlgItemTextW

  PostMessageW

  GetDlgItemTextW

  SendMessageW

  LoadImageW

  GetWindowThreadProcessId

  GetSystemMetrics

  GetDC

  ReleaseDC

  GetKeyState

  InvalidateRect

  EndDialog

  GetCursor

  SetCursor

  LoadCursorW

  MapDialogRect

  GetClassInfoExW

  RegisterClassExW

  UnregisterClassW

  CreateWindowExW

  DefWindowProcW

  GetMessageW

  IsDialogMessageW

  TranslateMessage

  DispatchMessageW

  PostQuitMessage

  GetCursorPos

  SetForegroundWindow

  TrackPopupMenuEx

  GetSubMenu

  SetWindowTextW

  RegisterWindowMessageW

  SetProcessDPIAware

  UpdateWindow

  AllowSetForegroundWindow

  LoadMenuIndirectW

  DialogBoxIndirectParamW

  CreateDialogIndirectParamW

  DrawEdge

  DrawStateW

  GetWindowTextW

  SetWindowPos

  MapWindowPoints

  GetWindowRect

  GetClientRect

  EnumWindows

  GetClassNameW

  GetLastActivePopup

  DestroyIcon

  ShowWindow

  DestroyMenu

  msvcrt

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  _unlock

  _lock

  _wcmdln

  _initterm

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  _callnewh

  malloc

  ?what@exception@@UBEPBDXZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  memcpy

  __CxxFrameHandler3

  _CxxThrowException

  wcschr

  _wcstoi64

  _wtoi

  wcsncpy_s

  _vsnwprintf_s

  _purecall

  wcsncat_s

  ??_V@YAXPAX@Z

  wcsnlen

  memmove

  ??3@YAXPAX@Z

  ??1exception@@UAE@XZ

  memset

  ole32

  CoInitialize

  CoCreateInstance

  shell32

  ShellExecuteW

  SHGetFolderPathW

  Shell_NotifyIconW

  oleaut32

  SysAllocString

  VariantClear

  SysFreeString

  wer

  WerReportCloseHandle

  WerReportAddFile

  WerReportSubmit

  WerReportSetParameter

  WerReportCreate

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1bf2a9ea09f8638ac50155e3bdb1bfdddeb5d3496d8f44fe2be0b3c57ae16941.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 651KB - Virtual size: 651KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1c022ec2400c0c5197aa32cef3182a09a13213dedfe1db71fc18c6d399571ed9.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  BKze.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 896KB - Virtual size: 895KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1d60db87501f760576e6b8b9f0213a25d37025fddc020be1f63790e29b7cffb2.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 229KB - Virtual size: 228KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1d62cd54e9672027a8c8939dabdb3d250ec3e75c748bfef7fcaa1d40fe44d9d9.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 108KB - Virtual size: 108KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1d95a1b070d3a22eeb4ddbc8a955e66fea8b8cbe746806b898e01de744b4b2f3.exe

  .exe windows:6 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 256KB - Virtual size: 256KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 59KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1de1d42113064dace922eed0089dd22a9c83f1d03040f9b1e787145603ab02b2.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  5f:ca:43:4f:8d:73:85:06:cc:3f:72:88:b1:58:e7:64:8b:c7:6e:8e:27:70:de:5c:08:8d:97:a0:37:26:58:98

  Signer

  Actual PE Digest

  5f:ca:43:4f:8d:73:85:06:cc:3f:72:88:b1:58:e7:64:8b:c7:6e:8e:27:70:de:5c:08:8d:97:a0:37:26:58:98

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\jma24e4e80ace\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1df5b2a41831081a752bfd626acb7e216d0c03b0e1b1a7c829a7348a54833c58.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1e23d2884e28c14119f3d849b0a6451516ec27bcc1c4247a3e9d15b2d6500065.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 701KB - Virtual size: 700KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1ed64b6b227819cf85ae9a739b566ee9120014675ef414876e56d68ce9c18b0b.exe

  .exe windows:6 windows x64 arch:x64

  de41d4e0545d977de6ca665131bb479a

  
  

  Code Sign

  33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  19-10-2023 19:51

  Not After

  16-10-2024 19:51

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  1e:70:d1:13:eb:3c:20:5f:a7:01:3c:31:31:0e:d1:ad:c0:f5:c7:75:65:f3:73:30:c2:32:a0:0a:00:82:3c:9a

  Signer

  Actual PE Digest

  1e:70:d1:13:eb:3c:20:5f:a7:01:3c:31:31:0e:d1:ad:c0:f5:c7:75:65:f3:73:30:c2:32:a0:0a:00:82:3c:9a

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __set_app_type

  __setusermatherr

  _amsg_exit

  _cexit

  _commode

  _fmode

  _initterm

  _onexit

  _wcsicmp

  _wcsnicmp

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcpy

  memset

  signal

  strlen

  strncmp

  vfprintf

  wcscat

  wcscpy

  wcslen

  wcsncmp

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  InitializeCriticalSection

  LeaveCriticalSection

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  Sections

  .text

  Size: 31KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 384B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 56KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 120B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1f309ccc149dfaea667ed3cb212c28aa8ea138393bb08bad9813f0428cb5f55d.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 337KB - Virtual size: 336KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/1f5cd6cf08ddde0cddf40106ef14f4f3f9328d4912e29d1827ac634355b7a0ab.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 776B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/21801a39d801c5df803e2fd2af939ad0be166dab55432a0e173a906de728b046.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 83KB - Virtual size: 82KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/222f76224b428d25c8a16437f9d05309ea160816439f25dd5e5003b07ef294a6.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 166KB - Virtual size: 166KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/22d9cdd9c9201e1592a2e081069e2c1c1e9563450125c3076c9b3bca2328120f.exe

  .exe windows:4 windows x86 arch:x86

  9b827673b71dda8dc951da9c5741c483

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvfw32

  DrawDibDraw

  avifil32

  AVIStreamGetFrame

  AVIStreamInfoA

  iphlpapi

  GetAdaptersInfo

  winmm

  waveOutRestart

  midiStreamRestart

  midiStreamClose

  midiOutReset

  midiStreamStop

  PlaySoundA

  waveOutUnprepareHeader

  waveOutPrepareHeader

  waveOutWrite

  waveOutPause

  waveOutReset

  waveOutClose

  midiStreamOut

  midiOutPrepareHeader

  midiStreamProperty

  midiStreamOpen

  midiOutUnprepareHeader

  waveOutOpen

  waveOutGetNumDevs

  ws2_32

  inet_addr

  inet_ntoa

  gethostbyname

  WSAStartup

  WSACleanup

  select

  send

  closesocket

  htons

  socket

  setsockopt

  recvfrom

  ioctlsocket

  WSAAsyncSelect

  connect

  recv

  getpeername

  ntohl

  WSAGetLastError

  ntohs

  getservbyname

  shutdown

  accept

  rasapi32

  RasGetConnectStatusA

  RasHangUpA

  kernel32

  GetTimeZoneInformation

  GetLocaleInfoA

  GetVersion

  TerminateThread

  CreateMutexA

  ReleaseMutex

  SuspendThread

  InterlockedIncrement

  InterlockedDecrement

  MapViewOfFile

  UnmapViewOfFile

  GetSystemInfo

  IsProcessorFeaturePresent

  lstrcmpiA

  SetNamedPipeHandleState

  WaitNamedPipeA

  OpenFileMappingA

  OpenEventA

  TlsAlloc

  TlsFree

  TlsSetValue

  TlsGetValue

  LocalFree

  FileTimeToLocalFileTime

  lstrcpynA

  DuplicateHandle

  FlushFileBuffers

  LockFile

  UnlockFile

  SetEndOfFile

  GlobalDeleteAtom

  GlobalFindAtomA

  GlobalAddAtomA

  GlobalGetAtomNameA

  lstrcmpA

  LocalAlloc

  GlobalHandle

  LocalReAlloc

  GetFileTime

  GetCurrentThread

  GlobalFlags

  SetErrorMode

  GetProcessVersion

  GetCPInfo

  GetOEMCP

  GetStartupInfoA

  RtlUnwind

  GetSystemTime

  GetLocalTime

  RaiseException

  HeapSize

  GetACP

  SetStdHandle

  GetFileType

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  SetHandleCount

  GetStdHandle

  GetEnvironmentVariableA

  HeapDestroy

  HeapCreate

  VirtualFree

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  LCMapStringA

  LCMapStringW

  VirtualAlloc

  IsBadWritePtr

  SetUnhandledExceptionFilter

  GetStringTypeA

  GetStringTypeW

  IsValidLocale

  IsValidCodePage

  EnumSystemLocalesA

  CompareStringA

  CompareStringW

  IsBadReadPtr

  IsBadCodePtr

  GetLocaleInfoW

  SetLastError

  TerminateProcess

  GetFileSize

  SetFilePointer

  GetCurrentProcess

  GetWindowsDirectoryA

  GetSystemDirectoryA

  CreateSemaphoreA

  ResumeThread

  ReleaseSemaphore

  EnterCriticalSection

  LeaveCriticalSection

  GetProfileStringA

  WriteFile

  WaitForMultipleObjects

  CreateFileA

  SetEvent

  FindResourceA

  LoadResource

  LockResource

  ReadFile

  GetModuleFileNameA

  WideCharToMultiByte

  MultiByteToWideChar

  GetCurrentThreadId

  ExitProcess

  GlobalSize

  GlobalFree

  DeleteCriticalSection

  InitializeCriticalSection

  lstrcatA

  lstrlenA

  WinExec

  lstrcpyA

  FindNextFileA

  GetDriveTypeA

  GlobalReAlloc

  HeapFree

  HeapReAlloc

  GetProcessHeap

  HeapAlloc

  GetUserDefaultLCID

  GetFullPathNameA

  FreeLibrary

  LoadLibraryA

  GetLastError

  GetVersionExA

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  CreateThread

  CreateEventA

  Sleep

  ExpandEnvironmentStringsA

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  FindFirstFileA

  FindClose

  GetFileAttributesA

  DeleteFileA

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetVolumeInformationA

  GetModuleHandleA

  GetProcAddress

  MulDiv

  GetCommandLineA

  GetTickCount

  CreateProcessA

  WaitForSingleObject

  CloseHandle

  InterlockedExchange

  FileTimeToSystemTime

  user32

  GetSysColorBrush

  GetMenuCheckMarkDimensions

  SetMenuItemBitmaps

  CheckMenuItem

  IsDialogMessageA

  ScrollWindowEx

  SendDlgItemMessageA

  MapWindowPoints

  AdjustWindowRectEx

  GetScrollPos

  RegisterClassA

  GetClassLongA

  RemovePropA

  GetMessageTime

  GetLastActivePopup

  RegisterWindowMessageA

  GetWindowPlacement

  EndDialog

  CreateDialogIndirectParamA

  DestroyWindow

  EndPaint

  BeginPaint

  CharUpperA

  GetWindowTextLengthA

  GetDlgItem

  GetClassNameA

  GetDesktopWindow

  UnregisterHotKey

  RegisterHotKey

  CreateWindowExA

  GetWindowTextA

  SetWindowTextA

  GetMenuItemCount

  GetMenuItemID

  GetMenuStringA

  GetMenuState

  GetTabbedTextExtentA

  GrayStringA

  TabbedTextOutA

  WindowFromDC

  EnumChildWindows

  GetWindowDC

  UnhookWindowsHookEx

  CallNextHookEx

  SetWindowsHookExA

  GetPropA

  MoveWindow

  CallWindowProcA

  SetPropA

  DrawTextA

  GetCursor

  DrawStateA

  FrameRect

  GetNextDlgTabItem

  GetForegroundWindow

  LoadIconA

  TranslateMessage

  DrawFrameControl

  DrawEdge

  DrawFocusRect

  WindowFromPoint

  GetMessageA

  DispatchMessageA

  SetRectEmpty

  CreateIconFromResourceEx

  CreateIconFromResource

  DrawIconEx

  CreatePopupMenu

  AppendMenuA

  ModifyMenuA

  CreateMenu

  CreateAcceleratorTableA

  GetDlgCtrlID

  GetSubMenu

  EnableMenuItem

  ClientToScreen

  EnumDisplaySettingsA

  LoadImageA

  SystemParametersInfoA

  ShowWindow

  IsWindowEnabled

  TranslateAcceleratorA

  GetKeyState

  CopyAcceleratorTableA

  PostQuitMessage

  IsZoomed

  GetClassInfoA

  DefWindowProcA

  GetSystemMenu

  DeleteMenu

  GetMenu

  SetMenu

  PeekMessageA

  IsIconic

  SetFocus

  GetActiveWindow

  GetWindow

  DestroyAcceleratorTable

  SetWindowRgn

  GetMessagePos

  ScreenToClient

  ChildWindowFromPointEx

  CopyRect

  LoadBitmapA

  WinHelpA

  KillTimer

  SetTimer

  ReleaseCapture

  GetCapture

  SetCapture

  GetScrollRange

  SetScrollRange

  SetScrollPos

  SetRect

  InflateRect

  IntersectRect

  DestroyIcon

  PtInRect

  OffsetRect

  EnableWindow

  RedrawWindow

  GetWindowLongA

  SetWindowLongA

  GetSysColor

  SetActiveWindow

  SetCursorPos

  LoadCursorA

  SetCursor

  GetDC

  FillRect

  IsRectEmpty

  ReleaseDC

  IsChild

  TrackPopupMenu

  DestroyMenu

  SetForegroundWindow

  GetWindowRect

  EqualRect

  UpdateWindow

  ValidateRect

  InvalidateRect

  GetClientRect

  GetFocus

  GetParent

  GetTopWindow

  PostMessageA

  IsWindow

  SetParent

  DestroyCursor

  SendMessageA

  SetWindowPos

  MessageBoxA

  GetCursorPos

  GetSystemMetrics

  EmptyClipboard

  SetClipboardData

  OpenClipboard

  GetClipboardData

  CloseClipboard

  wsprintfA

  WaitForInputIdle

  LoadStringA

  RegisterClipboardFormatA

  IsWindowVisible

  UnregisterClassA

  gdi32

  FillRgn

  CreateRectRgn

  CombineRgn

  PatBlt

  CreatePen

  SelectObject

  CreatePatternBrush

  CreateBitmap

  CreateBrushIndirect

  CreateDCA

  CreateCompatibleBitmap

  GetPolyFillMode

  GetStretchBltMode

  GetROP2

  GetBkColor

  GetBkMode

  GetTextColor

  CreateRoundRectRgn

  CreateEllipticRgn

  PathToRegion

  EndPath

  BeginPath

  GetWindowOrgEx

  GetViewportOrgEx

  GetWindowExtEx

  ExtTextOutA

  Escape

  TranslateCharsetInfo

  CreateSolidBrush

  SetPolyFillMode

  SetROP2

  SetMapMode

  SetViewportOrgEx

  OffsetViewportOrgEx

  SetViewportExtEx

  ScaleViewportExtEx

  SetWindowExtEx

  ScaleWindowExtEx

  GetClipBox

  ExcludeClipRect

  CreateFontIndirectA

  MoveToEx

  LineTo

  ExtSelectClipRgn

  GetViewportExtEx

  GetTextMetricsA

  CreateFontA

  SetDIBitsToDevice

  SetTextColor

  SetBkMode

  TextOutA

  SetBkColor

  CreateRectRgnIndirect

  CreateDIBSection

  SetPixel

  SetStretchBltMode

  GetClipRgn

  CreatePolygonRgn

  SelectClipRgn

  DeleteObject

  CreateDIBitmap

  GetSystemPaletteEntries

  CreatePalette

  StretchBlt

  SelectPalette

  RealizePalette

  GetDIBits

  RectVisible

  PtVisible

  CreatePenIndirect

  RestoreDC

  Ellipse

  Rectangle

  LPtoDP

  DPtoLP

  GetCurrentObject

  RoundRect

  SaveDC

  SetWindowOrgEx

  GetStockObject

  GetObjectA

  EndPage

  EndDoc

  DeleteDC

  StartDocA

  StartPage

  BitBlt

  GetPixel

  CreateCompatibleDC

  GetTextExtentPoint32A

  SetPixelV

  GetDeviceCaps

  msimg32

  GradientFill

  winspool.drv

  OpenPrinterA

  DocumentPropertiesA

  ClosePrinter

  comdlg32

  ChooseColorA

  GetOpenFileNameA

  GetSaveFileNameA

  GetFileTitleA

  advapi32

  RegCreateKeyExA

  RegOpenKeyA

  RegQueryValueA

  RegSetValueExA

  RegOpenKeyExA

  RegQueryValueExA

  RegCloseKey

  RegEnumValueA

  shell32

  SHGetFileInfoA

  DragAcceptFiles

  DragFinish

  ShellExecuteA

  Shell_NotifyIconA

  DragQueryFileA

  ole32

  ReleaseStgMedium

  RevokeDragDrop

  RegisterDragDrop

  OleUninitialize

  CLSIDFromString

  CoCreateInstance

  OleInitialize

  oleaut32

  RegisterTypeLi

  LoadTypeLi

  UnRegisterTypeLi

  comctl32

  ImageList_DragLeave

  ImageList_DragEnter

  ImageList_Destroy

  ImageList_Create

  ImageList_BeginDrag

  ImageList_Add

  ImageList_DragMove

  ImageList_Draw

  _TrackMouseEvent

  ImageList_SetBkColor

  ImageList_GetImageCount

  ImageList_GetImageInfo

  ImageList_GetIcon

  ImageList_DragShowNolock

  ImageList_EndDrag

  ord17

  ImageList_Read

  ImageList_DrawIndirect

  ImageList_AddMasked

  ImageList_Duplicate

  wldap32

  ord29

  wininet

  InternetSetOptionA

  InternetCrackUrlA

  HttpOpenRequestA

  HttpSendRequestA

  HttpQueryInfoA

  InternetReadFile

  InternetOpenA

  InternetCloseHandle

  InternetConnectA

  InternetCanonicalizeUrlA

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1008KB - Virtual size: 1006KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 864KB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 36KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2333dd858fc40899a1bff3fb39fbc0b4e65a864bfd4eb73c26b48aaddcca7061.exe

  .dll windows:6 windows x64 arch:x64

  e78141e724292ad3a360b1a7baf7cfab

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  C:\dvs\p4\build\sw\rel\gpu_drv\r560\r560_78\drivers\ui\uxd\bin\x64\Release\NvXDSyncPlugin.pdb

  Imports

  rpcrt4

  IUnknown_QueryInterface_Proxy

  IUnknown_AddRef_Proxy

  IUnknown_Release_Proxy

  NdrOleAllocate

  NdrOleFree

  CStdStubBuffer_QueryInterface

  CStdStubBuffer_AddRef

  CStdStubBuffer_Connect

  CStdStubBuffer_Disconnect

  CStdStubBuffer_Invoke

  CStdStubBuffer_IsIIDSupported

  CStdStubBuffer_CountRefs

  CStdStubBuffer_DebugServerQueryInterface

  CStdStubBuffer_DebugServerRelease

  NdrCStdStubBuffer_Release

  shlwapi

  PathFindFileNameW

  kernel32

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  GetTimeZoneInformation

  GetFileType

  GetStdHandle

  GetCurrentThread

  FreeLibraryAndExitThread

  ExitThread

  GetModuleHandleExW

  ExitProcess

  VirtualAlloc

  RtlUnwindEx

  InterlockedFlushSList

  InterlockedPushEntrySList

  RtlPcToFileHeader

  AreFileApisANSI

  MoveFileExW

  VerSetConditionMask

  CreateFileW

  GetFileAttributesW

  GetFullPathNameW

  CloseHandle

  GetLastError

  SetLastError

  GetSystemDirectoryW

  FreeLibrary

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleW

  GetProcAddress

  LoadLibraryExW

  LocalAlloc

  LocalFree

  VerifyVersionInfoW

  ExpandEnvironmentStringsW

  GetFileSizeEx

  WriteFile

  OutputDebugStringW

  EncodePointer

  DecodePointer

  RaiseException

  QueryPerformanceCounter

  QueryPerformanceFrequency

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  FindFirstFileExW

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  SetEvent

  ResetEvent

  ReleaseMutex

  WaitForSingleObject

  WaitForSingleObjectEx

  CreateMutexW

  CreateEventA

  CreateEventW

  OpenEventW

  Sleep

  WaitForMultipleObjects

  GetProcessTimes

  GetCurrentProcess

  GetCurrentProcessId

  CreateThread

  GetCurrentThreadId

  ProcessIdToSessionId

  GetSystemTimeAsFileTime

  LoadResource

  SizeofResource

  FindResourceW

  lstrcmpiW

  SetDllDirectoryW

  MultiByteToWideChar

  WideCharToMultiByte

  DuplicateHandle

  ReleaseSemaphore

  WaitForMultipleObjectsEx

  CreateSemaphoreA

  WTSGetActiveConsoleSessionId

  GetVersionExW

  TerminateProcess

  GetLocaleInfoW

  IsValidCodePage

  GetACP

  GetCommandLineA

  GetOEMCP

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  ReadFile

  SetStdHandle

  ReadConsoleW

  WriteConsoleW

  SignalObjectAndWait

  SwitchToThread

  SetThreadPriority

  GetThreadPriority

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  GetNumaHighestNodeNumber

  GetProcessAffinityMask

  SetThreadAffinityMask

  RegisterWaitForSingleObject

  UnregisterWait

  GetThreadTimes

  VirtualFree

  InterlockedPopEntrySList

  QueryDepthSList

  UnregisterWaitEx

  CreateTimerQueue

  LoadLibraryW

  GetProcessHeap

  DeviceIoControl

  SetFilePointerEx

  RemoveDirectoryW

  FindNextFileW

  FindClose

  DeleteFileW

  CreateDirectoryW

  FormatMessageA

  SystemTimeToFileTime

  CreateWaitableTimerA

  GetModuleHandleA

  GetLogicalProcessorInformation

  ResumeThread

  SetWaitableTimer

  OpenEventA

  GetCPInfo

  LCMapStringW

  CompareStringW

  GetTickCount

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  TryEnterCriticalSection

  GetStringTypeW

  GetStartupInfoW

  IsDebuggerPresent

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeSListHead

  advapi32

  RegEnumValueW

  RegQueryValueExW

  TraceMessage

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  UnregisterTraceGuids

  RegisterTraceGuidsW

  RegSetValueExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegCloseKey

  ole32

  CoResumeClassObjects

  CoAddRefServerProcess

  CoReleaseServerProcess

  CoInitializeSecurity

  CoCreateInstance

  StringFromGUID2

  CoTaskMemAlloc

  CoRevokeClassObject

  CoTaskMemFree

  CoCreateInstanceEx

  CoRegisterClassObject

  CoTaskMemRealloc

  CoSuspendClassObjects

  CoInitializeEx

  oleaut32

  SysFreeString

  SysStringLen

  VarUI4FromStr

  LoadTypeLi

  SysAllocString

  UnRegisterTypeLi

  RegisterTypeLi

  Exports

  Exports

  NvPluginGetInfo

  Sections

  .text

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .orpc

  Size: 512B - Virtual size: 255B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 437KB - Virtual size: 436KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 52KB - Virtual size: 83KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 32B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 125KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/246922b00b01800adedac053d0dd147ec65f3438f1620b2bb6a41f28cc21d149.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

  Certificate

  Issuer

  CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

  Not Before

  16-04-2020 18:36

  Not After

  16-04-2045 18:44

  Subject

  CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:d0:01:fa:44:27:80:35:38:a4:52:00:00:00:00:d0:01

  Certificate

  Issuer

  CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

  Not Before

  05-03-2024 04:25

  Not After

  08-03-2024 04:25

  Subject

  CN=DOTPDN LLC,O=DOTPDN LLC,L=Kirkland,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  33:00:00:d0:01:fa:44:27:80:35:38:a4:52:00:00:00:00:d0:01

  Certificate

  Issuer

  CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

  Not Before

  05-03-2024 04:25

  Not After

  08-03-2024 04:25

  Subject

  CN=DOTPDN LLC,O=DOTPDN LLC,L=Kirkland,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  33:00:00:00:07:37:8c:5b:a1:d9:5b:8c:d4:00:00:00:00:00:07

  Certificate

  Issuer

  CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

  Not Before

  13-04-2021 17:31

  Not After

  13-04-2026 17:31

  Subject

  CN=Microsoft ID Verified CS AOC CA 01,O=Microsoft Corporation,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

  Certificate

  Issuer

  CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

  Not Before

  01-04-2021 20:05

  Not After

  01-04-2036 20:15

  Subject

  CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

  Certificate

  Issuer

  CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

  Not Before

  19-11-2020 20:32

  Not After

  19-11-2035 20:42

  Subject

  CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:00:36:d9:36:1c:89:0a:2e:6b:81:00:00:00:00:00:36

  Certificate

  Issuer

  CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

  Not Before

  15-02-2024 20:35

  Not After

  15-02-2025 20:35

  Subject

  CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=Thales TSS ESN:45D6-96C5-5E63,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  c3:52:e3:f0:86:f7:b3:f0:32:9c:6f:22:33:f2:31:37:45:c6:06:ba:7c:6f:13:87:8c:f6:f2:f6:1d:ef:dc:7b

  Signer

  Actual PE Digest

  c3:52:e3:f0:86:f7:b3:f0:32:9c:6f:22:33:f2:31:37:45:c6:06:ba:7c:6f:13:87:8c:f6:f2:f6:1d:ef:dc:7b

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 774KB - Virtual size: 774KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/24985d941556f95dd3a91d2451d11d91af5633f618cd49a6a4ae31ece2dce41e.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2535fa679beee99dcaef0d7d159d1299e637b7f8bcae3cd17826004fd5f4cd8b.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/25512e04d8b4608cc9b3018d5315cd2645a78c18f62b198a012e9e562efde2ad.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 244KB - Virtual size: 244KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/25c879c050733f1ae4f15f4bb2995bdf02ac3fc325d48da9b1b3e45750708d2a.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\nm3g1kez\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 498KB - Virtual size: 498KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/27d6b8949076341f93c6454a30ed270ba8d08d0430f5c7fead167333201dc95d.exe

  .dll windows:5 windows x64 arch:x64

  46551b97c1d63fc258acfca97bdbeb94

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  kernel32

  CreateNamedPipeA

  TerminateProcess

  CreateProcessA

  GetCurrentDirectoryW

  GetFullPathNameA

  GetLogicalDrives

  FindClose

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ExpandEnvironmentStringsA

  GetFileAttributesA

  FindFirstFileA

  FindNextFileA

  CopyFileA

  MoveFileA

  GetCurrentProcessId

  CreateThread

  CreateToolhelp32Snapshot

  Thread32First

  Thread32Next

  Wow64GetThreadContext

  Wow64SetThreadContext

  VirtualAlloc

  VirtualProtect

  SetLastError

  SetNamedPipeHandleState

  PeekNamedPipe

  CreateFileA

  WaitNamedPipeA

  GetModuleFileNameA

  GetComputerNameA

  GetVersionExA

  GetACP

  GetOEMCP

  GetProcessHeap

  InitializeProcThreadAttributeList

  DeleteProcThreadAttributeList

  SetErrorMode

  UpdateProcThreadAttribute

  ProcessIdToSessionId

  Process32First

  Process32Next

  GetComputerNameExA

  VirtualFree

  VirtualQuery

  VirtualAllocEx

  VirtualProtectEx

  OpenProcess

  CreateRemoteThread

  ConnectNamedPipe

  ReadProcessMemory

  WriteProcessMemory

  GetThreadContext

  SetThreadContext

  ResumeThread

  CloseHandle

  DuplicateHandle

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingA

  ExitProcess

  ExitThread

  ReadFile

  GetCurrentThread

  GetCurrentProcess

  MultiByteToWideChar

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetStartupInfoA

  DisconnectNamedPipe

  CreatePipe

  GetTickCount

  GetLocalTime

  FlushFileBuffers

  WriteFile

  WaitForSingleObject

  Sleep

  GetModuleHandleA

  LoadLibraryA

  GetLastError

  HeapFree

  RaiseException

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  HeapAlloc

  HeapDestroy

  HeapCreate

  SetEndOfFile

  CreateFileW

  WriteConsoleW

  SetStdHandle

  GetStringTypeW

  LCMapStringW

  CompareStringW

  HeapSize

  LoadLibraryW

  OutputDebugStringW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  RemoveDirectoryW

  CreateDirectoryW

  DeleteFileW

  GetFileType

  SetFilePointerEx

  SetFilePointer

  ReadConsoleW

  GetConsoleMode

  GetConsoleCP

  WideCharToMultiByte

  GetCPInfo

  IsValidCodePage

  RtlUnwindEx

  GetProcAddress

  OpenThread

  FreeLibrary

  EncodePointer

  DecodePointer

  GetModuleHandleExW

  AreFileApisANSI

  GetSystemTimeAsFileTime

  HeapReAlloc

  GetCommandLineA

  GetCurrentThreadId

  GetStdHandle

  GetModuleFileNameW

  IsDebuggerPresent

  IsProcessorFeaturePresent

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetModuleHandleW

  LoadLibraryExW

  advapi32

  GetTokenInformation

  OpenProcessToken

  CryptReleaseContext

  CryptAcquireContextA

  CryptGenRandom

  CheckTokenMembership

  DuplicateTokenEx

  LogonUserA

  LookupAccountSidA

  FreeSid

  AllocateAndInitializeSid

  ImpersonateNamedPipeClient

  RevertToSelf

  GetUserNameA

  CreateProcessWithTokenW

  CreateProcessWithLogonW

  CreateProcessAsUserA

  ImpersonateLoggedOnUser

  LookupPrivilegeValueA

  AdjustTokenPrivileges

  OpenThreadToken

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetConnectA

  InternetQueryDataAvailable

  InternetQueryOptionA

  InternetSetOptionA

  InternetSetStatusCallback

  HttpOpenRequestA

  HttpAddRequestHeadersA

  HttpSendRequestA

  HttpQueryInfoA

  InternetOpenA

  ws2_32

  ntohs

  gethostbyname

  socket

  send

  connect

  ioctlsocket

  WSAIoctl

  WSACleanup

  WSAStartup

  closesocket

  ntohl

  htons

  htonl

  recv

  shutdown

  WSAGetLastError

  __WSAFDIsSet

  accept

  bind

  inet_addr

  listen

  recvfrom

  select

  sendto

  WSASocketA

  Exports

  Exports

  ReflectiveLoader

  Sections

  .text

  Size: 192KB - Virtual size: 192KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 63KB - Virtual size: 63KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 29KB - Virtual size: 70KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/27fd19605b2635dd1eeb6784ec72d27a233f4b65e1f7fb6463a836f8bc0eaacd.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 515KB - Virtual size: 515KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/284b5f6acee3027d3e3f2acfe92ae956d4aa482095ac3d24717247cf81abf0cb.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/28733955534ae18f37a6076f0859bc92e8a2342f1c437bc7d3a263f1c73a505b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\xampp\htdocs\default\HttpEmulator\obj\Debug\net8.0\LtpFaker.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/28a77038b1f69e4df9ae5f2e5333c3e1911eff6768ed4eeb6c7a7d3de4ec2e57.exe

  .exe windows:5 windows x64 arch:x64

  dd321d5cbf19ebb14037e9137cc8e5b6

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  oleaut32

  SysFreeString

  SysReAllocStringLen

  SysAllocStringLen

  SafeArrayGetElemsize

  SafeArrayPtrOfIndex

  SafeArrayPutElement

  SafeArrayGetElement

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayCreate

  VariantChangeType

  VariantCopyInd

  VariantCopy

  VariantClear

  VariantInit

  GetErrorInfo

  SysFreeString

  advapi32

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  RegUnLoadKeyW

  RegSetValueExW

  RegSaveKeyW

  RegRestoreKeyW

  RegReplaceKeyW

  RegQueryValueExW

  RegQueryInfoKeyW

  RegOpenKeyExW

  RegLoadKeyW

  RegFlushKey

  RegEnumValueW

  RegEnumKeyExW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  RegConnectRegistryW

  RegCloseKey

  user32

  CharNextW

  LoadStringW

  SetClassLongPtrW

  GetClassLongPtrW

  SetWindowLongPtrW

  GetWindowLongPtrW

  CreateWindowExW

  WindowFromPoint

  WaitMessage

  UpdateWindow

  UnregisterClassW

  UnhookWindowsHookEx

  TranslateMessage

  TranslateMDISysAccel

  TrackPopupMenu

  SystemParametersInfoW

  ShowWindow

  ShowScrollBar

  ShowOwnedPopups

  ShowCaret

  SetWindowRgn

  SetWindowsHookExW

  SetWindowTextW

  SetWindowPos

  SetWindowPlacement

  SetTimer

  SetScrollRange

  SetScrollPos

  SetScrollInfo

  SetRect

  SetPropW

  SetParent

  SetMenuItemInfoW

  SetMenu

  SetForegroundWindow

  SetFocus

  SetCursorPos

  SetCursor

  SetClipboardData

  SetCapture

  SetActiveWindow

  SendMessageA

  SendMessageW

  ScrollWindow

  ScreenToClient

  RemovePropW

  RemoveMenu

  ReleaseDC

  ReleaseCapture

  RegisterWindowMessageW

  RegisterClipboardFormatW

  RegisterClassW

  RedrawWindow

  PostQuitMessage

  PostMessageW

  PeekMessageA

  PeekMessageW

  OpenClipboard

  MsgWaitForMultipleObjectsEx

  MsgWaitForMultipleObjects

  MessageBoxW

  MessageBeep

  MapWindowPoints

  MapVirtualKeyW

  LoadStringW

  LoadKeyboardLayoutW

  LoadIconW

  LoadCursorW

  LoadBitmapW

  KillTimer

  IsZoomed

  IsWindowVisible

  IsWindowUnicode

  IsWindowEnabled

  IsWindow

  IsIconic

  IsDialogMessageA

  IsDialogMessageW

  IsChild

  InvalidateRect

  InsertMenuItemW

  InsertMenuW

  HideCaret

  GetWindowThreadProcessId

  GetWindowTextW

  GetWindowRect

  GetWindowPlacement

  GetWindowDC

  GetTopWindow

  GetSystemMetrics

  GetSystemMenu

  GetSysColorBrush

  GetSysColor

  GetSubMenu

  GetScrollRange

  GetScrollPos

  GetScrollInfo

  GetScrollBarInfo

  GetPropW

  GetParent

  GetWindow

  GetMessagePos

  GetMessageExtraInfo

  GetMenuStringW

  GetMenuState

  GetMenuItemInfoW

  GetMenuItemID

  GetMenuItemCount

  GetMenu

  GetLastActivePopup

  GetKeyboardState

  GetKeyboardLayoutNameW

  GetKeyboardLayoutList

  GetKeyboardLayout

  GetKeyState

  GetKeyNameTextW

  GetIconInfo

  GetForegroundWindow

  GetFocus

  GetDlgCtrlID

  GetDesktopWindow

  GetDCEx

  GetDC

  GetCursorPos

  GetCursor

  GetClipboardData

  GetClientRect

  GetClassNameW

  GetClassInfoExW

  GetClassInfoW

  GetCapture

  GetActiveWindow

  FrameRect

  FindWindowExW

  FindWindowW

  FillRect

  EnumWindows

  EnumThreadWindows

  EnumChildWindows

  EndPaint

  EndMenu

  EnableWindow

  EnableScrollBar

  EnableMenuItem

  EmptyClipboard

  DrawTextExW

  DrawTextW

  DrawMenuBar

  DrawIconEx

  DrawIcon

  DrawFrameControl

  DrawFocusRect

  DrawEdge

  DispatchMessageA

  DispatchMessageW

  DestroyWindow

  DestroyMenu

  DestroyIcon

  DestroyCursor

  DeleteMenu

  DefWindowProcW

  DefMDIChildProcW

  DefFrameProcW

  CreatePopupMenu

  CreateMenu

  CreateIcon

  CreateAcceleratorTableW

  CopyImage

  CopyIcon

  CloseClipboard

  ClientToScreen

  CheckMenuItem

  CharUpperBuffW

  CharUpperW

  CharNextW

  CharLowerBuffW

  CharLowerW

  CallWindowProcW

  CallNextHookEx

  BeginPaint

  AdjustWindowRectEx

  ActivateKeyboardLayout

  EnumDisplayMonitors

  GetMonitorInfoW

  MonitorFromPoint

  MonitorFromRect

  MonitorFromWindow

  kernel32

  Sleep

  VirtualFree

  VirtualAlloc

  lstrlenW

  VirtualQuery

  QueryPerformanceCounter

  GetTickCount

  GetSystemInfo

  GetVersion

  CompareStringW

  IsValidLocale

  SetThreadLocale

  GetSystemDefaultUILanguage

  GetUserDefaultUILanguage

  GetLocaleInfoW

  WideCharToMultiByte

  MultiByteToWideChar

  GetACP

  LoadLibraryExW

  GetStartupInfoW

  GetProcAddress

  GetModuleHandleW

  GetModuleFileNameW

  GetCommandLineW

  FreeLibrary

  GetLastError

  UnhandledExceptionFilter

  RtlUnwindEx

  RtlUnwind

  RaiseException

  ExitProcess

  ExitThread

  SwitchToThread

  GetCurrentThreadId

  CreateThread

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  FindFirstFileW

  FindClose

  WriteFile

  GetStdHandle

  CloseHandle

  GetProcAddress

  RaiseException

  LoadLibraryA

  GetLastError

  TlsSetValue

  TlsGetValue

  LocalFree

  LocalAlloc

  GetModuleHandleW

  FreeLibrary

  WriteFile

  WideCharToMultiByte

  WaitForSingleObject

  WaitForMultipleObjectsEx

  VirtualQueryEx

  VirtualQuery

  VirtualProtect

  VirtualFree

  VirtualAlloc

  VerSetConditionMask

  VerifyVersionInfoW

  TryEnterCriticalSection

  SwitchToThread

  SuspendThread

  Sleep

  SizeofResource

  SetThreadPriority

  SetThreadLocale

  SetLastError

  SetFilePointer

  SetEvent

  SetErrorMode

  SetEndOfFile

  ResumeThread

  ResetEvent

  ReadFile

  RaiseException

  QueryPerformanceFrequency

  QueryPerformanceCounter

  IsDebuggerPresent

  MulDiv

  LockResource

  LocalFree

  LoadResource

  LoadLibraryW

  LeaveCriticalSection

  LCMapStringW

  IsValidLocale

  InitializeCriticalSection

  HeapSize

  HeapFree

  HeapDestroy

  HeapCreate

  HeapAlloc

  GlobalUnlock

  GlobalLock

  GlobalFree

  GlobalFindAtomW

  GlobalDeleteAtom

  GlobalAlloc

  GlobalAddAtomW

  GetVersionExW

  GetVersion

  GetTimeZoneInformation

  GetTickCount

  GetThreadPriority

  GetThreadLocale

  GetStdHandle

  GetProcAddress

  GetModuleHandleW

  GetModuleFileNameW

  GetLocaleInfoW

  GetLocalTime

  GetLastError

  GetFullPathNameW

  GetFileSize

  GetFileAttributesW

  GetExitCodeThread

  GetDiskFreeSpaceW

  GetDateFormatW

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcessId

  GetCurrentProcess

  GetCPInfoExW

  GetCPInfo

  GetACP

  FreeResource

  FreeLibrary

  FormatMessageW

  FindResourceW

  FindFirstFileW

  FindClose

  EnumSystemLocalesW

  EnumResourceNamesW

  EnumCalendarInfoW

  EnterCriticalSection

  DeleteCriticalSection

  CreateThread

  CreateFileW

  CreateEventW

  CompareStringW

  CloseHandle

  Sleep

  gdi32

  UnrealizeObject

  StretchDIBits

  StretchBlt

  StartPage

  StartDocW

  SetWindowOrgEx

  SetWinMetaFileBits

  SetViewportOrgEx

  SetTextColor

  SetStretchBltMode

  SetRectRgn

  SetROP2

  SetPixel

  SetEnhMetaFileBits

  SetDIBits

  SetDIBColorTable

  SetBrushOrgEx

  SetBkMode

  SetBkColor

  SetAbortProc

  SelectPalette

  SelectObject

  SaveDC

  RoundRect

  RestoreDC

  Rectangle

  RectVisible

  RealizePalette

  Polyline

  Polygon

  PolyBezierTo

  PolyBezier

  PlayEnhMetaFile

  Pie

  PatBlt

  MoveToEx

  MaskBlt

  LineTo

  IntersectClipRect

  GetWindowOrgEx

  GetWinMetaFileBits

  GetTextMetricsW

  GetTextExtentPointW

  GetTextExtentPoint32W

  GetTextAlign

  GetSystemPaletteEntries

  GetStockObject

  GetRgnBox

  GetPixel

  GetPaletteEntries

  GetObjectW

  GetEnhMetaFilePaletteEntries

  GetEnhMetaFileHeader

  GetEnhMetaFileDescriptionW

  GetEnhMetaFileBits

  GetDeviceCaps

  GetDIBits

  GetDIBColorTable

  GetCurrentPositionEx

  GetClipBox

  GetBrushOrgEx

  GetBitmapBits

  GdiFlush

  FrameRgn

  ExtTextOutW

  ExtFloodFill

  ExcludeClipRect

  EnumFontsW

  EnumFontFamiliesExW

  EndPage

  EndDoc

  Ellipse

  DeleteObject

  DeleteEnhMetaFile

  DeleteDC

  CreateSolidBrush

  CreateRectRgn

  CreatePenIndirect

  CreatePalette

  CreateICW

  CreateHalftonePalette

  CreateFontIndirectW

  CreateDIBitmap

  CreateDIBSection

  CreateDCW

  CreateCompatibleDC

  CreateCompatibleBitmap

  CreateBrushIndirect

  CreateBitmap

  CopyEnhMetaFileW

  Chord

  BitBlt

  ArcTo

  Arc

  AngleArc

  AbortDoc

  version

  VerQueryValueW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoTaskMemAlloc

  CoCreateInstance

  CoUninitialize

  CoInitialize

  IsEqualGUID

  comctl32

  InitializeFlatSB

  FlatSB_SetScrollProp

  FlatSB_SetScrollPos

  FlatSB_SetScrollInfo

  FlatSB_GetScrollPos

  FlatSB_GetScrollInfo

  _TrackMouseEvent

  ImageList_GetImageInfo

  ImageList_SetIconSize

  ImageList_GetIconSize

  ImageList_Write

  ImageList_Read

  ImageList_GetDragImage

  ImageList_DragShowNolock

  ImageList_DragMove

  ImageList_DragLeave

  ImageList_DragEnter

  ImageList_EndDrag

  ImageList_BeginDrag

  ImageList_Copy

  ImageList_LoadImageW

  ImageList_GetIcon

  ImageList_Remove

  ImageList_DrawEx

  ImageList_Replace

  ImageList_Draw

  ImageList_SetOverlayImage

  ImageList_GetBkColor

  ImageList_SetBkColor

  ImageList_ReplaceIcon

  ImageList_Add

  ImageList_SetImageCount

  ImageList_GetImageCount

  ImageList_Destroy

  ImageList_Create

  shell32

  Shell_NotifyIconW

  winspool.drv

  OpenPrinterW

  EnumPrintersW

  DocumentPropertiesW

  ClosePrinter

  GetDefaultPrinterW

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 4.3MB - Virtual size: 4.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 383KB - Virtual size: 383KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 42KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 156B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 484B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 109B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 231KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 252KB - Virtual size: 251KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/294ced379d0a482555c0310f3ba705b26a776b797a12bed572a0103f90ff87dd.exe

  .exe windows:6 windows x86 arch:x86

  733f21ebd0062e4a15fd5f0e92de28df

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\LV\source\repos\App\Release\App.pdb

  Imports

  kernel32

  CreateFileW

  WriteConsoleW

  FreeConsole

  CreateProcessA

  GetEnvironmentVariableA

  CloseHandle

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwind

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  ExitProcess

  GetModuleHandleExW

  GetCommandLineA

  GetCommandLineW

  GetFileType

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  GetStringTypeW

  CompareStringW

  LCMapStringW

  GetProcessHeap

  ReadFile

  GetConsoleMode

  ReadConsoleW

  HeapSize

  HeapReAlloc

  FlushFileBuffers

  GetConsoleOutputCP

  SetFilePointerEx

  DecodePointer

  user32

  MessageBoxW

  advapi32

  CryptHashData

  CryptDestroyHash

  CryptReleaseContext

  CryptDestroyKey

  CryptAcquireContextW

  CryptDecrypt

  CryptCreateHash

  CryptDeriveKey

  dnsapi

  DnsQuery_A

  Sections

  .text

  Size: 57KB - Virtual size: 57KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/29845ffe6f02fc62fbdbc58655e25e48a591435b75281b7113f0c72134045092.exe

  .exe windows:6 windows x86 arch:x86

  84bb2aff56eab52b0bfbd8f1d67713aa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetEnvironmentVariableW

  CreateMutexW

  FindClose

  LocalAlloc

  CreateFileW

  GetLogicalDriveStringsW

  GetLastError

  CreateThread

  SetFilePointer

  GetFileSize

  ExitProcess

  CreateProcessW

  GetDriveTypeW

  FlushFileBuffers

  WriteConsoleW

  CloseHandle

  ExpandEnvironmentStringsW

  WriteFile

  FindNextFileW

  FindFirstFileW

  LocalFree

  ReadFile

  SetFilePointerEx

  GetConsoleMode

  GetConsoleOutputCP

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  GetCurrentProcess

  TerminateProcess

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  GetStdHandle

  GetModuleFileNameW

  GetModuleHandleExW

  HeapAlloc

  HeapFree

  FindFirstFileExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetStdHandle

  GetFileType

  GetStringTypeW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeCriticalSectionEx

  VirtualProtect

  LCMapStringW

  GetProcessHeap

  HeapSize

  HeapReAlloc

  DecodePointer

  user32

  wsprintfW

  advapi32

  CryptAcquireContextW

  CryptGenRandom

  RegSetValueExW

  RegCreateKeyW

  RegCloseKey

  ntdll

  NtDelayExecution

  NtClose

  RtlAdjustPrivilege

  Sections

  .text

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .fptable

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2a89e5d06b1d2b4a9c95c33443e10ba17891c7a99130c73c96bfa5df56393a5d.exe

  .exe windows:6 windows x86 arch:x86

  63ed59597dad42eeec3f01fae0ba2a2e

  
  

  Code Sign

  12:e7:9e:88:32:4c:ce:a9:4e:03:58:cc:b4:a7:50:75

  Certificate

  Issuer

  CN=CodeSigningCert

  Not Before

  28-02-2023 11:15

  Not After

  28-02-2025 11:25

  Subject

  CN=CodeSigningCert

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  60:c4:a5:9a:25:f7:73:b1:57:a8:9a:72:44:95:c6:fa:c2:67:b4:af:5a:dc:97:20:69:e1:c5:40:79:3f:2f:43

  Signer

  Actual PE Digest

  60:c4:a5:9a:25:f7:73:b1:57:a8:9a:72:44:95:c6:fa:c2:67:b4:af:5a:dc:97:20:69:e1:c5:40:79:3f:2f:43

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb

  Imports

  kernel32

  WriteFile

  DeleteFileW

  HeapDestroy

  HeapSize

  HeapReAlloc

  HeapFree

  HeapAlloc

  GetProcessHeap

  SizeofResource

  LockResource

  LoadResource

  FindResourceW

  FindResourceExW

  CreateEventExW

  WaitForSingleObject

  CreateProcessW

  GetLastError

  GetExitCodeProcess

  SetEvent

  RemoveDirectoryW

  GetProcAddress

  GetModuleHandleW

  GetWindowsDirectoryW

  CreateDirectoryW

  GetTempPathW

  GetTempFileNameW

  MoveFileW

  EnterCriticalSection

  LeaveCriticalSection

  GetModuleFileNameW

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  RaiseException

  SetLastError

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  MulDiv

  lstrcmpW

  CreateEventW

  FindClose

  FindFirstFileW

  GetFullPathNameW

  InitializeCriticalSection

  lstrcpynW

  CreateThread

  GetLogicalDriveStringsW

  GetDriveTypeW

  GetDiskFreeSpaceExW

  Sleep

  LoadLibraryExW

  FreeLibrary

  GetCurrentProcess

  WideCharToMultiByte

  GetSystemDirectoryW

  GetCurrentProcessId

  DecodePointer

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  CreateNamedPipeW

  GetExitCodeThread

  lstrlenW

  VerifyVersionInfoW

  VerSetConditionMask

  lstrcmpiW

  LoadLibraryW

  CompareStringW

  FindNextFileW

  GetFileSize

  GetFileAttributesW

  GetShortPathNameW

  GetFinalPathNameByHandleW

  SetFileAttributesW

  GetFileTime

  CopyFileW

  ReadFile

  SetFilePointer

  SetFileTime

  SystemTimeToFileTime

  MultiByteToWideChar

  GetSystemInfo

  WaitForMultipleObjects

  GetVersionExW

  CreateSemaphoreW

  ReleaseSemaphore

  GlobalMemoryStatus

  GetModuleHandleA

  GetProcessAffinityMask

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  GetStringTypeW

  OutputDebugStringW

  GetLocalTime

  FlushFileBuffers

  LocalFree

  LocalAlloc

  SetUnhandledExceptionFilter

  FileTimeToSystemTime

  GetEnvironmentVariableW

  GetSystemTime

  GetDateFormatW

  GetTimeFormatW

  GetLocaleInfoW

  FormatMessageW

  ConnectNamedPipe

  CloseHandle

  InitializeCriticalSectionEx

  LoadLibraryA

  GetModuleFileNameA

  GetCurrentThread

  GetConsoleOutputCP

  Wow64DisableWow64FsRedirection

  Wow64RevertWow64FsRedirection

  IsWow64Process

  SetConsoleTextAttribute

  GetStdHandle

  GetConsoleScreenBufferInfo

  GetTickCount

  GetCommandLineW

  SetCurrentDirectoryW

  SetEndOfFile

  EnumResourceLanguagesW

  GetSystemDefaultLangID

  GetUserDefaultLangID

  ResetEvent

  GlobalFree

  GetPrivateProfileStringW

  GetPrivateProfileSectionNamesW

  WritePrivateProfileStringW

  TerminateThread

  CompareFileTime

  CopyFileExW

  OpenEventW

  PeekNamedPipe

  WaitForSingleObjectEx

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  TryAcquireSRWLockExclusive

  FormatMessageA

  GetLocaleInfoEx

  FindFirstFileExW

  MoveFileExW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  WakeAllConditionVariable

  SleepConditionVariableSRW

  EncodePointer

  LCMapStringEx

  CompareStringEx

  GetCPInfo

  GetSystemTimeAsFileTime

  IsDebuggerPresent

  InitializeSListHead

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  FlushInstructionCache

  IsProcessorFeaturePresent

  VirtualAlloc

  VirtualFree

  UnhandledExceptionFilter

  TerminateProcess

  GetStartupInfoW

  RtlUnwind

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  ExitThread

  FreeLibraryAndExitThread

  GetModuleHandleExW

  ExitProcess

  GetFileType

  LCMapStringW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetConsoleMode

  SetFilePointerEx

  GetFileSizeEx

  ReadConsoleW

  GetTimeZoneInformation

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCommandLineA

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  WriteConsoleW

  GetEnvironmentStringsW

  CreateFileW

  imagehlp

  SymGetModuleBase

  SymFunctionTableAccess

  SymGetLineFromAddr

  SymSetSearchPath

  SymCleanup

  SymInitialize

  SymSetOptions

  StackWalk

  Sections

  .text

  Size: 2.8MB - Virtual size: 2.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 746KB - Virtual size: 745KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 13KB - Virtual size: 54KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didat

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 205KB - Virtual size: 205KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2a9eb7b0c040619387dcab44f7e040d88cd05712373dcec6bd855f283e89a981.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 576B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2bf5be3e7887e1f3817930ce7e54ddac4720827329ec5660ae57d9fcf4a8ad84.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  PnJP.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 574KB - Virtual size: 573KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2cc374fc5263d7616bf3c2ed503f63f6c1ef8fcd504891468aae160f104f1d55.exe

  .exe windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  Size: 3.8MB - Virtual size: 8.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  Size: 84KB - Virtual size: 186KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 2.8MB - Virtual size: 2.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Size: 16KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Size: 2KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1024B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  Windows

  Size: - Virtual size: 15.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .boot

  Size: 9.8MB - Virtual size: 9.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16B - Virtual size: 4KB

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2d13118e76f48b0630942c7967b606e6b1d00884cb9d0d98c6b8b3b1663a3a4b.exe

  .exe windows:6 windows x64 arch:x64

  de41d4e0545d977de6ca665131bb479a

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-04-2024 00:00

  Not After

  10-04-2027 23:59

  Subject

  SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  47:cb:3f:af:26:db:83:d6:db:10:96:7e:40:cf:b8:dc:2e:1f:7c:df:2b:e4:e9:d1:6f:e8:39:7c:00:f6:85:fc

  Signer

  Actual PE Digest

  47:cb:3f:af:26:db:83:d6:db:10:96:7e:40:cf:b8:dc:2e:1f:7c:df:2b:e4:e9:d1:6f:e8:39:7c:00:f6:85:fc

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __set_app_type

  __setusermatherr

  _amsg_exit

  _cexit

  _commode

  _fmode

  _initterm

  _onexit

  _wcsicmp

  _wcsnicmp

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcpy

  memset

  signal

  strlen

  strncmp

  vfprintf

  wcscat

  wcscpy

  wcslen

  wcsncmp

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  InitializeCriticalSection

  LeaveCriticalSection

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  Sections

  .text

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 384B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 54KB - Virtual size: 54KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 120B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2d623f8bc94955d09dc64cac80580b20c1d503263af7ac609cd4d1106f0f7ee4.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 440KB - Virtual size: 440KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2e31d40d7a51bed75433378487b5801dacee2be70dfc3601168f446ebc2e6020.exe

  .exe windows:6 windows x86 arch:x86

  c3e6a2ca407c7b037f38ac43479627d0

  
  

  Code Sign

  81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  19-06-2024 03:25

  Not After

  28-07-2038 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  46:39:3d:90:ec:c8:30:8e:c5:62:57:90

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  22-04-2024 15:30

  Not After

  23-04-2025 15:30

  Subject

  SERIALNUMBER=0146772,CN=SHINE YOUR GUTS (SMC-PRIVATE) LIMITED,O=SHINE YOUR GUTS (SMC-PRIVATE) LIMITED,L=Lahore,ST=Punjab,C=PK,1.2.840.113549.1.9.1=#0c13676e617a617234323340676d61696c2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#1302504b,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Not Before

  07-11-2023 17:13

  Not After

  09-12-2034 17:13

  Subject

  CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  20-06-2018 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  10-12-2014 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  83:81:4b:10:97:88:df:87:87:97:2d:b2:37:43:c6:66:b3:5d:5a:41:67:d9:f4:c2:00:c3:bb:02:51:2b:11:48

  Signer

  Actual PE Digest

  83:81:4b:10:97:88:df:87:87:97:2d:b2:37:43:c6:66:b3:5d:5a:41:67:d9:f4:c2:00:c3:bb:02:51:2b:11:48

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateFileW

  MultiByteToWideChar

  LockResource

  CloseHandle

  GetModuleFileNameW

  FindResourceW

  LocalFree

  GetModuleHandleW

  WideCharToMultiByte

  DecodePointer

  WriteFile

  GetCurrentProcess

  SizeofResource

  CreateDirectoryW

  GetLastError

  LoadResource

  GetCommandLineW

  FlushFileBuffers

  HeapReAlloc

  HeapSize

  GetConsoleMode

  GetConsoleOutputCP

  SetFilePointerEx

  SetStdHandle

  FormatMessageA

  GetLocaleInfoEx

  FindClose

  FindFirstFileExW

  FindNextFileW

  AreFileApisANSI

  GetProcAddress

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  RaiseException

  SetLastError

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  GetCPInfo

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  HeapFree

  HeapAlloc

  GetFileType

  CompareStringW

  LCMapStringW

  GetStringTypeW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  GetProcessHeap

  WriteConsoleW

  advapi32

  RegGetValueW

  CloseServiceHandle

  OpenSCManagerW

  StartServiceW

  OpenServiceW

  CreateServiceW

  winhttp

  WinHttpCloseHandle

  WinHttpReceiveResponse

  WinHttpConnect

  WinHttpQueryDataAvailable

  WinHttpOpenRequest

  WinHttpReadData

  WinHttpOpen

  WinHttpSendRequest

  Sections

  .text

  Size: 192KB - Virtual size: 191KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 46KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 332KB - Virtual size: 331KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2e4deff4bfe5c4ce46b2d0a1f875dbc0933ec2e0f0e4a210990352601c29638e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  cf:f0:4e:17:8d:61:df:f5:6a:d1:69:21:49:41:bd:5a:17:41:28:6f:11:dc:64:47:b6:ec:d5:1c:eb:78:02:1a

  Signer

  Actual PE Digest

  cf:f0:4e:17:8d:61:df:f5:6a:d1:69:21:49:41:bd:5a:17:41:28:6f:11:dc:64:47:b6:ec:d5:1c:eb:78:02:1a

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\s0i48\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 194KB - Virtual size: 194KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459.exe

  .exe windows:6 windows x86 arch:x86

  9c7c36eb46cc991a5074f8a811c4c46c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CreateThread

  GetLocalTime

  GetThreadContext

  GetProcAddress

  VirtualAllocEx

  RemoveDirectoryA

  ReadProcessMemory

  GetSystemInfo

  CreateDirectoryA

  SetThreadContext

  SetEndOfFile

  DecodePointer

  ReadConsoleW

  HeapReAlloc

  HeapSize

  CloseHandle

  CreateFileA

  GetFileAttributesA

  GetLastError

  Sleep

  GetTempPathA

  SetCurrentDirectoryA

  GetModuleHandleA

  ResumeThread

  GetComputerNameExW

  GetVersionExW

  CreateMutexA

  VirtualAlloc

  WriteFile

  VirtualFree

  WriteProcessMemory

  GetModuleFileNameA

  CreateProcessA

  ReadFile

  GetTimeZoneInformation

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetStringTypeW

  GetProcessHeap

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  FindClose

  SetFilePointerEx

  SetStdHandle

  GetFullPathNameW

  GetCurrentDirectoryW

  DeleteFileW

  LCMapStringW

  CompareStringW

  MultiByteToWideChar

  HeapAlloc

  HeapFree

  GetCommandLineW

  GetCommandLineA

  GetStdHandle

  FileTimeToSystemTime

  SystemTimeToTzSpecificLocalTime

  PeekNamedPipe

  GetFileType

  GetFileInformationByHandle

  GetDriveTypeW

  RaiseException

  GetCurrentThreadId

  IsProcessorFeaturePresent

  QueueUserWorkItem

  GetModuleHandleExW

  FormatMessageW

  WideCharToMultiByte

  EnterCriticalSection

  LeaveCriticalSection

  TryEnterCriticalSection

  DeleteCriticalSection

  SetLastError

  InitializeCriticalSectionAndSpinCount

  CreateEventW

  SwitchToThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetSystemTimeAsFileTime

  GetTickCount

  GetModuleHandleW

  WaitForSingleObjectEx

  QueryPerformanceCounter

  SetEvent

  ResetEvent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsDebuggerPresent

  GetStartupInfoW

  GetCurrentProcessId

  InitializeSListHead

  CreateTimerQueue

  SignalObjectAndWait

  SetThreadPriority

  GetThreadPriority

  GetLogicalProcessorInformation

  CreateTimerQueueTimer

  ChangeTimerQueueTimer

  DeleteTimerQueueTimer

  GetNumaHighestNodeNumber

  GetProcessAffinityMask

  SetThreadAffinityMask

  RegisterWaitForSingleObject

  UnregisterWait

  EncodePointer

  GetCurrentThread

  GetThreadTimes

  FreeLibrary

  FreeLibraryAndExitThread

  GetModuleFileNameW

  LoadLibraryExW

  VirtualProtect

  DuplicateHandle

  ReleaseSemaphore

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  InterlockedFlushSList

  QueryDepthSList

  UnregisterWaitEx

  LoadLibraryW

  RtlUnwind

  ExitProcess

  CreateFileW

  WriteConsoleW

  advapi32

  RegCloseKey

  RegQueryInfoKeyW

  RegQueryValueExA

  GetSidSubAuthorityCount

  GetSidSubAuthority

  GetUserNameA

  LookupAccountNameA

  RegSetValueExA

  RegOpenKeyExA

  RegEnumValueA

  GetSidIdentifierAuthority

  shell32

  SHGetFolderPathA

  ShellExecuteA

  ord680

  SHFileOperationA

  ole32

  CoUninitialize

  CoCreateInstance

  CoInitialize

  wininet

  HttpOpenRequestA

  InternetOpenUrlA

  InternetOpenW

  InternetOpenA

  InternetCloseHandle

  HttpSendRequestA

  InternetConnectA

  InternetReadFile

  ws2_32

  closesocket

  inet_pton

  getaddrinfo

  WSAStartup

  send

  socket

  connect

  recv

  htons

  freeaddrinfo

  Sections

  .text

  Size: 313KB - Virtual size: 313KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 68KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 13KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2f468583af58180a7ce4fd6ca34aeb56bb7e7fc2738d1ba6df62accfd61bd3ec.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 114KB - Virtual size: 113KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 87KB - Virtual size: 87KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2f4fcaa761e94666f521722e3a74693b12c0459a8688a29cd7a8dfaa6b474399.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 737KB - Virtual size: 737KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2f85f2112068f8bb10404aa3baa706095769f0945bce1854c0b6bb90e9f12178.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 231KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/2fd225d75dd151496e47e552a46a487e51a8c8c426a8e715c587368defbad256.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  85:0a:2d:b9:a0:b6:d5:26:58:f9:f3:b3:a4:29:fe:ef:f1:51:72:f5:bc:5f:00:fa:ce:c5:2a:7c:5f:2e:95:40

  Signer

  Actual PE Digest

  85:0a:2d:b9:a0:b6:d5:26:58:f9:f3:b3:a4:29:fe:ef:f1:51:72:f5:bc:5f:00:fa:ce:c5:2a:7c:5f:2e:95:40

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  4c:31:b3:d4:6b:f6:c6:8c:58:d4:c8:a6:04:2c:64:ca:c4:d4:98:15

  Signer

  Actual PE Digest

  4c:31:b3:d4:6b:f6:c6:8c:58:d4:c8:a6:04:2c:64:ca:c4:d4:98:15

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  addY.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 680KB - Virtual size: 680KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/317d4b1683e217b6af80de147bbeb8581255f320dd11ca5c13b0796f837d42aa.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 768KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 337KB - Virtual size: 340KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 245KB - Virtual size: 248KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 253KB - Virtual size: 252KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/319d1dc217b7e83a85dd62cb2c066156ba5579087f11c991a99089606979ca28.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  picturefonts.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 12.0MB - Virtual size: 12.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 128KB - Virtual size: 127KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/31a24d9835b55569b96d3eddf9aed12397a745a90bdb8b96e6658d4301a789c3.exe

  .exe windows:4 windows x86 arch:x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/31eb5bc6161a8ef7f6f1bf98d06c2aa51845b5129c81792d6387e542b4f9999d.exe

  .exe windows:6 windows x86 arch:x86

  e569e6f445d32ba23766ad67d1e3787f

  
  

  Code Sign

  04:00:00:00:00:01:21:58:53:08:a2

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  18-03-2009 10:00

  Not After

  18-03-2029 10:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  28-07-2020 00:00

  Not After

  18-03-2029 00:00

  Subject

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  28-07-2020 00:00

  Not After

  28-07-2030 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  19:e3:19:06:28:b5:61:96:ff:a3:61:a6

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  21-02-2024 09:02

  Not After

  21-02-2025 09:02

  Subject

  SERIALNUMBER=220340024072,CN=YARD STAR\, TOO,O=YARD STAR\, TOO,STREET=Dom 79\, kv. 147\, ulitsa Sadovaya,L=Kostanay,ST=Kostanay,C=KZ,1.2.840.113549.1.9.1=#0c1461646d696e4079617264737461726b7a2e636f6d,1.3.6.1.4.1.311.60.2.1.3=#13024b5a,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  13:9e:d0:e9:72:ee:8f:56:35:bd:74:00:22:bd:e9:e8:2c:6d:5b:48

  Signer

  Actual PE Digest

  13:9e:d0:e9:72:ee:8f:56:35:bd:74:00:22:bd:e9:e8:2c:6d:5b:48

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  kernel32

  GetACP

  GetExitCodeProcess

  LocalFree

  CloseHandle

  SizeofResource

  VirtualProtect

  VirtualFree

  GetFullPathNameW

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  RtlUnwind

  GetCPInfo

  GetStdHandle

  GetModuleHandleW

  FreeLibrary

  HeapDestroy

  ReadFile

  CreateProcessW

  GetLastError

  GetModuleFileNameW

  SetLastError

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  GetVersion

  RaiseException

  FormatMessageW

  SwitchToThread

  GetExitCodeThread

  GetCurrentThread

  LoadLibraryExW

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  VirtualQueryEx

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetFileSize

  GetStartupInfoW

  GetFileAttributesW

  InitializeCriticalSection

  GetSystemWindowsDirectoryW

  GetThreadPriority

  SetThreadPriority

  GetCurrentProcess

  VirtualAlloc

  GetSystemInfo

  GetCommandLineW

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  GetWindowsDirectoryW

  VerSetConditionMask

  GetDiskFreeSpaceW

  FindFirstFileW

  GetUserDefaultUILanguage

  lstrlenW

  QueryPerformanceCounter

  SetEndOfFile

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  CreateFileW

  GetLocaleInfoW

  GetSystemDirectoryW

  DeleteFileW

  GetLocalTime

  GetEnvironmentVariableW

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  TlsGetValue

  GetDateFormatW

  SetErrorMode

  IsValidLocale

  TlsSetValue

  CreateDirectoryW

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  GetUserDefaultLangID

  RemoveDirectoryW

  CreateEventW

  SetThreadLocale

  GetThreadLocale

  comctl32

  InitCommonControls

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  user32

  CreateWindowExW

  TranslateMessage

  CharLowerBuffW

  CallWindowProcW

  CharUpperW

  PeekMessageW

  GetSystemMetrics

  SetWindowLongW

  MessageBoxW

  DestroyWindow

  CharUpperBuffW

  CharNextW

  MsgWaitForMultipleObjects

  LoadStringW

  ExitWindowsEx

  DispatchMessageW

  oleaut32

  SysAllocStringLen

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetLBound

  SafeArrayGetUBound

  VariantInit

  VariantClear

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  SafeArrayCreate

  netapi32

  NetWkstaGetInfo

  NetApiBufferFree

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  RegQueryValueExW

  AdjustTokenPrivileges

  GetTokenInformation

  ConvertSidToStringSidW

  LookupPrivilegeValueW

  RegCloseKey

  OpenProcessToken

  RegOpenKeyExW

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 718KB - Virtual size: 718KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 27KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 420B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 24B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 93B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 151KB - Virtual size: 151KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/329146b8e732bfb9fba00809eacdd76e9fd7b52c188f8fe833b1abc544c0c475.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 598KB - Virtual size: 598KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3301b05a3fa16102cccd8eb66951e7db4f7a6e658c2c9b726116a02f7ef3715f.exe

  .exe windows:4 windows x64 arch:x64

  070246d46ce68062328bca176dabae5e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegOpenKeyExW

  RegOpenKeyW

  RegQueryMultipleValuesW

  RegQueryValueA

  RegQueryValueW

  kernel32

  GetCommandLineA

  GetProcAddress

  InitializeCriticalSection

  LoadLibraryA

  SetUnhandledExceptionFilter

  Sleep

  TlsAlloc

  TlsGetValue

  TlsSetValue

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  msvcrt

  __C_specific_handler

  atexit

  exit

  memcpy

  memset

  signal

  Sections

  .text

  Size: 2.0MB - Virtual size: 2.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 56KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 34KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 407KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 312B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 900B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/33660a9cf07371ef6a0508379ea58cb9d296b61151824900f10a857a54a3a35b.exe

  .exe windows:6 windows x64 arch:x64

  4f37c18012091e638ba43dc2708c7c99

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  C:\Users\Mikz\Desktop\User Mode\User Mode\build\usermode\Usermode.pdb

  Imports

  kernel32

  EnterCriticalSection

  OutputDebugStringW

  LeaveCriticalSection

  AreFileApisANSI

  QueryPerformanceFrequency

  QueryPerformanceCounter

  FindFirstFileW

  Process32First

  DeviceIoControl

  FindClose

  CreateFileW

  CreateToolhelp32Snapshot

  Sleep

  GetLastError

  Process32Next

  CloseHandle

  CreateThread

  GetFileAttributesExW

  CreateDirectoryW

  GetCurrentDirectoryW

  GetLocaleInfoEx

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  GetConsoleWindow

  lstrcmpiA

  RtlLookupFunctionEntry

  RtlCaptureContext

  SleepConditionVariableSRW

  WakeAllConditionVariable

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  WideCharToMultiByte

  GetFileSizeEx

  CreateFileA

  WaitForMultipleObjects

  PeekNamedPipe

  ReadFile

  GetFileType

  GetStdHandle

  GetEnvironmentVariableA

  MultiByteToWideChar

  WaitForSingleObjectEx

  MoveFileExA

  GetTickCount

  VerifyVersionInfoA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  GetSystemDirectoryA

  VerSetConditionMask

  SleepEx

  HeapDestroy

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  InitializeCriticalSectionEx

  DeleteCriticalSection

  GetCurrentProcess

  VirtualProtect

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  QueryFullProcessImageNameW

  SetLastError

  FormatMessageA

  LocalFree

  GetFileInformationByHandleEx

  user32

  MessageBoxA

  GetSystemMetrics

  msvcp140

  ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

  ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Xbad_function_call@std@@YAXXZ

  ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  _Query_perf_frequency

  ??1_Lockit@std@@QEAA@XZ

  ??0_Lockit@std@@QEAA@H@Z

  ?uncaught_exceptions@std@@YAHXZ

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

  ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

  ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?setf@ios_base@std@@QEAAHHH@Z

  ??7ios_base@std@@QEBA_NXZ

  ??Bid@locale@std@@QEAA_KXZ

  ?always_noconv@codecvt_base@std@@QEBA_NXZ

  ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?good@ios_base@std@@QEBA_NXZ

  ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

  ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

  ?_Xbad_alloc@std@@YAXXZ

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAHH@Z

  ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

  ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ?id@?$ctype@D@std@@2V0locale@2@A

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  _Query_perf_counter

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

  ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

  ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

  ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  normaliz

  IdnToAscii

  wldap32

  ord30

  ord301

  ord79

  ord35

  ord33

  ord32

  ord27

  ord200

  ord143

  ord22

  ord41

  ord50

  ord45

  ord60

  ord211

  ord46

  ord217

  ord26

  crypt32

  CertOpenStore

  CertCloseStore

  CertFreeCertificateChain

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CryptStringToBinaryA

  PFXImportCertStore

  CryptDecodeObjectEx

  CertAddCertificateContextToStore

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertGetNameStringA

  CertFindExtension

  ws2_32

  select

  closesocket

  recv

  ntohl

  send

  gethostname

  sendto

  WSAGetLastError

  recvfrom

  freeaddrinfo

  getaddrinfo

  __WSAFDIsSet

  ioctlsocket

  listen

  htonl

  accept

  WSACleanup

  bind

  connect

  WSAStartup

  WSAIoctl

  WSASetLastError

  socket

  getpeername

  getsockname

  setsockopt

  ntohs

  getsockopt

  htons

  shlwapi

  PathFindFileNameW

  rpcrt4

  UuidCreate

  UuidToStringA

  RpcStringFreeA

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __std_terminate

  strstr

  strchr

  __std_exception_destroy

  __std_exception_copy

  _CxxThrowException

  memchr

  memcmp

  memcpy

  memmove

  memset

  strrchr

  __current_exception

  __current_exception_context

  __C_specific_handler

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  __acrt_iob_func

  fwrite

  _lseeki64

  _read

  __stdio_common_vsprintf

  fflush

  fread

  feof

  fputs

  __stdio_common_vsscanf

  _write

  _close

  _open

  fseek

  fclose

  fputc

  fgetc

  ftell

  _popen

  _pclose

  fgets

  _set_fmode

  _get_stream_buffer_pointers

  fopen

  _fseeki64

  fsetpos

  ungetc

  setvbuf

  fgetpos

  api-ms-win-crt-string-l1-1-0

  _strdup

  isupper

  strspn

  strncmp

  strncpy

  tolower

  strcspn

  strcmp

  strpbrk

  api-ms-win-crt-utility-l1-1-0

  qsort

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  _callnewh

  malloc

  calloc

  free

  realloc

  api-ms-win-crt-convert-l1-1-0

  strtol

  atoi

  strtoul

  strtod

  strtoull

  strtoll

  api-ms-win-crt-runtime-l1-1-0

  _initialize_narrow_environment

  _errno

  system

  strerror

  __sys_nerr

  abort

  _invalid_parameter_noinfo

  _resetstkoflw

  exit

  _beginthreadex

  _getpid

  terminate

  _register_thread_local_exe_atexit_callback

  _c_exit

  __p___argv

  __p___argc

  _exit

  _initterm_e

  _initterm

  _get_initial_narrow_environment

  _set_app_type

  _seh_filter_exe

  _cexit

  _crt_atexit

  _register_onexit_function

  _initialize_onexit_table

  _invalid_parameter_noinfo_noreturn

  _configure_narrow_argv

  api-ms-win-crt-filesystem-l1-1-0

  _access

  _lock_file

  _unlock_file

  _fstat64

  _stat64

  _unlink

  api-ms-win-crt-math-l1-1-0

  _dsign

  _dclass

  __setusermatherr

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-time-l1-1-0

  _time64

  strftime

  _gmtime64

  _localtime64

  api-ms-win-crt-locale-l1-1-0

  localeconv

  _configthreadlocale

  ___lc_codepage_func

  advapi32

  ConvertSidToStringSidA

  OpenProcessToken

  AddAccessAllowedAce

  GetLengthSid

  GetTokenInformation

  InitializeAcl

  IsValidSid

  SetSecurityInfo

  CopySid

  CryptEncrypt

  CryptAcquireContextA

  CryptReleaseContext

  CryptGetHashParam

  CryptGenRandom

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  CryptDestroyKey

  CryptImportKey

  shell32

  ShellExecuteA

  Sections

  .text

  Size: 458KB - Virtual size: 457KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 112KB - Virtual size: 115KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3377833145efec59e58919e139a1a43b18c127404f18a004519ca6e955bedfa9.exe

  .dll windows:6 windows x64 arch:x64

  c69c22b5a3698527f0d3c9618c3affbd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  c:\buildslave\steam_rel_client_win64\build\src\steam_api\win64\Release\steam_api64.pdb

  Imports

  kernel32

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  GetCommandLineW

  GetEnvironmentVariableA

  SetEnvironmentVariableA

  GetCurrentDirectoryW

  GetFileAttributesW

  GetFileAttributesExW

  OutputDebugStringA

  TlsAlloc

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  GetExitCodeProcess

  OpenProcess

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  LoadLibraryExA

  MultiByteToWideChar

  WideCharToMultiByte

  WriteConsoleW

  InitializeCriticalSectionAndSpinCount

  GetLastError

  CloseHandle

  GetProcAddress

  SetEndOfFile

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  GetModuleHandleW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlPcToFileHeader

  RaiseException

  RtlUnwindEx

  InterlockedFlushSList

  SetLastError

  EncodePointer

  GetCurrentProcess

  TerminateProcess

  ExitProcess

  HeapFree

  HeapAlloc

  GetStdHandle

  GetFileType

  LCMapStringW

  ReadFile

  GetConsoleMode

  ReadConsoleW

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetFileSizeEx

  SetFilePointerEx

  GetStringTypeW

  SetStdHandle

  FlushFileBuffers

  WriteFile

  GetConsoleOutputCP

  CreateFileW

  HeapSize

  HeapReAlloc

  advapi32

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  shell32

  ShellExecuteW

  Exports

  Exports

  GetHSteamPipe

  GetHSteamUser

  SteamAPI_GetHSteamPipe

  SteamAPI_GetHSteamUser

  SteamAPI_GetSteamInstallPath

  SteamAPI_ISteamAppList_GetAppBuildId

  SteamAPI_ISteamAppList_GetAppInstallDir

  SteamAPI_ISteamAppList_GetAppName

  SteamAPI_ISteamAppList_GetInstalledApps

  SteamAPI_ISteamAppList_GetNumInstalledApps

  SteamAPI_ISteamApps_BGetDLCDataByIndex

  SteamAPI_ISteamApps_BIsAppInstalled

  SteamAPI_ISteamApps_BIsCybercafe

  SteamAPI_ISteamApps_BIsDlcInstalled

  SteamAPI_ISteamApps_BIsLowViolence

  SteamAPI_ISteamApps_BIsSubscribed

  SteamAPI_ISteamApps_BIsSubscribedApp

  SteamAPI_ISteamApps_BIsSubscribedFromFamilySharing

  SteamAPI_ISteamApps_BIsSubscribedFromFreeWeekend

  SteamAPI_ISteamApps_BIsTimedTrial

  SteamAPI_ISteamApps_BIsVACBanned

  SteamAPI_ISteamApps_GetAppBuildId

  SteamAPI_ISteamApps_GetAppInstallDir

  SteamAPI_ISteamApps_GetAppOwner

  SteamAPI_ISteamApps_GetAvailableGameLanguages

  SteamAPI_ISteamApps_GetCurrentBetaName

  SteamAPI_ISteamApps_GetCurrentGameLanguage

  SteamAPI_ISteamApps_GetDLCCount

  SteamAPI_ISteamApps_GetDlcDownloadProgress

  SteamAPI_ISteamApps_GetEarliestPurchaseUnixTime

  SteamAPI_ISteamApps_GetFileDetails

  SteamAPI_ISteamApps_GetInstalledDepots

  SteamAPI_ISteamApps_GetLaunchCommandLine

  SteamAPI_ISteamApps_GetLaunchQueryParam

  SteamAPI_ISteamApps_InstallDLC

  SteamAPI_ISteamApps_MarkContentCorrupt

  SteamAPI_ISteamApps_RequestAllProofOfPurchaseKeys

  SteamAPI_ISteamApps_RequestAppProofOfPurchaseKey

  SteamAPI_ISteamApps_SetDlcContext

  SteamAPI_ISteamApps_UninstallDLC

  SteamAPI_ISteamClient_BReleaseSteamPipe

  SteamAPI_ISteamClient_BShutdownIfAllPipesClosed

  SteamAPI_ISteamClient_ConnectToGlobalUser

  SteamAPI_ISteamClient_CreateLocalUser

  SteamAPI_ISteamClient_CreateSteamPipe

  SteamAPI_ISteamClient_GetIPCCallCount

  SteamAPI_ISteamClient_GetISteamAppList

  SteamAPI_ISteamClient_GetISteamApps

  SteamAPI_ISteamClient_GetISteamController

  SteamAPI_ISteamClient_GetISteamFriends

  SteamAPI_ISteamClient_GetISteamGameSearch

  SteamAPI_ISteamClient_GetISteamGameServer

  SteamAPI_ISteamClient_GetISteamGameServerStats

  SteamAPI_ISteamClient_GetISteamGenericInterface

  SteamAPI_ISteamClient_GetISteamHTMLSurface

  SteamAPI_ISteamClient_GetISteamHTTP

  SteamAPI_ISteamClient_GetISteamInput

  SteamAPI_ISteamClient_GetISteamInventory

  SteamAPI_ISteamClient_GetISteamMatchmaking

  SteamAPI_ISteamClient_GetISteamMatchmakingServers

  SteamAPI_ISteamClient_GetISteamMusic

  SteamAPI_ISteamClient_GetISteamMusicRemote

  SteamAPI_ISteamClient_GetISteamNetworking

  SteamAPI_ISteamClient_GetISteamParentalSettings

  SteamAPI_ISteamClient_GetISteamParties

  SteamAPI_ISteamClient_GetISteamRemotePlay

  SteamAPI_ISteamClient_GetISteamRemoteStorage

  SteamAPI_ISteamClient_GetISteamScreenshots

  SteamAPI_ISteamClient_GetISteamUGC

  SteamAPI_ISteamClient_GetISteamUser

  SteamAPI_ISteamClient_GetISteamUserStats

  SteamAPI_ISteamClient_GetISteamUtils

  SteamAPI_ISteamClient_GetISteamVideo

  SteamAPI_ISteamClient_ReleaseUser

  SteamAPI_ISteamClient_SetLocalIPBinding

  SteamAPI_ISteamClient_SetWarningMessageHook

  SteamAPI_ISteamController_ActivateActionSet

  SteamAPI_ISteamController_ActivateActionSetLayer

  SteamAPI_ISteamController_DeactivateActionSetLayer

  SteamAPI_ISteamController_DeactivateAllActionSetLayers

  SteamAPI_ISteamController_GetActionOriginFromXboxOrigin

  SteamAPI_ISteamController_GetActionSetHandle

  SteamAPI_ISteamController_GetActiveActionSetLayers

  SteamAPI_ISteamController_GetAnalogActionData

  SteamAPI_ISteamController_GetAnalogActionHandle

  SteamAPI_ISteamController_GetAnalogActionOrigins

  SteamAPI_ISteamController_GetConnectedControllers

  SteamAPI_ISteamController_GetControllerBindingRevision

  SteamAPI_ISteamController_GetControllerForGamepadIndex

  SteamAPI_ISteamController_GetCurrentActionSet

  SteamAPI_ISteamController_GetDigitalActionData

  SteamAPI_ISteamController_GetDigitalActionHandle

  SteamAPI_ISteamController_GetDigitalActionOrigins

  SteamAPI_ISteamController_GetGamepadIndexForController

  SteamAPI_ISteamController_GetGlyphForActionOrigin

  SteamAPI_ISteamController_GetGlyphForXboxOrigin

  SteamAPI_ISteamController_GetInputTypeForHandle

  SteamAPI_ISteamController_GetMotionData

  SteamAPI_ISteamController_GetStringForActionOrigin

  SteamAPI_ISteamController_GetStringForXboxOrigin

  SteamAPI_ISteamController_Init

  SteamAPI_ISteamController_RunFrame

  SteamAPI_ISteamController_SetLEDColor

  SteamAPI_ISteamController_ShowBindingPanel

  SteamAPI_ISteamController_Shutdown

  SteamAPI_ISteamController_StopAnalogActionMomentum

  SteamAPI_ISteamController_TranslateActionOrigin

  SteamAPI_ISteamController_TriggerHapticPulse

  SteamAPI_ISteamController_TriggerRepeatedHapticPulse

  SteamAPI_ISteamController_TriggerVibration

  SteamAPI_ISteamFriends_ActivateGameOverlay

  SteamAPI_ISteamFriends_ActivateGameOverlayInviteDialog

  SteamAPI_ISteamFriends_ActivateGameOverlayInviteDialogConnectString

  SteamAPI_ISteamFriends_ActivateGameOverlayRemotePlayTogetherInviteDialog

  SteamAPI_ISteamFriends_ActivateGameOverlayToStore

  SteamAPI_ISteamFriends_ActivateGameOverlayToUser

  SteamAPI_ISteamFriends_ActivateGameOverlayToWebPage

  SteamAPI_ISteamFriends_BHasEquippedProfileItem

  SteamAPI_ISteamFriends_ClearRichPresence

  SteamAPI_ISteamFriends_CloseClanChatWindowInSteam

  SteamAPI_ISteamFriends_DownloadClanActivityCounts

  SteamAPI_ISteamFriends_EnumerateFollowingList

  SteamAPI_ISteamFriends_GetChatMemberByIndex

  SteamAPI_ISteamFriends_GetClanActivityCounts

  SteamAPI_ISteamFriends_GetClanByIndex

  SteamAPI_ISteamFriends_GetClanChatMemberCount

  SteamAPI_ISteamFriends_GetClanChatMessage

  SteamAPI_ISteamFriends_GetClanCount

  SteamAPI_ISteamFriends_GetClanName

  SteamAPI_ISteamFriends_GetClanOfficerByIndex

  SteamAPI_ISteamFriends_GetClanOfficerCount

  SteamAPI_ISteamFriends_GetClanOwner

  SteamAPI_ISteamFriends_GetClanTag

  SteamAPI_ISteamFriends_GetCoplayFriend

  SteamAPI_ISteamFriends_GetCoplayFriendCount

  SteamAPI_ISteamFriends_GetFollowerCount

  SteamAPI_ISteamFriends_GetFriendByIndex

  SteamAPI_ISteamFriends_GetFriendCoplayGame

  SteamAPI_ISteamFriends_GetFriendCoplayTime

  SteamAPI_ISteamFriends_GetFriendCount

  SteamAPI_ISteamFriends_GetFriendCountFromSource

  SteamAPI_ISteamFriends_GetFriendFromSourceByIndex

  SteamAPI_ISteamFriends_GetFriendGamePlayed

  SteamAPI_ISteamFriends_GetFriendMessage

  SteamAPI_ISteamFriends_GetFriendPersonaName

  SteamAPI_ISteamFriends_GetFriendPersonaNameHistory

  SteamAPI_ISteamFriends_GetFriendPersonaState

  SteamAPI_ISteamFriends_GetFriendRelationship

  SteamAPI_ISteamFriends_GetFriendRichPresence

  SteamAPI_ISteamFriends_GetFriendRichPresenceKeyByIndex

  SteamAPI_ISteamFriends_GetFriendRichPresenceKeyCount

  SteamAPI_ISteamFriends_GetFriendSteamLevel

  SteamAPI_ISteamFriends_GetFriendsGroupCount

  SteamAPI_ISteamFriends_GetFriendsGroupIDByIndex

  SteamAPI_ISteamFriends_GetFriendsGroupMembersCount

  SteamAPI_ISteamFriends_GetFriendsGroupMembersList

  SteamAPI_ISteamFriends_GetFriendsGroupName

  SteamAPI_ISteamFriends_GetLargeFriendAvatar

  SteamAPI_ISteamFriends_GetMediumFriendAvatar

  SteamAPI_ISteamFriends_GetNumChatsWithUnreadPriorityMessages

  SteamAPI_ISteamFriends_GetPersonaName

  SteamAPI_ISteamFriends_GetPersonaState

  SteamAPI_ISteamFriends_GetPlayerNickname

  SteamAPI_ISteamFriends_GetProfileItemPropertyString

  SteamAPI_ISteamFriends_GetProfileItemPropertyUint

  SteamAPI_ISteamFriends_GetSmallFriendAvatar

  SteamAPI_ISteamFriends_GetUserRestrictions

  SteamAPI_ISteamFriends_HasFriend

  SteamAPI_ISteamFriends_InviteUserToGame

  SteamAPI_ISteamFriends_IsClanChatAdmin

  SteamAPI_ISteamFriends_IsClanChatWindowOpenInSteam

  SteamAPI_ISteamFriends_IsClanOfficialGameGroup

  SteamAPI_ISteamFriends_IsClanPublic

  SteamAPI_ISteamFriends_IsFollowing

  SteamAPI_ISteamFriends_IsUserInSource

  SteamAPI_ISteamFriends_JoinClanChatRoom

  SteamAPI_ISteamFriends_LeaveClanChatRoom

  SteamAPI_ISteamFriends_OpenClanChatWindowInSteam

  SteamAPI_ISteamFriends_RegisterProtocolInOverlayBrowser

  SteamAPI_ISteamFriends_ReplyToFriendMessage

  SteamAPI_ISteamFriends_RequestClanOfficerList

  SteamAPI_ISteamFriends_RequestEquippedProfileItems

  SteamAPI_ISteamFriends_RequestFriendRichPresence

  SteamAPI_ISteamFriends_RequestUserInformation

  SteamAPI_ISteamFriends_SendClanChatMessage

  SteamAPI_ISteamFriends_SetInGameVoiceSpeaking

  SteamAPI_ISteamFriends_SetListenForFriendsMessages

  SteamAPI_ISteamFriends_SetPersonaName

  SteamAPI_ISteamFriends_SetPlayedWith

  SteamAPI_ISteamFriends_SetRichPresence

  SteamAPI_ISteamGameSearch_AcceptGame

  SteamAPI_ISteamGameSearch_AddGameSearchParams

  SteamAPI_ISteamGameSearch_CancelRequestPlayersForGame

  SteamAPI_ISteamGameSearch_DeclineGame

  SteamAPI_ISteamGameSearch_EndGame

  SteamAPI_ISteamGameSearch_EndGameSearch

  SteamAPI_ISteamGameSearch_HostConfirmGameStart

  SteamAPI_ISteamGameSearch_RequestPlayersForGame

  SteamAPI_ISteamGameSearch_RetrieveConnectionDetails

  SteamAPI_ISteamGameSearch_SearchForGameSolo

  SteamAPI_ISteamGameSearch_SearchForGameWithLobby

  SteamAPI_ISteamGameSearch_SetConnectionDetails

  SteamAPI_ISteamGameSearch_SetGameHostParams

  SteamAPI_ISteamGameSearch_SubmitPlayerResult

  SteamAPI_ISteamGameServerStats_ClearUserAchievement

  SteamAPI_ISteamGameServerStats_GetUserAchievement

  SteamAPI_ISteamGameServerStats_GetUserStatFloat

  SteamAPI_ISteamGameServerStats_GetUserStatInt32

  SteamAPI_ISteamGameServerStats_RequestUserStats

  SteamAPI_ISteamGameServerStats_SetUserAchievement

  SteamAPI_ISteamGameServerStats_SetUserStatFloat

  SteamAPI_ISteamGameServerStats_SetUserStatInt32

  SteamAPI_ISteamGameServerStats_StoreUserStats

  SteamAPI_ISteamGameServerStats_UpdateUserAvgRateStat

  SteamAPI_ISteamGameServer_AssociateWithClan

  SteamAPI_ISteamGameServer_BLoggedOn

  SteamAPI_ISteamGameServer_BSecure

  SteamAPI_ISteamGameServer_BUpdateUserData

  SteamAPI_ISteamGameServer_BeginAuthSession

  SteamAPI_ISteamGameServer_CancelAuthTicket

  SteamAPI_ISteamGameServer_ClearAllKeyValues

  SteamAPI_ISteamGameServer_ComputeNewPlayerCompatibility

  SteamAPI_ISteamGameServer_CreateUnauthenticatedUserConnection

  SteamAPI_ISteamGameServer_EndAuthSession

  SteamAPI_ISteamGameServer_GetAuthSessionTicket

  SteamAPI_ISteamGameServer_GetGameplayStats

  SteamAPI_ISteamGameServer_GetNextOutgoingPacket

  SteamAPI_ISteamGameServer_GetPublicIP

  SteamAPI_ISteamGameServer_GetServerReputation

  SteamAPI_ISteamGameServer_GetSteamID

  SteamAPI_ISteamGameServer_HandleIncomingPacket

  SteamAPI_ISteamGameServer_LogOff

  SteamAPI_ISteamGameServer_LogOn

  SteamAPI_ISteamGameServer_LogOnAnonymous

  SteamAPI_ISteamGameServer_RequestUserGroupStatus

  SteamAPI_ISteamGameServer_SendUserConnectAndAuthenticate_DEPRECATED

  SteamAPI_ISteamGameServer_SendUserDisconnect_DEPRECATED

  SteamAPI_ISteamGameServer_SetAdvertiseServerActive

  SteamAPI_ISteamGameServer_SetBotPlayerCount

  SteamAPI_ISteamGameServer_SetDedicatedServer

  SteamAPI_ISteamGameServer_SetGameData

  SteamAPI_ISteamGameServer_SetGameDescription

  SteamAPI_ISteamGameServer_SetGameTags

  SteamAPI_ISteamGameServer_SetKeyValue

  SteamAPI_ISteamGameServer_SetMapName

  SteamAPI_ISteamGameServer_SetMaxPlayerCount

  SteamAPI_ISteamGameServer_SetModDir

  SteamAPI_ISteamGameServer_SetPasswordProtected

  SteamAPI_ISteamGameServer_SetProduct

  SteamAPI_ISteamGameServer_SetRegion

  SteamAPI_ISteamGameServer_SetServerName

  SteamAPI_ISteamGameServer_SetSpectatorPort

  SteamAPI_ISteamGameServer_SetSpectatorServerName

  SteamAPI_ISteamGameServer_UserHasLicenseForApp

  SteamAPI_ISteamGameServer_WasRestartRequested

  SteamAPI_ISteamHTMLSurface_AddHeader

  SteamAPI_ISteamHTMLSurface_AllowStartRequest

  SteamAPI_ISteamHTMLSurface_CopyToClipboard

  SteamAPI_ISteamHTMLSurface_CreateBrowser

  SteamAPI_ISteamHTMLSurface_ExecuteJavascript

  SteamAPI_ISteamHTMLSurface_FileLoadDialogResponse

  SteamAPI_ISteamHTMLSurface_Find

  SteamAPI_ISteamHTMLSurface_GetLinkAtPosition

  SteamAPI_ISteamHTMLSurface_GoBack

  SteamAPI_ISteamHTMLSurface_GoForward

  SteamAPI_ISteamHTMLSurface_Init

  SteamAPI_ISteamHTMLSurface_JSDialogResponse

  SteamAPI_ISteamHTMLSurface_KeyChar

  SteamAPI_ISteamHTMLSurface_KeyDown

  SteamAPI_ISteamHTMLSurface_KeyUp

  SteamAPI_ISteamHTMLSurface_LoadURL

  SteamAPI_ISteamHTMLSurface_MouseDoubleClick

  SteamAPI_ISteamHTMLSurface_MouseDown

  SteamAPI_ISteamHTMLSurface_MouseMove

  SteamAPI_ISteamHTMLSurface_MouseUp

  SteamAPI_ISteamHTMLSurface_MouseWheel

  SteamAPI_ISteamHTMLSurface_OpenDeveloperTools

  SteamAPI_ISteamHTMLSurface_PasteFromClipboard

  SteamAPI_ISteamHTMLSurface_Reload

  SteamAPI_ISteamHTMLSurface_RemoveBrowser

  SteamAPI_ISteamHTMLSurface_SetBackgroundMode

  SteamAPI_ISteamHTMLSurface_SetCookie

  SteamAPI_ISteamHTMLSurface_SetDPIScalingFactor

  SteamAPI_ISteamHTMLSurface_SetHorizontalScroll

  SteamAPI_ISteamHTMLSurface_SetKeyFocus

  SteamAPI_ISteamHTMLSurface_SetPageScaleFactor

  SteamAPI_ISteamHTMLSurface_SetSize

  SteamAPI_ISteamHTMLSurface_SetVerticalScroll

  SteamAPI_ISteamHTMLSurface_Shutdown

  SteamAPI_ISteamHTMLSurface_StopFind

  SteamAPI_ISteamHTMLSurface_StopLoad

  SteamAPI_ISteamHTMLSurface_ViewSource

  SteamAPI_ISteamHTTP_CreateCookieContainer

  SteamAPI_ISteamHTTP_CreateHTTPRequest

  SteamAPI_ISteamHTTP_DeferHTTPRequest

  SteamAPI_ISteamHTTP_GetHTTPDownloadProgressPct

  SteamAPI_ISteamHTTP_GetHTTPRequestWasTimedOut

  SteamAPI_ISteamHTTP_GetHTTPResponseBodyData

  SteamAPI_ISteamHTTP_GetHTTPResponseBodySize

  SteamAPI_ISteamHTTP_GetHTTPResponseHeaderSize

  SteamAPI_ISteamHTTP_GetHTTPResponseHeaderValue

  SteamAPI_ISteamHTTP_GetHTTPStreamingResponseBodyData

  SteamAPI_ISteamHTTP_PrioritizeHTTPRequest

  SteamAPI_ISteamHTTP_ReleaseCookieContainer

  SteamAPI_ISteamHTTP_ReleaseHTTPRequest

  SteamAPI_ISteamHTTP_SendHTTPRequest

  SteamAPI_ISteamHTTP_SendHTTPRequestAndStreamResponse

  SteamAPI_ISteamHTTP_SetCookie

  SteamAPI_ISteamHTTP_SetHTTPRequestAbsoluteTimeoutMS

  SteamAPI_ISteamHTTP_SetHTTPRequestContextValue

  SteamAPI_ISteamHTTP_SetHTTPRequestCookieContainer

  SteamAPI_ISteamHTTP_SetHTTPRequestGetOrPostParameter

  SteamAPI_ISteamHTTP_SetHTTPRequestHeaderValue

  SteamAPI_ISteamHTTP_SetHTTPRequestNetworkActivityTimeout

  SteamAPI_ISteamHTTP_SetHTTPRequestRawPostBody

  SteamAPI_ISteamHTTP_SetHTTPRequestRequiresVerifiedCertificate

  SteamAPI_ISteamHTTP_SetHTTPRequestUserAgentInfo

  SteamAPI_ISteamInput_ActivateActionSet

  SteamAPI_ISteamInput_ActivateActionSetLayer

  SteamAPI_ISteamInput_BNewDataAvailable

  SteamAPI_ISteamInput_BWaitForData

  SteamAPI_ISteamInput_DeactivateActionSetLayer

  SteamAPI_ISteamInput_DeactivateAllActionSetLayers

  SteamAPI_ISteamInput_EnableActionEventCallbacks

  SteamAPI_ISteamInput_EnableDeviceCallbacks

  SteamAPI_ISteamInput_GetActionOriginFromXboxOrigin

  SteamAPI_ISteamInput_GetActionSetHandle

  SteamAPI_ISteamInput_GetActiveActionSetLayers

  SteamAPI_ISteamInput_GetAnalogActionData

  SteamAPI_ISteamInput_GetAnalogActionHandle

  SteamAPI_ISteamInput_GetAnalogActionOrigins

  SteamAPI_ISteamInput_GetConnectedControllers

  SteamAPI_ISteamInput_GetControllerForGamepadIndex

  SteamAPI_ISteamInput_GetCurrentActionSet

  SteamAPI_ISteamInput_GetDeviceBindingRevision

  SteamAPI_ISteamInput_GetDigitalActionData

  SteamAPI_ISteamInput_GetDigitalActionHandle

  SteamAPI_ISteamInput_GetDigitalActionOrigins

  SteamAPI_ISteamInput_GetGamepadIndexForController

  SteamAPI_ISteamInput_GetGlyphForActionOrigin_Legacy

  SteamAPI_ISteamInput_GetGlyphForXboxOrigin

  SteamAPI_ISteamInput_GetGlyphPNGForActionOrigin

  SteamAPI_ISteamInput_GetGlyphSVGForActionOrigin

  SteamAPI_ISteamInput_GetInputTypeForHandle

  SteamAPI_ISteamInput_GetMotionData

  SteamAPI_ISteamInput_GetRemotePlaySessionID

  SteamAPI_ISteamInput_GetSessionInputConfigurationSettings

  SteamAPI_ISteamInput_GetStringForActionOrigin

  SteamAPI_ISteamInput_GetStringForAnalogActionName

  SteamAPI_ISteamInput_GetStringForDigitalActionName

  SteamAPI_ISteamInput_GetStringForXboxOrigin

  SteamAPI_ISteamInput_Init

  SteamAPI_ISteamInput_Legacy_TriggerHapticPulse

  SteamAPI_ISteamInput_Legacy_TriggerRepeatedHapticPulse

  SteamAPI_ISteamInput_RunFrame

  SteamAPI_ISteamInput_SetDualSenseTriggerEffect

  SteamAPI_ISteamInput_SetInputActionManifestFilePath

  SteamAPI_ISteamInput_SetLEDColor

  SteamAPI_ISteamInput_ShowBindingPanel

  SteamAPI_ISteamInput_Shutdown

  SteamAPI_ISteamInput_StopAnalogActionMomentum

  SteamAPI_ISteamInput_TranslateActionOrigin

  SteamAPI_ISteamInput_TriggerSimpleHapticEvent

  SteamAPI_ISteamInput_TriggerVibration

  SteamAPI_ISteamInput_TriggerVibrationExtended

  SteamAPI_ISteamInventory_AddPromoItem

  SteamAPI_ISteamInventory_AddPromoItems

  SteamAPI_ISteamInventory_CheckResultSteamID

  SteamAPI_ISteamInventory_ConsumeItem

  SteamAPI_ISteamInventory_DeserializeResult

  SteamAPI_ISteamInventory_DestroyResult

  SteamAPI_ISteamInventory_ExchangeItems

  SteamAPI_ISteamInventory_GenerateItems

  SteamAPI_ISteamInventory_GetAllItems

  SteamAPI_ISteamInventory_GetEligiblePromoItemDefinitionIDs

  SteamAPI_ISteamInventory_GetItemDefinitionIDs

  SteamAPI_ISteamInventory_GetItemDefinitionProperty

  SteamAPI_ISteamInventory_GetItemPrice

  SteamAPI_ISteamInventory_GetItemsByID

  SteamAPI_ISteamInventory_GetItemsWithPrices

  SteamAPI_ISteamInventory_GetNumItemsWithPrices

  SteamAPI_ISteamInventory_GetResultItemProperty

  SteamAPI_ISteamInventory_GetResultItems

  SteamAPI_ISteamInventory_GetResultStatus

  SteamAPI_ISteamInventory_GetResultTimestamp

  SteamAPI_ISteamInventory_GrantPromoItems

  SteamAPI_ISteamInventory_InspectItem

  SteamAPI_ISteamInventory_LoadItemDefinitions

  SteamAPI_ISteamInventory_RemoveProperty

  SteamAPI_ISteamInventory_RequestEligiblePromoItemDefinitionsIDs

  SteamAPI_ISteamInventory_RequestPrices

  SteamAPI_ISteamInventory_SendItemDropHeartbeat

  SteamAPI_ISteamInventory_SerializeResult

  SteamAPI_ISteamInventory_SetPropertyBool

  SteamAPI_ISteamInventory_SetPropertyFloat

  SteamAPI_ISteamInventory_SetPropertyInt64

  SteamAPI_ISteamInventory_SetPropertyString

  SteamAPI_ISteamInventory_StartPurchase

  SteamAPI_ISteamInventory_StartUpdateProperties

  SteamAPI_ISteamInventory_SubmitUpdateProperties

  SteamAPI_ISteamInventory_TradeItems

  SteamAPI_ISteamInventory_TransferItemQuantity

  SteamAPI_ISteamInventory_TriggerItemDrop

  SteamAPI_ISteamMatchmakingPingResponse_ServerFailedToRespond

  SteamAPI_ISteamMatchmakingPingResponse_ServerResponded

  SteamAPI_ISteamMatchmakingPlayersResponse_AddPlayerToList

  SteamAPI_ISteamMatchmakingPlayersResponse_PlayersFailedToRespond

  SteamAPI_ISteamMatchmakingPlayersResponse_PlayersRefreshComplete

  SteamAPI_ISteamMatchmakingRulesResponse_RulesFailedToRespond

  SteamAPI_ISteamMatchmakingRulesResponse_RulesRefreshComplete

  SteamAPI_ISteamMatchmakingRulesResponse_RulesResponded

  SteamAPI_ISteamMatchmakingServerListResponse_RefreshComplete

  SteamAPI_ISteamMatchmakingServerListResponse_ServerFailedToRespond

  SteamAPI_ISteamMatchmakingServerListResponse_ServerResponded

  SteamAPI_ISteamMatchmakingServers_CancelQuery

  SteamAPI_ISteamMatchmakingServers_CancelServerQuery

  SteamAPI_ISteamMatchmakingServers_GetServerCount

  SteamAPI_ISteamMatchmakingServers_GetServerDetails

  SteamAPI_ISteamMatchmakingServers_IsRefreshing

  SteamAPI_ISteamMatchmakingServers_PingServer

  SteamAPI_ISteamMatchmakingServers_PlayerDetails

  SteamAPI_ISteamMatchmakingServers_RefreshQuery

  SteamAPI_ISteamMatchmakingServers_RefreshServer

  SteamAPI_ISteamMatchmakingServers_ReleaseRequest

  SteamAPI_ISteamMatchmakingServers_RequestFavoritesServerList

  SteamAPI_ISteamMatchmakingServers_RequestFriendsServerList

  SteamAPI_ISteamMatchmakingServers_RequestHistoryServerList

  SteamAPI_ISteamMatchmakingServers_RequestInternetServerList

  SteamAPI_ISteamMatchmakingServers_RequestLANServerList

  SteamAPI_ISteamMatchmakingServers_RequestSpectatorServerList

  SteamAPI_ISteamMatchmakingServers_ServerRules

  SteamAPI_ISteamMatchmaking_AddFavoriteGame

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListCompatibleMembersFilter

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListDistanceFilter

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListFilterSlotsAvailable

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListNearValueFilter

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListNumericalFilter

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListResultCountFilter

  SteamAPI_ISteamMatchmaking_AddRequestLobbyListStringFilter

  SteamAPI_ISteamMatchmaking_CreateLobby

  SteamAPI_ISteamMatchmaking_DeleteLobbyData

  SteamAPI_ISteamMatchmaking_GetFavoriteGame

  SteamAPI_ISteamMatchmaking_GetFavoriteGameCount

  SteamAPI_ISteamMatchmaking_GetLobbyByIndex

  SteamAPI_ISteamMatchmaking_GetLobbyChatEntry

  SteamAPI_ISteamMatchmaking_GetLobbyData

  SteamAPI_ISteamMatchmaking_GetLobbyDataByIndex

  SteamAPI_ISteamMatchmaking_GetLobbyDataCount

  SteamAPI_ISteamMatchmaking_GetLobbyGameServer

  SteamAPI_ISteamMatchmaking_GetLobbyMemberByIndex

  SteamAPI_ISteamMatchmaking_GetLobbyMemberData

  SteamAPI_ISteamMatchmaking_GetLobbyMemberLimit

  SteamAPI_ISteamMatchmaking_GetLobbyOwner

  SteamAPI_ISteamMatchmaking_GetNumLobbyMembers

  SteamAPI_ISteamMatchmaking_InviteUserToLobby

  SteamAPI_ISteamMatchmaking_JoinLobby

  SteamAPI_ISteamMatchmaking_LeaveLobby

  SteamAPI_ISteamMatchmaking_RemoveFavoriteGame

  SteamAPI_ISteamMatchmaking_RequestLobbyData

  SteamAPI_ISteamMatchmaking_RequestLobbyList

  SteamAPI_ISteamMatchmaking_SendLobbyChatMsg

  SteamAPI_ISteamMatchmaking_SetLinkedLobby

  SteamAPI_ISteamMatchmaking_SetLobbyData

  SteamAPI_ISteamMatchmaking_SetLobbyGameServer

  SteamAPI_ISteamMatchmaking_SetLobbyJoinable

  SteamAPI_ISteamMatchmaking_SetLobbyMemberData

  SteamAPI_ISteamMatchmaking_SetLobbyMemberLimit

  SteamAPI_ISteamMatchmaking_SetLobbyOwner

  SteamAPI_ISteamMatchmaking_SetLobbyType

  SteamAPI_ISteamMusicRemote_BActivationSuccess

  SteamAPI_ISteamMusicRemote_BIsCurrentMusicRemote

  SteamAPI_ISteamMusicRemote_CurrentEntryDidChange

  SteamAPI_ISteamMusicRemote_CurrentEntryIsAvailable

  SteamAPI_ISteamMusicRemote_CurrentEntryWillChange

  SteamAPI_ISteamMusicRemote_DeregisterSteamMusicRemote

  SteamAPI_ISteamMusicRemote_EnableLooped

  SteamAPI_ISteamMusicRemote_EnablePlayNext

  SteamAPI_ISteamMusicRemote_EnablePlayPrevious

  SteamAPI_ISteamMusicRemote_EnablePlaylists

  SteamAPI_ISteamMusicRemote_EnableQueue

  SteamAPI_ISteamMusicRemote_EnableShuffled

  SteamAPI_ISteamMusicRemote_PlaylistDidChange

  SteamAPI_ISteamMusicRemote_PlaylistWillChange

  SteamAPI_ISteamMusicRemote_QueueDidChange

  SteamAPI_ISteamMusicRemote_QueueWillChange

  SteamAPI_ISteamMusicRemote_RegisterSteamMusicRemote

  SteamAPI_ISteamMusicRemote_ResetPlaylistEntries

  SteamAPI_ISteamMusicRemote_ResetQueueEntries

  SteamAPI_ISteamMusicRemote_SetCurrentPlaylistEntry

  SteamAPI_ISteamMusicRemote_SetCurrentQueueEntry

  SteamAPI_ISteamMusicRemote_SetDisplayName

  SteamAPI_ISteamMusicRemote_SetPNGIcon_64x64

  SteamAPI_ISteamMusicRemote_SetPlaylistEntry

  SteamAPI_ISteamMusicRemote_SetQueueEntry

  SteamAPI_ISteamMusicRemote_UpdateCurrentEntryCoverArt

  SteamAPI_ISteamMusicRemote_UpdateCurrentEntryElapsedSeconds

  SteamAPI_ISteamMusicRemote_UpdateCurrentEntryText

  SteamAPI_ISteamMusicRemote_UpdateLooped

  SteamAPI_ISteamMusicRemote_UpdatePlaybackStatus

  SteamAPI_ISteamMusicRemote_UpdateShuffled

  Sections

  .text

  Size: 152KB - Virtual size: 151KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 109KB - Virtual size: 108KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/33da286e78538e3f5eda7b23c70578a1fda8a5b98069bd269b8a6035babe2b23.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  8a:39:98:03:df:27:d0:45:70:57:cf:10:84:ee:96:15:f9:2e:6f:29:00:0b:e2:cb:1b:64:e0:ad:f3:a1:00:12

  Signer

  Actual PE Digest

  8a:39:98:03:df:27:d0:45:70:57:cf:10:84:ee:96:15:f9:2e:6f:29:00:0b:e2:cb:1b:64:e0:ad:f3:a1:00:12

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\q07sak\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/33dcb751179a24196e7dbd47ab8ee254d839106b5ae5843bdf5e456b35ecedf7.exe

  .exe windows:1 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 106KB - Virtual size: 108KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/33e42e7828cda7987d17342e0eb8134f590cd3d291dbc75f13334259a4908ba1.exe

  .exe windows:6 windows x64 arch:x64

  6897e09add1836442c84d70f65d04a85

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetConsoleScreenBufferInfo

  SetConsoleCursorInfo

  GetConsoleCursorInfo

  SetConsoleOutputCP

  SetConsoleCtrlHandler

  GetConsoleOutputCP

  GetUserDefaultLCID

  GetSystemDefaultLCID

  GetCurrencyFormatW

  SetLocaleInfoW

  GetCPInfoExW

  IsValidCodePage

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetNumaProcessorNode

  SetVolumeMountPointW

  FindFirstVolumeMountPointW

  CopyFileExW

  CopyFileW

  BackupSeek

  BackupRead

  lstrcatW

  lstrcmpW

  GetTapeParameters

  GetTapeStatus

  PrepareTape

  GetTapePosition

  SetTapePosition

  ConvertFiberToThread

  GetProcessIoCounters

  GetCurrentProcess

  SetProcessAffinityMask

  GetNumaHighestNodeNumber

  QueryInformationJobObject

  AssignProcessToJobObject

  GetLogicalProcessorInformation

  GetProcessPriorityBoost

  SetPriorityClass

  TlsSetValue

  TlsGetValue

  GetThreadPriorityBoost

  GetCurrentThreadId

  WriteConsoleW

  CloseHandle

  CreateFileW

  GetConsoleMode

  FlushFileBuffers

  HeapReAlloc

  HeapSize

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  SetFileApisToANSI

  AreFileApisANSI

  UnlockFileEx

  SetFilePointerEx

  SetEndOfFile

  QueryDosDeviceW

  LockFileEx

  GetLongPathNameW

  GetFileSizeEx

  GetModuleHandleA

  GetExitCodeProcess

  GetStringTypeW

  GetFileType

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  FindNextFileW

  FindFirstFileExW

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  TerminateProcess

  ExitProcess

  GetModuleFileNameW

  WriteFile

  GetStdHandle

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  TlsFree

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetFileInformationByHandle

  GetFileAttributesExW

  FindClose

  DefineDosDeviceW

  GetCurrentDirectoryW

  SetStdHandle

  GetCurrentProcessId

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  gdi32

  SetWindowOrgEx

  GetKerningPairsW

  SetBrushOrgEx

  GetWinMetaFileBits

  PolylineTo

  Polygon

  LPtoDP

  PolyTextOutW

  StrokeAndFillPath

  SetArcDirection

  AbortPath

  SetWinMetaFileBits

  GetEnhMetaFileBits

  GdiTransparentBlt

  SetTextColor

  SetSystemPaletteUse

  SetMetaFileBitsEx

  SetMapMode

  SetDIBitsToDevice

  SetBkMode

  SetDCPenColor

  SaveDC

  PtVisible

  PtInRegion

  OffsetClipRgn

  MaskBlt

  GetWindowExtEx

  GetViewportOrgEx

  RemoveFontResourceExW

  GetGlyphIndicesW

  GetTextExtentExPointW

  GetTextAlign

  GetSystemPaletteUse

  GetSystemPaletteEntries

  GetMetaFileBitsEx

  GetCurrentPositionEx

  GetCharWidth32W

  GetCharWidthW

  EnumFontFamiliesW

  DrawEscape

  CreateBrushIndirect

  CancelDC

  BitBlt

  Arc

  AnimatePalette

  winspool.drv

  ConnectToPrinterDlg

  EnumPrintersW

  ResetPrinterW

  SetJobW

  GetJobW

  EnumJobsW

  SetPrinterW

  FlushPrinter

  GetPrinterDataW

  EnumPrinterDataW

  SetPrinterDataW

  SetPrinterDataExW

  GetFormW

  ConfigurePortW

  SetPortW

  comdlg32

  PrintDlgExW

  PrintDlgW

  ChooseFontW

  ReplaceTextW

  FindTextW

  ChooseColorW

  GetFileTitleW

  GetSaveFileNameW

  GetOpenFileNameW

  CommDlgExtendedError

  ole32

  StringFromIID

  CLSIDFromString

  CoEnableCallCancellation

  CoTestCancel

  CoCancelCall

  CoQueryAuthenticationServices

  CoQueryClientBlanket

  CoSetProxyBlanket

  IIDFromString

  CoGetInterfaceAndReleaseStream

  CoMarshalInterThreadInterfaceInStream

  CoGetStdMarshalEx

  CoLockObjectExternal

  CoDisconnectObject

  CoMarshalHresult

  CoUnmarshalInterface

  CoMarshalInterface

  CoGetMarshalSizeMax

  CoGetPSClsid

  CoResumeClassObjects

  CoGetObjectContext

  CoGetContextToken

  CoGetCurrentLogicalThreadId

  CoGetCurrentProcess

  CoUninitialize

  ProgIDFromCLSID

  CLSIDFromProgID

  CoInvalidateRemoteMachineBindings

  CLSIDFromProgIDEx

  CoGetInstanceFromIStorage

  CoAllowSetForegroundWindow

  CoIsOle1Class

  CoFileTimeToDosDateTime

  CoInstall

  BindMoniker

  MkParseDisplayName

  MonikerRelativePathTo

  GetClassFile

  OleGetIconOfClass

  OleSetAutoConvert

  CoGetInterceptor

  CoGetCallContext

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerInstallFileW

  VerFindFileW

  comctl32

  ord412

  ord410

  ord14

  ord15

  ord13

  PropertySheetW

  dxgi

  CreateDXGIFactory

  Sections

  .text

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 45KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/342a7c418f2125aee7a228634841450a97c0b0653c5f9217bd1bb0677a5b14db.exe

  .exe windows:4 windows x86 arch:x86

  59a4a44a250c4cf4f2d9de2b3fe5d95f

  
  

  Code Sign

  32:10:44:e0:73:99:00:1a:c8:94:e6:78:09:1b:11:30:91:7a:5e:af

  Certificate

  Issuer

  CN=Majestical Hurricano\ ,O=Emneomraadedefinitionen,L=Princetown,ST=England,C=GB

  Not Before

  11-06-2024 04:46

  Not After

  11-06-2027 04:46

  Subject

  CN=Majestical Hurricano\ ,O=Emneomraadedefinitionen,L=Princetown,ST=England,C=GB

  32:10:44:e0:73:99:00:1a:c8:94:e6:78:09:1b:11:30:91:7a:5e:af

  Certificate

  Issuer

  CN=Majestical Hurricano\ ,O=Emneomraadedefinitionen,L=Princetown,ST=England,C=GB

  Not Before

  11-06-2024 04:46

  Not After

  11-06-2027 04:46

  Subject

  CN=Majestical Hurricano\ ,O=Emneomraadedefinitionen,L=Princetown,ST=England,C=GB

  89:d6:0b:4b:ea:6b:0e:f8:5e:7b:40:dd:97:ca:73:59:6e:75:73:a7:27:22:e0:85:7f:79:4d:a8:42:c8:9b:5d

  Signer

  Actual PE Digest

  89:d6:0b:4b:ea:6b:0e:f8:5e:7b:40:dd:97:ca:73:59:6e:75:73:a7:27:22:e0:85:7f:79:4d:a8:42:c8:9b:5d

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  a4:cc:97:c7:2b:d3:01:08:a8:91:00:d9:23:10:1f:b3:ee:5b:82:65

  Signer

  Actual PE Digest

  a4:cc:97:c7:2b:d3:01:08:a8:91:00:d9:23:10:1f:b3:ee:5b:82:65

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetTickCount

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  SearchPathA

  GetShortPathNameA

  CreateFileA

  GetFileSize

  GetModuleFileNameA

  ReadFile

  GetCurrentProcess

  CopyFileA

  ExitProcess

  SetEnvironmentVariableA

  Sleep

  CloseHandle

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrlenA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  GetTempFileNameA

  lstrcpyA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  GetProcAddress

  GlobalAlloc

  CompareFileTime

  SetFileTime

  ExpandEnvironmentStringsA

  lstrcmpiA

  lstrcmpA

  WaitForSingleObject

  GlobalFree

  GetExitCodeProcess

  GetModuleHandleA

  GetTempPathA

  GetWindowsDirectoryA

  LoadLibraryExA

  FindFirstFileA

  FindNextFileA

  DeleteFileA

  SetFilePointer

  WriteFile

  FindClose

  WritePrivateProfileStringA

  MultiByteToWideChar

  MulDiv

  GetPrivateProfileStringA

  FreeLibrary

  user32

  CreateWindowExA

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  GetDC

  SystemParametersInfoA

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamA

  SetTimer

  GetDlgItem

  wsprintfA

  SetForegroundWindow

  ShowWindow

  IsWindow

  LoadImageA

  SetWindowLongA

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  EndPaint

  PostQuitMessage

  FindWindowExA

  SendMessageTimeoutA

  SetWindowTextA

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectA

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  advapi32

  RegCloseKey

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegEnumValueA

  RegCreateKeyExA

  RegSetValueExA

  RegQueryValueExA

  RegEnumKeyA

  comctl32

  ImageList_Create

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ole32

  CoCreateInstance

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 76KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/34918278f6eb6b5e3afa8da406eb3c5a4cc3b7c4a1cee55320fecdbef4e0a463.exe

  .exe windows:6 windows x64 arch:x64

  d7fa2572888c8bf82e5ce063fb4df4c4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  FindClose

  GetModuleHandleExW

  TerminateProcess

  ExitProcess

  GetCurrentProcess

  WriteFile

  GetStdHandle

  RaiseException

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  HeapSize

  HeapReAlloc

  FlushFileBuffers

  GetConsoleCP

  GetConsoleMode

  SetFilePointerEx

  CreateFileW

  WriteConsoleW

  lstrlenW

  GetModuleHandleA

  GetModuleFileNameW

  CreateEventA

  WaitForSingleObject

  GetProcessHeap

  HeapFree

  HeapAlloc

  HeapDestroy

  HeapCreate

  FindNextFileW

  CloseHandle

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  user32

  GetClassInfoW

  DeleteMenu

  DefMDIChildProcW

  CharUpperBuffW

  SetMenuItemInfoW

  GetDlgCtrlID

  DispatchMessageW

  GetDCEx

  GetClassInfoExW

  ShowWindow

  DestroyWindow

  IsDialogMessageW

  LoadCursorW

  CreateAcceleratorTableW

  PeekMessageW

  CreateWindowExW

  RegisterClassW

  IsIconic

  GetSystemMenu

  EnableWindow

  FrameRect

  LoadStringW

  IsZoomed

  LoadBitmapW

  GetMenuItemInfoW

  MsgWaitForMultipleObjectsEx

  GetCursor

  ShowCaret

  PostMessageW

  CreateIcon

  GetClientRect

  GetWindowTextW

  CreateMenu

  DrawMenuBar

  CopyImage

  FillRect

  DefFrameProcW

  EndPaint

  GetScrollPos

  SetScrollPos

  GetMenuStringW

  DestroyIcon

  DrawFocusRect

  BeginPaint

  ReleaseDC

  KillTimer

  EndMenu

  InsertMenuW

  DestroyCursor

  SetTimer

  GetScrollInfo

  DestroyMenu

  GetScrollRange

  LoadIconW

  DrawIcon

  gdi32

  GetEnhMetaFileHeader

  CreateCompatibleBitmap

  Polygon

  SetAbortProc

  RectVisible

  SetBkMode

  CreateICW

  CreateSolidBrush

  PolyBezierTo

  RoundRect

  SetTextColor

  CreateDCW

  GetWindowOrgEx

  RestoreDC

  StretchBlt

  CreatePalette

  MoveToEx

  SetRectRgn

  AngleArc

  GetTextMetricsW

  Pie

  GetStockObject

  ole32

  CoTaskMemFree

  IsEqualGUID

  CoUninitialize

  CoInitialize

  OleInitialize

  CoTaskMemAlloc

  OleUninitialize

  CoCreateInstance

  oleaut32

  SysFreeString

  SafeArrayGetElement

  SafeArrayCreate

  SafeArrayPtrOfIndex

  GetErrorInfo

  SafeArrayGetUBound

  SysAllocStringLen

  VariantCopyInd

  SysReAllocStringLen

  SafeArrayPutElement

  VariantInit

  SafeArrayGetLBound

  VariantClear

  VariantChangeType

  SafeArrayAccessData

  SafeArrayUnaccessData

  VariantCopy

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  Sections

  .text

  Size: 384KB - Virtual size: 383KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .textbss

  Size: - Virtual size: 64KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3495194a65368179d60d72d6864361695a493fab82cff1c862c964949a677f42.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 327KB - Virtual size: 326KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/34e2b621f15ad4747c7e3dde2be3617841ffacba203b93fd2ff3256b914240f7.exe

  .exe windows:5 windows x86 arch:x86

  80af665d041a9ba06ab9c03956097116

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  winspool.drv

  DocumentPropertiesW

  ClosePrinter

  OpenPrinterW

  GetDefaultPrinterW

  EnumPrintersW

  comctl32

  ImageList_GetImageInfo

  FlatSB_SetScrollInfo

  InitCommonControls

  ImageList_DragMove

  ImageList_Destroy

  _TrackMouseEvent

  ImageList_DragShowNolock

  ImageList_Add

  FlatSB_SetScrollProp

  ImageList_GetDragImage

  ImageList_Create

  ImageList_EndDrag

  ImageList_DrawEx

  ImageList_SetImageCount

  FlatSB_GetScrollPos

  FlatSB_SetScrollPos

  InitializeFlatSB

  ImageList_Copy

  FlatSB_GetScrollInfo

  ImageList_Write

  ImageList_SetBkColor

  ImageList_GetBkColor

  ImageList_BeginDrag

  ImageList_GetIcon

  ImageList_Replace

  ImageList_GetImageCount

  ImageList_DragEnter

  ImageList_GetIconSize

  ImageList_SetIconSize

  ImageList_Read

  ImageList_DragLeave

  ImageList_LoadImageW

  ImageList_Draw

  ImageList_Remove

  ImageList_ReplaceIcon

  ImageList_SetOverlayImage

  shell32

  Shell_NotifyIconW

  SHFileOperationW

  ShellExecuteExW

  user32

  CopyImage

  SetMenuItemInfoW

  GetMenuItemInfoW

  DefFrameProcW

  GetDlgCtrlID

  FrameRect

  RegisterWindowMessageW

  GetMenuStringW

  FillRect

  SendMessageA

  IsClipboardFormatAvailable

  EnumWindows

  ShowOwnedPopups

  GetClassInfoW

  GetScrollRange

  SetActiveWindow

  GetActiveWindow

  DrawEdge

  GetKeyboardLayoutList

  LoadBitmapW

  EnumChildWindows

  GetScrollBarInfo

  UnhookWindowsHookEx

  SetCapture

  GetCapture

  ShowCaret

  CreatePopupMenu

  GetMenuItemID

  CharLowerBuffW

  PostMessageW

  SetWindowLongW

  IsZoomed

  SetParent

  DrawMenuBar

  InvalidateRgn

  GetClientRect

  IsChild

  IsIconic

  CallNextHookEx

  ShowWindow

  GetWindowTextW

  SetForegroundWindow

  IsDialogMessageW

  DestroyWindow

  RegisterClassW

  EndMenu

  CharNextW

  GetFocus

  GetDC

  SetFocus

  ReleaseDC

  GetClassLongW

  SetScrollRange

  DrawTextW

  PeekMessageA

  MessageBeep

  SetClassLongW

  RemovePropW

  GetSubMenu

  DestroyIcon

  IsWindowVisible

  DispatchMessageA

  UnregisterClassW

  GetTopWindow

  SendMessageW

  LoadStringW

  CreateMenu

  CharLowerW

  SetWindowRgn

  SetWindowPos

  GetMenuItemCount

  GetSysColorBrush

  GetWindowDC

  DrawTextExW

  CharLowerBuffA

  EnumClipboardFormats

  GetScrollInfo

  SetWindowTextW

  GetMessageExtraInfo

  GetSysColor

  EnableScrollBar

  TrackPopupMenu

  DrawIconEx

  GetClassNameW

  GetMessagePos

  GetIconInfo

  SetScrollInfo

  GetKeyNameTextW

  GetDesktopWindow

  SetCursorPos

  GetCursorPos

  SetMenu

  GetMenuState

  GetMenu

  UnregisterHotKey

  SetRect

  GetKeyState

  GetCursor

  KillTimer

  BeginDeferWindowPos

  WaitMessage

  TranslateMDISysAccel

  GetWindowPlacement

  CreateWindowExW

  ChildWindowFromPoint

  GetDCEx

  PeekMessageW

  MonitorFromWindow

  MessageBoxA

  SetTimer

  WindowFromPoint

  BeginPaint

  RegisterClipboardFormatW

  MapVirtualKeyW

  IsWindowUnicode

  DispatchMessageW

  CreateAcceleratorTableW

  DefMDIChildProcW

  GetSystemMenu

  SetScrollPos

  GetScrollPos

  IsCharAlphaNumericA

  DrawFocusRect

  ReleaseCapture

  LoadCursorW

  ScrollWindow

  GetLastActivePopup

  GetSystemMetrics

  CharUpperBuffW

  SetClipboardData

  GetClipboardData

  ClientToScreen

  SetWindowPlacement

  GetMonitorInfoW

  CheckMenuItem

  CharUpperW

  DefWindowProcW

  GetForegroundWindow

  EnableWindow

  GetWindowThreadProcessId

  RedrawWindow

  EndPaint

  MsgWaitForMultipleObjectsEx

  LoadKeyboardLayoutW

  ActivateKeyboardLayout

  GetParent

  MonitorFromRect

  InsertMenuItemW

  GetPropW

  MessageBoxW

  SetPropW

  UpdateWindow

  MsgWaitForMultipleObjects

  DestroyMenu

  SetWindowsHookExW

  EmptyClipboard

  AdjustWindowRectEx

  IsWindow

  DrawIcon

  EnumThreadWindows

  InvalidateRect

  GetKeyboardState

  ScreenToClient

  DrawFrameControl

  IsCharAlphaNumericW

  SetCursor

  CreateIcon

  RemoveMenu

  GetKeyboardLayoutNameW

  OpenClipboard

  TranslateMessage

  MapWindowPoints

  EnumDisplayMonitors

  CountClipboardFormats

  CallWindowProcW

  CloseClipboard

  DestroyCursor

  CopyIcon

  CharUpperBuffA

  PostQuitMessage

  ShowScrollBar

  EnableMenuItem

  DeferWindowPos

  HideCaret

  EndDeferWindowPos

  FindWindowExW

  MonitorFromPoint

  LoadIconW

  SystemParametersInfoW

  GetWindow

  GetWindowRect

  GetWindowLongW

  InsertMenuW

  IsWindowEnabled

  IsDialogMessageA

  FindWindowW

  GetKeyboardLayout

  DeleteMenu

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  VerQueryValueA

  GetFileVersionInfoW

  oleaut32

  SafeArrayPutElement

  GetErrorInfo

  VariantInit

  VariantClear

  SysFreeString

  SafeArrayAccessData

  SysReAllocStringLen

  SafeArrayCreate

  SafeArrayGetElement

  SysAllocStringLen

  SafeArrayUnaccessData

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetUBound

  SafeArrayGetLBound

  VariantCopyInd

  VariantChangeType

  advapi32

  RegSetValueExW

  CloseServiceHandle

  ControlService

  RegConnectRegistryW

  GetUserNameW

  RegQueryInfoKeyW

  RegUnLoadKeyW

  RegSaveKeyW

  RegReplaceKeyW

  RegCreateKeyExW

  OpenServiceW

  RegLoadKeyW

  RegEnumKeyExW

  QueryServiceStatus

  RegDeleteKeyW

  RegOpenKeyExA

  RegOpenKeyExW

  RegDeleteValueW

  RegFlushKey

  RegQueryValueExA

  RegQueryValueExW

  RegEnumValueW

  RegCloseKey

  RegRestoreKeyW

  netapi32

  NetWkstaGetInfo

  NetApiBufferFree

  msvcrt

  memcpy

  memset

  kernel32

  SetFileAttributesW

  GetFileType

  SetFileTime

  QueryDosDeviceW

  GetACP

  GetExitCodeProcess

  GetStringTypeExW

  CloseHandle

  LocalFree

  GetCurrentProcessId

  SizeofResource

  VirtualProtect

  TerminateThread

  QueryPerformanceFrequency

  IsDebuggerPresent

  FindNextFileW

  GetFullPathNameW

  VirtualFree

  HeapAlloc

  ExitProcess

  GetCPInfoExW

  GlobalSize

  GetSystemTime

  RtlUnwind

  GetCPInfo

  EnumSystemLocalesW

  GetStdHandle

  GetTimeZoneInformation

  SystemTimeToTzSpecificLocalTime

  GetModuleHandleW

  FreeLibrary

  TryEnterCriticalSection

  HeapDestroy

  CompareFileTime

  ReadFile

  DosDateTimeToFileTime

  HeapSize

  GetLastError

  GetModuleFileNameW

  SetLastError

  GlobalAlloc

  GlobalUnlock

  FindResourceW

  CreateThread

  CompareStringW

  MapViewOfFile

  LoadLibraryA

  GetVolumeInformationW

  ResetEvent

  MulDiv

  FreeResource

  GetDriveTypeW

  GetVersion

  RaiseException

  MoveFileW

  GlobalAddAtomW

  GetSystemTimeAsFileTime

  FormatMessageW

  OpenProcess

  SwitchToThread

  GetExitCodeThread

  OutputDebugStringW

  GetCurrentThread

  LocalFileTimeToFileTime

  GetFileAttributesExW

  LoadLibraryExW

  TerminateProcess

  LockResource

  FileTimeToSystemTime

  GetCurrentThreadId

  UnhandledExceptionFilter

  MoveFileExW

  GlobalFindAtomW

  VirtualQuery

  GlobalFree

  VirtualQueryEx

  Sleep

  EnterCriticalSection

  SetFilePointer

  FlushFileBuffers

  GetStringTypeExA

  LoadResource

  SuspendThread

  GetTickCount

  WaitForMultipleObjects

  GetFileSize

  GlobalDeleteAtom

  GetStartupInfoW

  GetFileAttributesW

  InitializeCriticalSection

  GetThreadPriority

  GetCurrentProcess

  GlobalLock

  SetThreadPriority

  VirtualAlloc

  GetCommandLineW

  GetSystemInfo

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  GetLogicalDriveStringsW

  GetVersionExW

  GetModuleHandleA

  VerifyVersionInfoW

  HeapCreate

  GetDiskFreeSpaceW

  VerSetConditionMask

  FindFirstFileW

  GetUserDefaultUILanguage

  GetConsoleOutputCP

  UnmapViewOfFile

  GetConsoleCP

  GetModuleFileNameA

  lstrlenW

  CompareStringA

  SetEndOfFile

  QueryPerformanceCounter

  lstrcmpW

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  GetLocaleInfoW

  CreateFileW

  EnumResourceNamesW

  DeleteFileW

  MoveFileA

  IsDBCSLeadByteEx

  GetEnvironmentVariableW

  GetLocalTime

  WaitForSingleObject

  WriteFile

  CreateFileMappingW

  ExitThread

  DeleteCriticalSection

  GetDateFormatW

  TlsGetValue

  SetErrorMode

  GetComputerNameW

  IsValidLocale

  TlsSetValue

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  RemoveDirectoryW

  CreateEventW

  WaitForMultipleObjectsEx

  GetThreadLocale

  SetThreadLocale

  ole32

  IsEqualGUID

  OleInitialize

  OleUninitialize

  CoInitialize

  CoCreateInstance

  CoUninitialize

  CoTaskMemFree

  CoTaskMemAlloc

  gdi32

  Pie

  SetBkMode

  CreateCompatibleBitmap

  GetEnhMetaFileHeader

  RectVisible

  AngleArc

  SetAbortProc

  SetTextColor

  StretchBlt

  RoundRect

  SelectClipRgn

  RestoreDC

  SetRectRgn

  GetTextMetricsW

  GetWindowOrgEx

  CreatePalette

  PolyBezierTo

  CreateICW

  CreateDCW

  GetStockObject

  CreateSolidBrush

  GetBkMode

  Polygon

  MoveToEx

  PlayEnhMetaFile

  Ellipse

  StartPage

  GetBitmapBits

  StartDocW

  AbortDoc

  GetSystemPaletteEntries

  GetEnhMetaFileBits

  GetEnhMetaFilePaletteEntries

  CreatePenIndirect

  CreateFontIndirectW

  PolyBezier

  EndDoc

  GetObjectW

  GetWinMetaFileBits

  SetROP2

  GetEnhMetaFileDescriptionW

  ArcTo

  Arc

  SelectPalette

  ExcludeClipRect

  MaskBlt

  SetWindowOrgEx

  EndPage

  DeleteEnhMetaFile

  Chord

  SetDIBits

  SetViewportOrgEx

  CreateRectRgn

  RealizePalette

  SetDIBColorTable

  GetDIBColorTable

  CreateBrushIndirect

  PatBlt

  SetEnhMetaFileBits

  Rectangle

  SaveDC

  DeleteDC

  FrameRgn

  BitBlt

  GetDeviceCaps

  GetTextExtentPoint32W

  GetClipBox

  IntersectClipRect

  Polyline

  CreateBitmap

  SetWinMetaFileBits

  CombineRgn

  GetStretchBltMode

  CreateDIBitmap

  SetStretchBltMode

  GetDIBits

  CreateDIBSection

  LineTo

  GetRgnBox

  EnumFontsW

  CreateHalftonePalette

  SelectObject

  DeleteObject

  ExtFloodFill

  UnrealizeObject

  CopyEnhMetaFileW

  SetBkColor

  CreateCompatibleDC

  GetBrushOrgEx

  GetCurrentPositionEx

  GetTextExtentPointW

  ExtTextOutW

  SetBrushOrgEx

  GetPixel

  GdiFlush

  SetPixel

  EnumFontFamiliesExW

  StretchDIBits

  GetPaletteEntries

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 34KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 897KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 96B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 93B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 268KB - Virtual size: 268KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/35005932465ca51b1bffcd168dd6c9386dbdecb78efacfbe4877b9b1e65da8b4.exe

  .exe windows:6 windows x86 arch:x86

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 4.3MB - Virtual size: 4.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7.8MB - Virtual size: 7.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 256KB - Virtual size: 577KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  /4

  Size: 512B - Virtual size: 297B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 591KB - Virtual size: 591KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /32

  Size: 107KB - Virtual size: 106KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /46

  Size: 512B - Virtual size: 48B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /65

  Size: 1.1MB - Virtual size: 1.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /78

  Size: 763KB - Virtual size: 763KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /90

  Size: 215KB - Virtual size: 214KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 223KB - Virtual size: 222KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 564KB - Virtual size: 564KB

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 202KB - Virtual size: 202KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/356108c722dbfed7782c279d388601706606ef10915929bc0c0732aa9b4e9cea.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 540KB - Virtual size: 539KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/357ef9cb624718fe978e70761284731ab2e7d5b3ae278b72de36faa14ba7a3f9.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 38KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 241KB - Virtual size: 240KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 906KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/35cff2b48d10ff7ed2cafae09a39e95b0c09dcab5a152377df6b0e361f4ba729.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 346KB - Virtual size: 345KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3734acf3b4ea01abe76869973f9794f3c75a91f8b00f580afa9f9d26d5cf7984.exe

  .exe windows:6 windows x64 arch:x64

  18e6cfb07c24126434da95227f10463b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  wininet

  InternetCloseHandle

  InternetReadFile

  InternetOpenW

  InternetOpenUrlW

  winspool.drv

  DocumentPropertiesW

  ClosePrinter

  OpenPrinterW

  GetDefaultPrinterW

  EnumPrintersW

  comdlg32

  FindTextW

  ChooseFontW

  ChooseColorW

  GetSaveFileNameW

  GetOpenFileNameW

  comctl32

  ImageList_GetImageInfo

  FlatSB_SetScrollInfo

  InitCommonControls

  ImageList_DragMove

  ImageList_Destroy

  _TrackMouseEvent

  ImageList_DragShowNolock

  ImageList_Add

  FlatSB_SetScrollProp

  ImageList_GetDragImage

  ImageList_Create

  ImageList_EndDrag

  ImageList_DrawEx

  ImageList_SetImageCount

  FlatSB_GetScrollPos

  FlatSB_SetScrollPos

  InitializeFlatSB

  ImageList_Copy

  FlatSB_GetScrollInfo

  ImageList_Write

  ImageList_DrawIndirect

  ImageList_SetBkColor

  ImageList_GetBkColor

  ImageList_BeginDrag

  ImageList_GetIcon

  ImageList_Replace

  ImageList_GetImageCount

  ImageList_DragEnter

  ImageList_GetIconSize

  ImageList_SetIconSize

  ImageList_Read

  ImageList_DragLeave

  ImageList_LoadImageW

  ImageList_Draw

  ImageList_Remove

  ImageList_ReplaceIcon

  ImageList_SetOverlayImage

  shell32

  Shell_NotifyIconW

  SHAppBarMessage

  user32

  MoveWindow

  CopyImage

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetCaretPos

  GetCaretPos

  DefFrameProcW

  ScrollWindowEx

  GetDlgCtrlID

  FrameRect

  RegisterWindowMessageW

  GetMenuStringW

  FillRect

  SendMessageA

  IsClipboardFormatAvailable

  EnumWindows

  ShowOwnedPopups

  GetClassInfoExW

  GetClassInfoW

  GetScrollRange

  SetActiveWindow

  GetActiveWindow

  DrawEdge

  GetKeyboardLayoutList

  LoadBitmapW

  EnumChildWindows

  GetScrollBarInfo

  UnhookWindowsHookEx

  SetCapture

  GetCapture

  ShowCaret

  CreatePopupMenu

  GetMenuItemID

  DestroyCaret

  CharLowerBuffW

  PostMessageW

  IsZoomed

  SetParent

  DrawMenuBar

  GetClientRect

  IsChild

  SendDlgItemMessageW

  IsIconic

  CallNextHookEx

  ShowWindow

  SetForegroundWindow

  GetWindowTextW

  IsDialogMessageW

  DestroyWindow

  RegisterClassW

  EndMenu

  CharNextW

  GetFocus

  GetDC

  SetFocus

  ReleaseDC

  SetScrollRange

  DrawTextW

  PeekMessageA

  MessageBeep

  RemovePropW

  GetSubMenu

  DestroyIcon

  IsWindowVisible

  PtInRect

  DispatchMessageA

  UnregisterClassW

  GetTopWindow

  SendMessageW

  GetMessageTime

  GetComboBoxInfo

  GetWindowLongPtrW

  SetWindowLongPtrW

  LoadStringW

  CreateMenu

  CharLowerW

  SetWindowRgn

  SetWindowPos

  GetMenuItemCount

  GetSysColorBrush

  GetWindowDC

  DrawTextExW

  EnumClipboardFormats

  GetScrollInfo

  SetWindowTextW

  GetMessageExtraInfo

  GetSysColor

  EnableScrollBar

  TrackPopupMenu

  DrawIconEx

  GetClassNameW

  GetMessagePos

  GetIconInfo

  SetScrollInfo

  GetKeyNameTextW

  GetDesktopWindow

  SetCursorPos

  GetCursorPos

  SetMenu

  GetMenuState

  GetMenu

  SetRect

  GetKeyState

  IsRectEmpty

  ValidateRect

  IsCharAlphaW

  GetCursor

  KillTimer

  WaitMessage

  TranslateMDISysAccel

  GetWindowPlacement

  GetMenuItemRect

  CreateIconIndirect

  CreateWindowExW

  GetDCEx

  PeekMessageW

  MonitorFromWindow

  GetUpdateRect

  SetTimer

  WindowFromPoint

  BeginPaint

  RegisterClipboardFormatW

  MapVirtualKeyW

  OffsetRect

  IsWindowUnicode

  DispatchMessageW

  CreateAcceleratorTableW

  DefMDIChildProcW

  GetSystemMenu

  SetScrollPos

  GetScrollPos

  InflateRect

  DrawFocusRect

  ReleaseCapture

  LoadCursorW

  ScrollWindow

  GetLastActivePopup

  GetSystemMetrics

  CharUpperBuffW

  SetClassLongPtrW

  GetClassLongPtrW

  ClientToScreen

  SetClipboardData

  GetClipboardData

  SetWindowPlacement

  GetMonitorInfoW

  CheckMenuItem

  CharUpperW

  DefWindowProcW

  GetForegroundWindow

  EnableWindow

  GetWindowThreadProcessId

  RedrawWindow

  EndPaint

  MsgWaitForMultipleObjectsEx

  LoadKeyboardLayoutW

  ActivateKeyboardLayout

  GetParent

  CreateCaret

  MonitorFromRect

  InsertMenuItemW

  GetPropW

  MessageBoxW

  SetPropW

  UpdateWindow

  MsgWaitForMultipleObjects

  DestroyMenu

  SetWindowsHookExW

  GetDoubleClickTime

  EmptyClipboard

  GetDlgItem

  AdjustWindowRectEx

  IsWindow

  DrawIcon

  EnumThreadWindows

  InvalidateRect

  SetKeyboardState

  GetKeyboardState

  ScreenToClient

  DrawFrameControl

  IsCharAlphaNumericW

  BringWindowToTop

  SetCursor

  CreateIcon

  RemoveMenu

  GetKeyboardLayoutNameW

  OpenClipboard

  TranslateMessage

  MapWindowPoints

  EnumDisplayMonitors

  CallWindowProcW

  CountClipboardFormats

  CloseClipboard

  DestroyCursor

  CopyIcon

  PostQuitMessage

  ShowScrollBar

  EnableMenuItem

  HideCaret

  FindWindowExW

  MonitorFromPoint

  LoadIconW

  SystemParametersInfoW

  GetWindow

  GetWindowRect

  InsertMenuW

  IsWindowEnabled

  IsDialogMessageA

  FindWindowW

  GetKeyboardLayout

  DeleteMenu

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  oleaut32

  SafeArrayPutElement

  GetErrorInfo

  VariantInit

  VariantClear

  SysFreeString

  SafeArrayAccessData

  SysReAllocStringLen

  SafeArrayCreate

  SafeArrayGetElement

  SysAllocStringLen

  SafeArrayUnaccessData

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetUBound

  SafeArrayGetLBound

  VariantChangeType

  advapi32

  RegSetValueExW

  RegConnectRegistryW

  RegEnumKeyExW

  RegLoadKeyW

  RegDeleteKeyW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegUnLoadKeyW

  RegSaveKeyW

  RegDeleteValueW

  RegReplaceKeyW

  RegFlushKey

  RegQueryValueExW

  RegEnumValueW

  RegCloseKey

  RegCreateKeyExW

  RegRestoreKeyW

  msvcrt

  memcpy

  memset

  kernel32

  GetFileType

  RtlUnwindEx

  GetACP

  CloseHandle

  LocalFree

  GetCurrentProcessId

  SizeofResource

  QueryPerformanceFrequency

  IsDebuggerPresent

  GetFullPathNameW

  VirtualFree

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  GlobalSize

  RtlUnwind

  GetCPInfo

  EnumSystemLocalesW

  GetStdHandle

  GetModuleHandleW

  FreeLibrary

  TryEnterCriticalSection

  HeapDestroy

  ReadFile

  GetLastError

  GetModuleFileNameW

  SetLastError

  GlobalAlloc

  GlobalUnlock

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  MulDiv

  FreeResource

  GetVersion

  RaiseException

  GlobalAddAtomW

  FormatMessageW

  SwitchToThread

  GetExitCodeThread

  OutputDebugStringW

  GetCurrentThread

  LoadLibraryExW

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  GlobalFindAtomW

  VirtualQueryEx

  GlobalFree

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetFileSize

  GetStartupInfoW

  GlobalDeleteAtom

  GetFileAttributesW

  InitializeCriticalSection

  GetThreadPriority

  GetCurrentProcess

  SetThreadPriority

  GlobalLock

  VirtualAlloc

  GetCommandLineW

  GetSystemInfo

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  WinExec

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  LCMapStringW

  GetDiskFreeSpaceW

  VerSetConditionMask

  FindFirstFileW

  GetUserDefaultUILanguage

  GetConsoleOutputCP

  GetConsoleCP

  lstrlenW

  SetEndOfFile

  QueryPerformanceCounter

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  GetLocaleInfoW

  CreateFileW

  EnumResourceNamesW

  IsDBCSLeadByteEx

  GetLocalTime

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  GetDateFormatW

  TlsGetValue

  SetErrorMode

  IsValidLocale

  TlsSetValue

  CreateDirectoryW

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  CreateEventW

  WaitForMultipleObjectsEx

  SetThreadLocale

  GetThreadLocale

  ole32

  IsEqualGUID

  OleInitialize

  OleUninitialize

  CoInitialize

  CoCreateInstance

  CoUninitialize

  CoTaskMemFree

  CoTaskMemAlloc

  gdi32

  Pie

  SetBkMode

  CreateCompatibleBitmap

  GetEnhMetaFileHeader

  CloseEnhMetaFile

  RectVisible

  AngleArc

  SetAbortProc

  SetTextColor

  GetTextColor

  StretchBlt

  RoundRect

  RestoreDC

  SetRectRgn

  GetTextMetricsW

  GetWindowOrgEx

  CreatePalette

  CreateDCW

  PolyBezierTo

  CreateICW

  GetStockObject

  CreateSolidBrush

  GetBkMode

  Polygon

  MoveToEx

  PlayEnhMetaFile

  Ellipse

  StartPage

  GetBitmapBits

  StartDocW

  AbortDoc

  GetSystemPaletteEntries

  GetEnhMetaFileBits

  GetEnhMetaFilePaletteEntries

  CreatePenIndirect

  SetMapMode

  CreateFontIndirectW

  PolyBezier

  ExtCreatePen

  EndDoc

  GetObjectW

  GetCurrentObject

  GetWinMetaFileBits

  SetROP2

  GetEnhMetaFileDescriptionW

  ArcTo

  CreateEnhMetaFileW

  Arc

  SelectPalette

  SetGraphicsMode

  ExcludeClipRect

  MaskBlt

  SetWindowOrgEx

  EndPage

  DeleteEnhMetaFile

  Chord

  SetDIBits

  SetViewportOrgEx

  GetViewportOrgEx

  CreateRectRgn

  RealizePalette

  SetDIBColorTable

  GetDIBColorTable

  CreateBrushIndirect

  PatBlt

  SetEnhMetaFileBits

  Rectangle

  SaveDC

  DeleteDC

  BitBlt

  SetWorldTransform

  FrameRgn

  GetDeviceCaps

  GetTextExtentPoint32W

  GetClipBox

  IntersectClipRect

  Polyline

  CreateBitmap

  CombineRgn

  SetWinMetaFileBits

  CreateDIBitmap

  GetStretchBltMode

  CreateDIBSection

  SetStretchBltMode

  GetDIBits

  ExtCreateRegion

  LineTo

  GetRgnBox

  EnumFontsW

  SetWindowExtEx

  CreateHalftonePalette

  SelectObject

  DeleteObject

  ExtFloodFill

  UnrealizeObject

  CopyEnhMetaFileW

  SetBkColor

  CreateCompatibleDC

  GetBrushOrgEx

  GetCurrentPositionEx

  SetDCPenColor

  CreateRoundRectRgn

  GetTextExtentPointW

  ExtTextOutW

  SetBrushOrgEx

  GetPixel

  GdiFlush

  SetViewportExtEx

  SetPixel

  PolyPolyline

  EnumFontFamiliesExW

  StretchDIBits

  GetPaletteEntries

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 677KB - Virtual size: 676KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 130KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 640B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 109B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 207KB - Virtual size: 207KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 220KB - Virtual size: 219KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 13.4MB - Virtual size: 13.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/38957fb3708884f1a8befb0c17b0fa81f57005a5de058772cc12bf357c548eab.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\Для вас дорогие\44CALIBER\obj\Release\Insidious.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 271KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/38b95beb9b6512936ad31e9b19db37160eca1f9d64c42bfb8d80f58bd9aadef5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3a68ca00f014589a8f29e3e5160972f53e267ee79d31acf48a28bf5b472a5919.exe

  .exe windows:5 windows x86 arch:x86

  1389569a3a39186f3eb453b501cfe688

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FindNextFileA

  ExpandEnvironmentStringsA

  GetLongPathNameW

  CopyFileW

  GetLocaleInfoA

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  VirtualProtect

  SetLastError

  VirtualFree

  VirtualAlloc

  GetNativeSystemInfo

  HeapAlloc

  GetProcessHeap

  FreeLibrary

  IsBadReadPtr

  GetTempPathW

  OpenProcess

  OpenMutexA

  lstrcatW

  GetCurrentProcessId

  GetTempFileNameW

  UnmapViewOfFile

  DuplicateHandle

  CreateFileMappingW

  MapViewOfFile

  GetSystemDirectoryA

  GlobalAlloc

  GlobalLock

  GetTickCount

  GlobalUnlock

  WriteProcessMemory

  ResumeThread

  GetThreadContext

  ReadProcessMemory

  CreateProcessW

  SetThreadContext

  LocalAlloc

  GlobalFree

  MulDiv

  SizeofResource

  QueryDosDeviceW

  FindFirstVolumeW

  GetConsoleScreenBufferInfo

  SetConsoleTextAttribute

  lstrlenW

  GetStdHandle

  SetFilePointer

  FindResourceA

  LockResource

  LoadResource

  LocalFree

  FindVolumeClose

  GetVolumePathNamesForVolumeNameW

  lstrcpyW

  FindFirstFileA

  FormatMessageA

  FindNextVolumeW

  AllocConsole

  lstrcmpW

  GetModuleFileNameA

  lstrcpynA

  QueryPerformanceFrequency

  QueryPerformanceCounter

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  HeapSize

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExA

  ReadConsoleW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  HeapReAlloc

  GetACP

  GetModuleHandleExW

  MoveFileExW

  RtlUnwind

  RaiseException

  LoadLibraryExW

  GetCPInfo

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetFileSize

  TerminateThread

  GetLastError

  CreateDirectoryW

  GetModuleHandleA

  RemoveDirectoryW

  MoveFileW

  SetFilePointerEx

  GetLogicalDriveStringsA

  DeleteFileW

  DeleteFileA

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  lstrlenA

  GetDriveTypeA

  FindNextFileW

  GetFileSizeEx

  FindFirstFileW

  GetModuleHandleW

  ExitProcess

  CreateMutexA

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  CreateProcessA

  PeekNamedPipe

  CreatePipe

  TerminateProcess

  ReadFile

  HeapFree

  HeapCreate

  CreateEventA

  GetLocalTime

  CreateThread

  SetEvent

  CreateEventW

  WaitForSingleObject

  Sleep

  GetModuleFileNameW

  CloseHandle

  ExitThread

  CreateFileW

  WriteFile

  SetConsoleOutputCP

  InitializeCriticalSectionAndSpinCount

  MultiByteToWideChar

  DecodePointer

  EncodePointer

  WideCharToMultiByte

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  WaitForSingleObjectEx

  ResetEvent

  SetEndOfFile

  user32

  GetMessageA

  GetWindowTextW

  wsprintfW

  GetClipboardData

  UnhookWindowsHookEx

  GetForegroundWindow

  ToUnicodeEx

  GetKeyboardLayout

  SetWindowsHookExA

  CloseClipboard

  OpenClipboard

  GetKeyboardState

  CallNextHookEx

  GetKeyboardLayoutNameA

  GetKeyState

  GetWindowTextLengthW

  DispatchMessageA

  SetForegroundWindow

  SetClipboardData

  EnumWindows

  ExitWindowsEx

  EmptyClipboard

  ShowWindow

  SetWindowTextW

  MessageBoxW

  IsWindowVisible

  CloseWindow

  SendInput

  EnumDisplaySettingsW

  mouse_event

  CreatePopupMenu

  TranslateMessage

  TrackPopupMenu

  DefWindowProcA

  CreateWindowExA

  AppendMenuA

  GetSystemMetrics

  RegisterClassExA

  GetCursorPos

  SystemParametersInfoW

  GetWindowThreadProcessId

  MapVirtualKeyA

  DrawIcon

  GetIconInfo

  gdi32

  BitBlt

  CreateCompatibleBitmap

  SelectObject

  CreateCompatibleDC

  StretchBlt

  GetDIBits

  DeleteObject

  CreateDCA

  GetObjectA

  DeleteDC

  advapi32

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  GetUserNameW

  RegEnumKeyExA

  QueryServiceStatus

  CloseServiceHandle

  OpenSCManagerW

  OpenSCManagerA

  ControlService

  StartServiceW

  QueryServiceConfigW

  ChangeServiceConfigW

  OpenServiceW

  EnumServicesStatusW

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  RegCreateKeyA

  RegCloseKey

  RegQueryInfoKeyW

  RegQueryValueExA

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegSetValueExA

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyW

  RegDeleteValueW

  RegEnumValueW

  RegQueryValueExW

  RegDeleteKeyA

  shell32

  ShellExecuteExA

  Shell_NotifyIconA

  ExtractIconA

  ShellExecuteW

  ole32

  CoInitializeEx

  CoUninitialize

  CoGetObject

  shlwapi

  PathFileExistsW

  PathFileExistsA

  StrToIntA

  winmm

  waveInOpen

  waveInStart

  waveInAddBuffer

  PlaySoundW

  mciSendStringA

  mciSendStringW

  waveInClose

  waveInStop

  waveInPrepareHeader

  waveInUnprepareHeader

  ws2_32

  gethostbyname

  send

  WSAStartup

  closesocket

  inet_ntoa

  htons

  htonl

  getservbyname

  ntohs

  getservbyport

  gethostbyaddr

  inet_addr

  WSASetLastError

  WSAGetLastError

  recv

  connect

  socket

  urlmon

  URLOpenBlockingStreamW

  URLDownloadToFileW

  gdiplus

  GdipSaveImageToStream

  GdipGetImageEncodersSize

  GdipFree

  GdipDisposeImage

  GdipAlloc

  GdipCloneImage

  GdipGetImageEncoders

  GdiplusStartup

  GdipLoadImageFromStream

  wininet

  InternetOpenUrlW

  InternetOpenW

  InternetCloseHandle

  InternetReadFile

  Sections

  .text

  Size: 348KB - Virtual size: 348KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 94KB - Virtual size: 94KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1024B - Virtual size: 560B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3abd01f8fa4bbc0919e070295b6c8a1ac511fdc136e992badf65b461a92f5074.exe

  .exe windows:5 windows x86 arch:x86

  d8ab2ebe34302214fb591786c1224cb5

  
  

  Code Sign

  1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-11-2018 00:00

  Not After

  31-12-2030 23:59

  Subject

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  73:09:80:91:ab:52:0b:92:b7:82:5c:b8:49:3b:55:dc

  Certificate

  Issuer

  CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  11-03-2021 00:00

  Not After

  10-03-2024 23:59

  Subject

  CN=AVB Disc Soft\, SIA,O=AVB Disc Soft\, SIA,POSTALCODE=2015,STREET=Turaidas iela 65A,L=Jūrmala,C=LV

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e8:9d:4a:8e:5e:6a:6f:de:93:0a:cb:5f:9a:69:dc:a7:34:08:d6:4c:24:de:ff:f6:15:6b:77:97:3b:9b:2f:aa

  Signer

  Actual PE Digest

  e8:9d:4a:8e:5e:6a:6f:de:93:0a:cb:5f:9a:69:dc:a7:34:08:d6:4c:24:de:ff:f6:15:6b:77:97:3b:9b:2f:aa

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\vmagent_new\bin\joblist\683178\out\Release\360PrivacyGuard.pdb

  Imports

  kernel32

  GetLocaleInfoW

  LocalFileTimeToFileTime

  GetFileSizeEx

  ExitThread

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetCPInfo

  GetStartupInfoW

  RtlUnwind

  HeapReAlloc

  HeapSize

  GetOEMCP

  IsValidCodePage

  LCMapStringA

  LCMapStringW

  VirtualFree

  VirtualAlloc

  HeapCreate

  HeapDestroy

  GetStdHandle

  GetModuleFileNameA

  SetHandleCount

  GetFileType

  GetConsoleCP

  GetConsoleMode

  CompareStringA

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  GetStringTypeA

  GetStringTypeW

  InitializeCriticalSectionAndSpinCount

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  SetStdHandle

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CreateFileA

  SetEnvironmentVariableA

  GlobalFlags

  lstrcmpiA

  HeapWalk

  HeapLock

  OpenThread

  HeapUnlock

  OutputDebugStringW

  SetFilePointerEx

  IsProcessorFeaturePresent

  GlobalAddAtomW

  GlobalFindAtomW

  GlobalDeleteAtom

  GetVersionExA

  lstrcmpA

  CompareStringW

  TlsFree

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  GlobalHandle

  GlobalReAlloc

  TlsGetValue

  GetACP

  FormatMessageW

  ExitProcess

  GetFullPathNameW

  lstrcmpW

  SetErrorMode

  SetEnvironmentVariableW

  lstrcpyW

  lstrlenA

  GetCommandLineW

  GlobalUnlock

  GlobalLock

  GetTempFileNameW

  GlobalAlloc

  InterlockedIncrement

  GetTimeZoneInformation

  GlobalFree

  FreeConsole

  GetTempPathW

  SetCurrentDirectoryW

  MulDiv

  CreateSemaphoreW

  ReleaseSemaphore

  GetSystemTimeAsFileTime

  RaiseException

  FlushInstructionCache

  GetModuleHandleA

  CreateProcessW

  LocalAlloc

  GetTickCount

  TerminateProcess

  OpenMutexW

  SetEndOfFile

  FlushFileBuffers

  SetFilePointer

  WriteFile

  GetCurrentThreadId

  FreeResource

  lstrcmpiW

  HeapFree

  GetProcessHeap

  HeapAlloc

  WideCharToMultiByte

  GetCurrentProcess

  lstrlenW

  SetLastError

  ProcessIdToSessionId

  LoadLibraryA

  GetUserDefaultUILanguage

  LoadLibraryExW

  MultiByteToWideChar

  ReleaseMutex

  CreateMutexW

  GetCurrentProcessId

  DeviceIoControl

  MoveFileExW

  GetFileAttributesW

  DeleteFileW

  ExpandEnvironmentStringsW

  SystemTimeToFileTime

  GetSystemTime

  GetSystemDirectoryW

  GetSystemWindowsDirectoryW

  ReadFile

  GetFileSize

  GetModuleFileNameW

  GetWindowsDirectoryW

  GetPrivateProfileStringW

  CreateThread

  CreateFileW

  GetShortPathNameW

  OpenProcess

  InterlockedDecrement

  FindNextFileW

  FindFirstFileW

  SetEvent

  LoadLibraryW

  InterlockedCompareExchange

  Sleep

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  LocalFree

  GetLastError

  GetVersion

  CloseHandle

  WaitForSingleObject

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetModuleHandleW

  GetProcAddress

  GetVersionExW

  CreateEventW

  InterlockedExchange

  FindClose

  FreeLibrary

  GetStartupInfoA

  user32

  SetCursor

  GetWindowTextW

  GetWindowTextLengthW

  RedrawWindow

  ScreenToClient

  GetMessagePos

  PtInRect

  DrawTextW

  DispatchMessageW

  TranslateMessage

  GetMessageW

  SetWindowTextW

  GetWindow

  MonitorFromWindow

  MapWindowPoints

  IsRectEmpty

  IsDialogMessageW

  GetClientRect

  DrawIconEx

  DestroyIcon

  GetActiveWindow

  MessageBoxW

  InvalidateRect

  LoadIconW

  GetDesktopWindow

  keybd_event

  GetKeyboardState

  SetActiveWindow

  SetForegroundWindow

  AttachThreadInput

  GetForegroundWindow

  AllowSetForegroundWindow

  GetMonitorInfoW

  GetWindowRect

  MoveWindow

  ClientToScreen

  OffsetRect

  CopyRect

  GetFocus

  ReleaseDC

  GetDC

  RegisterWindowMessageW

  SetRectEmpty

  IsWindowEnabled

  SetFocus

  SetWindowPos

  SendMessageW

  GetParent

  EnableWindow

  CreateWindowExW

  LoadCursorW

  GetClassInfoExW

  GetDlgCtrlID

  GetKeyState

  IsWindow

  GetWindowDC

  BeginPaint

  EndPaint

  SetCapture

  ReleaseCapture

  GetClassLongW

  SetClassLongW

  BringWindowToTop

  SwitchToThisWindow

  PostMessageW

  LoadStringW

  UnregisterClassA

  GetSystemMetrics

  GetWindowThreadProcessId

  IsWindowVisible

  SetWindowLongW

  GetWindowLongW

  DefWindowProcW

  DestroyMenu

  TabbedTextOutW

  DrawTextExW

  CallWindowProcW

  FindWindowW

  SendMessageTimeoutW

  KillTimer

  GrayStringW

  DestroyWindow

  OpenClipboard

  EmptyClipboard

  CloseClipboard

  GetClipboardData

  FindWindowExW

  CallNextHookEx

  SetClipboardViewer

  ChangeClipboardChain

  SetWindowsHookExW

  UnhookWindowsHookEx

  CharNextW

  PeekMessageW

  DestroyAcceleratorTable

  InvalidateRgn

  FillRect

  CreateAcceleratorTableW

  GetSysColor

  GetClassNameW

  GetDlgItem

  IsChild

  LoadImageW

  PrivateExtractIconsW

  PostQuitMessage

  GetCursorPos

  GetLastActivePopup

  GetSubMenu

  GetMenuItemCount

  GetMenuItemID

  GetMenuState

  ValidateRect

  GetSysColorBrush

  CheckMenuItem

  EnableMenuItem

  ModifyMenuW

  LoadBitmapW

  GetMenuCheckMarkDimensions

  SetMenuItemBitmaps

  IsIconic

  SystemParametersInfoA

  GetMenu

  AdjustWindowRectEx

  RegisterClassW

  GetClassInfoW

  SetMenu

  GetMessageTime

  GetTopWindow

  RemovePropW

  GetPropW

  SetPropW

  GetCapture

  WinHelpW

  RegisterClassExW

  SetTimer

  ShowWindow

  GetWindowPlacement

  gdi32

  SetWindowExtEx

  ScaleViewportExtEx

  SetViewportExtEx

  OffsetViewportOrgEx

  Escape

  TextOutW

  RectVisible

  PtVisible

  SetMapMode

  RestoreDC

  SaveDC

  ExtTextOutW

  GetClipBox

  CreateBitmap

  GetStockObject

  BitBlt

  SetViewportOrgEx

  GetPixel

  CreateCompatibleBitmap

  SetTextColor

  SetBkColor

  CreateSolidBrush

  GetTextExtentPoint32W

  GetTextMetricsW

  GetObjectA

  GetObjectW

  SelectObject

  CreateCompatibleDC

  DeleteDC

  ScaleWindowExtEx

  DeleteObject

  CreateFontW

  GetDeviceCaps

  winspool.drv

  DocumentPropertiesW

  OpenPrinterW

  ClosePrinter

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  RegOpenKeyExA

  RegQueryValueExA

  RegQueryInfoKeyW

  GetSidSubAuthority

  GetTokenInformation

  OpenProcessToken

  RegDeleteValueW

  RegCreateKeyExW

  RegEnumKeyExW

  RegEnumValueW

  RegQueryValueExW

  RegDeleteKeyW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegEnumKeyExA

  shell32

  DragQueryFileW

  DragFinish

  ExtractIconW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  ShellExecuteW

  ord680

  ShellExecuteExW

  SHGetFileInfoW

  SHGetFolderPathW

  DragAcceptFiles

  SHGetSpecialFolderPathW

  ole32

  CoInitializeEx

  CLSIDFromString

  CoGetClassObject

  OleLockRunning

  StringFromGUID2

  OleUninitialize

  OleInitialize

  CoTaskMemAlloc

  CoTaskMemRealloc

  RevokeDragDrop

  CreateStreamOnHGlobal

  CLSIDFromProgID

  CoUninitialize

  CoCreateInstance

  CoInitialize

  CoTaskMemFree

  oleaut32

  SysAllocString

  VariantInit

  VariantClear

  SysFreeString

  DispCallFunc

  SafeArrayGetVartype

  SafeArrayCopy

  VariantCopy

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayCreate

  SafeArrayDestroy

  SafeArrayLock

  SafeArrayUnlock

  VarBstrCmp

  SysAllocStringLen

  VarUI4FromStr

  OleCreateFontIndirect

  SysStringLen

  LoadRegTypeLi

  LoadTypeLi

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  VariantChangeType

  shlwapi

  StrStrW

  StrRStrIW

  PathRemoveBackslashW

  ColorHLSToRGB

  ColorRGBToHLS

  PathCompactPathW

  PathStripPathW

  ord437

  SHSetValueA

  SHGetValueA

  StrCmpNIW

  StrStrIA

  PathAddBackslashW

  PathAppendW

  SHGetValueW

  wnsprintfW

  PathIsDirectoryW

  PathFindExtensionW

  PathFindFileNameW

  StrCmpIW

  PathCombineW

  PathFileExistsW

  StrStrIW

  PathRemoveFileSpecW

  comctl32

  InitCommonControlsEx

  gdiplus

  GdipCreatePath

  GdipDeletePath

  GdipGetSmoothingMode

  GdipSetSmoothingMode

  GdipFillPath

  GdipDrawPath

  GdipCreateBitmapFromScan0

  GdipGetImagePixelFormat

  GdipGetImageGraphicsContext

  GdipDrawImageRectI

  GdipSetPixelOffsetMode

  GdipAddPathLineI

  GdipSetPenDashOffset

  GdipDrawEllipseI

  GdipSetPenWidth

  GdipGetPixelOffsetMode

  GdipAddPathRectangleI

  GdipCreateLineBrushFromRect

  GdipDrawRectangleI

  GdipCreatePen2

  GdipSetLinePresetBlend

  GdipDeleteFontFamily

  GdipCloneFontFamily

  GdipGetFontCollectionFamilyList

  GdipCreateFont

  GdipSetTextRenderingHint

  GdipSetClipRectI

  GdipResetClip

  GdipGetFontHeight

  GdipCreateFromHWND

  GdipCreatePathGradientFromPath

  GdipSetPathGradientCenterColor

  GdipDrawString

  GdipGetPathGradientPointCount

  GdipAddPathEllipseI

  GdipDrawLine

  GdipDrawImageRectRectI

  GdipNewPrivateFontCollection

  GdipFillRectangleI

  GdipPrivateAddMemoryFont

  GdipTranslateWorldTransform

  GdipRotateWorldTransform

  GdipResetWorldTransform

  GdipDrawImagePointRectI

  GdipCreateBitmapFromStream

  GdipSetInterpolationMode

  GdipGetImageEncodersSize

  GdipGetImageEncoders

  GdipSaveImageToFile

  GdipAddPathArc

  GdipAddPathLine

  GdipAddPathPie

  GdipGetPathWorldBoundsI

  GdipAddPathLine2

  GdipSetPathGradientCenterPoint

  GdipSetPathGradientGammaCorrection

  GdipCloneBrush

  GdipDeleteBrush

  GdipCreateSolidFill

  GdipFillRectangle

  GdipMeasureString

  GdipSetStringFormatAlign

  GdipSetStringFormatLineAlign

  GdipDeleteStringFormat

  GdipCreateStringFormat

  GdipDeleteFont

  GdipCreateFontFromLogfontA

  GdipCreateFontFromDC

  GdipDrawLineI

  GdipGetImageWidth

  GdipCreateBitmapFromFile

  GdipCloneImage

  GdipAlloc

  GdipDisposeImage

  GdipCreateLineBrushFromRectI

  GdipClosePathFigure

  GdipAddPathArcI

  GdipResetPath

  GdipDeletePrivateFontCollection

  GdipSetPenDashStyle

  GdipDeletePen

  GdipCreatePen1

  GdipDeleteGraphics

  GdipFree

  GdipCreateFromHDC

  GdipBitmapSetPixel

  GdipBitmapGetPixel

  GdipSetPathGradientSurroundColorsWithCount

  GdipGetImageHeight

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  wininet

  HttpQueryInfoW

  InternetCloseHandle

  InternetOpenUrlW

  InternetSetOptionW

  InternetOpenW

  DeleteUrlCacheEntryW

  InternetReadFile

  psapi

  GetModuleFileNameExW

  wtsapi32

  WTSQuerySessionInformationW

  userenv

  GetUserProfileDirectoryW

  imm32

  ImmDisableIME

  rpcrt4

  NdrAsyncClientCall

  RpcAsyncInitializeHandle

  RpcStringBindingComposeW

  RpcBindingFromStringBindingW

  RpcAsyncCompleteCall

  RpcStringFreeW

  RpcBindingFree

  oleacc

  LresultFromObject

  CreateStdAccessibleObject

  Sections

  .text

  Size: 736KB - Virtual size: 736KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 175KB - Virtual size: 174KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 53KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.0MB - Virtual size: 1.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 73KB - Virtual size: 72KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3ae42a57533de246fd315e146064cf3fd9b466e0450b891298cdeb79ffa44d24.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 589KB - Virtual size: 589KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3afe01534a7b396016185fcbd28aeca02a10bb84c82603286ca663c7b994b3ea.exe

  .exe windows:5 windows x86 arch:x86

  1d1ec441fe0c255b7bd79f009a10a8a3

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetComputerNameA

  SearchPathW

  SetPriorityClass

  GetNumaProcessorNode

  GetConsoleAliasExesLengthA

  InterlockedIncrement

  OpenJobObjectA

  QueryDosDeviceA

  GetComputerNameW

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetTickCount

  GetConsoleAliasesLengthA

  GetUserDefaultLangID

  GetEnvironmentStrings

  LoadLibraryW

  GetConsoleMode

  Sleep

  CopyFileW

  WriteConsoleOutputA

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetModuleFileNameW

  GetBinaryTypeW

  GetStartupInfoW

  WritePrivateProfileStringW

  DisconnectNamedPipe

  GetCommandLineW

  GetConsoleAliasesW

  FillConsoleOutputCharacterW

  GetLastError

  GetProcAddress

  SetStdHandle

  EnterCriticalSection

  SearchPathA

  BuildCommDCBW

  InterlockedExchangeAdd

  OpenWaitableTimerW

  LocalAlloc

  FoldStringW

  GetModuleFileNameA

  GetDefaultCommConfigA

  SetConsoleTitleW

  GetModuleHandleA

  GetShortPathNameW

  SetCalendarInfoA

  FindAtomW

  GlobalReAlloc

  SetFileAttributesW

  CopyFileExA

  GetVolumeInformationW

  CreateFileW

  SetFilePointer

  CloseHandle

  CreateDirectoryA

  DebugActiveProcess

  HeapAlloc

  EncodePointer

  DecodePointer

  MultiByteToWideChar

  HeapSetInformation

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  ExitProcess

  WriteFile

  GetStdHandle

  HeapCreate

  HeapSize

  GetCPInfo

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  HeapReAlloc

  RtlUnwind

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeW

  HeapFree

  IsProcessorFeaturePresent

  GetConsoleCP

  FlushFileBuffers

  WriteConsoleW

  user32

  SetFocus

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 82KB - Virtual size: 82KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 35.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 135KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3b0298ab4d2bf30c8009cf40297bd5eacdb2b845a28778ab5de1e452fe9209a1.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 189KB - Virtual size: 188KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3b2b055027ab684ff8477eb80090e9c1bbaf7ad07059ecdf73b2d5a0eca8530c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 394KB - Virtual size: 393KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3b318399e094b9024f2b6c8d92eff595a636b147b4bf240752e92a6bcd7b7fd8.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  PVFb.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 649KB - Virtual size: 649KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3b79a6f501554bc68d204d6b0b7ea80cc1619d9dd0ffebb6933edc3e9b8f29ac.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  00:e1:6e:88:c9:f4:3b:5d:d8:f4:65:c3:04:8c:42:8e:bd:52:36:bf:ee:50:26:59:cc:e6:e5:e9:0e:0a:ef:d2

  Signer

  Actual PE Digest

  00:e1:6e:88:c9:f4:3b:5d:d8:f4:65:c3:04:8c:42:8e:bd:52:36:bf:ee:50:26:59:cc:e6:e5:e9:0e:0a:ef:d2

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\dmyw4opmrtqcx\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3c7db61b397a28897ade5d4beaa84af510207cd5ff1b17feb6e82c5f3c2df71e.exe

  .exe windows:0 windows x86 arch:x86

  1e5a4769bafbf8d68687235e0a241fea

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  gdi32

  ChoosePixelFormat

  CombineRgn

  CreateCompatibleBitmap

  CreateICW

  CreatePen

  EndGdiRendering

  EndPage

  EngDeleteClip

  EngQueryEMFInfo

  EngStretchBltROP

  EngTransparentBlt

  EngUnicodeToMultiByteN

  FixBrushOrgEx

  GdiConvertBitmapV5

  GdiDeleteSpoolFileHandle

  GdiFullscreenControl

  GdiIsMetaPrintDC

  GdiStartPageEMF

  GetCharacterPlacementA

  GetColorSpace

  GetETM

  GetEnhMetaFileW

  GetFontRealizationInfo

  GetICMProfileA

  GetICMProfileW

  GetMapMode

  GetMiterLimit

  GetOutlineTextMetricsW

  GetROP2

  GetTextExtentExPointW

  GetTextExtentPointI

  GetTextFaceA

  MoveToEx

  NamedEscape

  OffsetClipRgn

  OffsetRgn

  PATHOBJ_bEnum

  PATHOBJ_bEnumClipLines

  PaintRgn

  PlgBlt

  PolyTextOutA

  Polygon

  QueryFontAssocStatus

  RealizePalette

  RemoveFontResourceA

  ResetDCW

  STROBJ_bEnum

  STROBJ_dwGetCodePage

  SelectClipPath

  SelectFontLocal

  SetDCPenColor

  SetGraphicsMode

  SetMetaFileBitsEx

  SetRectRgn

  SetTextCharacterExtra

  kernel32

  CloseThreadpoolTimer

  CompareStringOrdinal

  CreateDirectoryA

  CreateDirectoryW

  CreateHardLinkA

  CreateMutexExW

  CreateProcessA

  CreateThreadpool

  CreateTimerQueueTimer

  CtrlRoutine

  DeleteFileTransactedW

  DeleteProcThreadAttributeList

  DeleteTimerQueueTimer

  EnumDateFormatsA

  EnumResourceTypesExW

  EnumTimeFormatsA

  EnumUILanguagesA

  ExitVDM

  FileTimeToLocalFileTime

  FindFirstFileExA

  FindNextFileW

  FlsSetValue

  FreeEnvironmentStringsA

  FreeLibrary

  GetACP

  GetCalendarDaysInMonth

  GetCalendarInfoA

  GetCalendarSupportedDateRange

  GetConsoleAliasExesW

  GetConsoleFontSize

  GetConsoleOriginalTitleA

  GetCurrencyFormatA

  GetCurrentDirectoryW

  GetDiskFreeSpaceExA

  GetDllDirectoryW

  GetEraNameCountedString

  GetFileSizeEx

  GetOverlappedResult

  GetProcAddress

  GetQueuedCompletionStatusEx

  GetShortPathNameW

  GetStringTypeA

  GetSystemDefaultLocaleName

  GetSystemPreferredUILanguages

  GetTempPathW

  GetTimeFormatW

  GetTimeZoneInformationForYear

  GetUserGeoID

  GetVersionExW

  GetVolumeNameForVolumeMountPointA

  GetVolumeNameForVolumeMountPointW

  GetWriteWatch

  GlobalFindAtomW

  GlobalMemoryStatusEx

  InterlockedPopEntrySList

  IsBadHugeWritePtr

  IsValidLocale

  LZStart

  LoadLibraryA

  LockFile

  MoveFileTransactedW

  OpenMutexW

  PostQueuedCompletionStatus

  PrivMoveFileIdentityW

  QueryDepthSList

  QueryProcessAffinityUpdateMode

  QueueUserWorkItem

  ReadConsoleInputExA

  ResetWriteWatch

  ResolveLocaleName

  SetCommState

  SetComputerNameExW

  SetConsoleTitleW

  SetDefaultCommConfigA

  SetDefaultCommConfigW

  SetDefaultDllDirectories

  SetDynamicTimeZoneInformation

  SetEnvironmentStringsA

  SetFileBandwidthReservation

  SetNamedPipeAttribute

  SetSearchPathMode

  SetThreadpoolThreadMinimum

  SetTimerQueueTimer

  SetUnhandledExceptionFilter

  SignalObjectAndWait

  SleepConditionVariableCS

  TryAcquireSRWLockShared

  TzSpecificLocalTimeToSystemTimeEx

  UnlockFile

  WaitForMultipleObjectsEx

  WerGetFlags

  lstrlenW

  msvcrt

  _chgsign

  _stricoll

  _wcsnset

  clock

  fclose

  feof

  fgets

  fputws

  free

  getc

  isspace

  iswalpha

  malloc

  mbtowc

  memcpy

  memset

  rand

  strcat

  strcpy_s

  strcspn

  strerror

  strlen

  strrchr

  swprintf_s

  swscanf_s

  ungetwc

  shell32

  AssocGetDetailsOfPropKey

  DragQueryPoint

  ExtractIconEx

  GetCurrentProcessExplicitAppUserModelID

  ILFree

  IsNetDrive

  PifMgr_CloseProperties

  RestartDialog

  SHBindToFolderIDListParentEx

  SHBindToParent

  SHCreateDirectoryExA

  SHCreateItemInKnownFolder

  SHCreateStdEnumFmtEtc

  SHGetFolderPathAndSubDirW

  SHGetKnownFolderIDList

  SHGetKnownFolderItem

  SHGetNewLinkInfo

  SHGetNewLinkInfoA

  SHGetSettings

  SHSetFolderPathW

  user32

  AttachThreadInput

  CallMsgFilterA

  CascadeChildWindows

  CharPrevW

  CheckWindowThreadDesktop

  CloseWindow

  CreateSystemThreads

  DefMDIChildProcA

  DestroyCaret

  DisplayConfigGetDeviceInfo

  EnterReaderModeHelper

  EnumDesktopWindows

  GetAltTabInfoA

  GetClassNameA

  GetClassNameW

  GetCursor

  GetDialogBaseUnits

  GetGuiResources

  GetKBCodePage

  GetLastInputInfo

  GetMenuItemCount

  GetWindow

  GetWindowCompositionInfo

  GetWindowDC

  GetWindowLongA

  GetWindowModuleFileName

  IsCharUpperW

  IsChild

  LoadAcceleratorsA

  LoadStringA

  LoadStringW

  MessageBeep

  MessageBoxExW

  PaintMenuBar

  RegisterErrorReportingDialog

  RegisterTasklist

  RemoveClipboardFormatListener

  ScreenToClient

  SendMessageTimeoutA

  SetGestureConfig

  SetScrollPos

  ShowSystemCursor

  ShutdownBlockReasonDestroy

  TrackPopupMenuEx

  TranslateAcceleratorW

  TranslateMessage

  UnregisterDeviceNotification

  UnregisterPowerSettingNotification

  WinHelpW

  Sections

  .text

  Size: 1.4MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 454KB - Virtual size: 453KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 946KB - Virtual size: 946KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 84KB - Virtual size: 84KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3c80aa408f8054f20f367719afd84910a717f20d47b3fcbbf4454d6f3efaf17e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3c8ad9f99ce8d1b1a3eaa291918cff6ea197ff74edb2c0e861665c6117330552.exe

  .dll windows:4 windows x64 arch:x64

  dae02f32a21e03ce65412f6e56942daa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  mscoree

  _CorDllMain

  Exports

  Exports

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXF

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXMM

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXMMNH

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXMRRRTTCONNNNNNCMEIEKRRT

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXMRRRTTT

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPCF

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPJ

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPR

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPRS

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPSS

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXPT

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXVV

  VivgMpDxvnynJIpTGexMwVfOXFPmgdBqMAtmGMgDXX

  krita_main

  Sections

  .text

  Size: 247KB - Virtual size: 246KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .sdata

  Size: 1024B - Virtual size: 915B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 928B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 928B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3d7139a6da9252f6ad42ce3855765fd40f6d0cd5e853f7851d66e2b6a2c4807a.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 469KB - Virtual size: 468KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3ec49e14a495f9bdafb8944db9125c0e8f7f4258c285962df393c8918b0665dd.exe

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 97KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3f74f56c78e667340a94829adc698b2f8ef6f73c0cd569820ff0094243103f01.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 237KB - Virtual size: 237KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3fa3a4c013327a127797156d3ebf3f261204c32b47a7dd8cecaa717bd669ad85.exe

  .exe windows:10 windows x86 arch:x86

  9e41f63b8143bebfb96200b6d2b13400

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  imecfmui.pdb

  Imports

  advapi32

  EventWrite

  EventRegister

  EventUnregister

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegCloseKey

  RegOpenCurrentUser

  OpenProcessToken

  GetTokenInformation

  IsValidSid

  ConvertSidToStringSidW

  GetSidSubAuthority

  GetSidSubAuthorityCount

  RegOpenKeyExW

  kernel32

  DeleteFileW

  CloseHandle

  GetProcAddress

  CreateFileW

  GetTickCount

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleHandleA

  TerminateProcess

  GetCurrentProcess

  GetTempPathW

  UnhandledExceptionFilter

  GetStartupInfoW

  Sleep

  GetModuleFileNameA

  ExpandEnvironmentStringsW

  FreeLibrary

  GetLastError

  LocalFree

  GetVersionExW

  FindResourceExW

  LoadResource

  FindFirstFileW

  FindNextFileW

  FindClose

  LoadLibraryExW

  GetModuleHandleExW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  CompareStringW

  LockResource

  WriteFile

  gdi32

  GetDeviceCaps

  CreateFontIndirectW

  GetStockObject

  SelectObject

  GetTextExtentPoint32W

  GetObjectW

  user32

  DestroyWindow

  GetWindowLongW

  SetWindowLongW

  SendDlgItemMessageW

  GetDlgItem

  EnableWindow

  MessageBoxW

  SetDlgItemTextW

  PostMessageW

  GetDlgItemTextW

  SendMessageW

  LoadImageW

  GetWindowThreadProcessId

  GetSystemMetrics

  GetDC

  ReleaseDC

  GetKeyState

  InvalidateRect

  EndDialog

  GetCursor

  SetCursor

  LoadCursorW

  MapDialogRect

  GetClassInfoExW

  RegisterClassExW

  UnregisterClassW

  CreateWindowExW

  DefWindowProcW

  GetMessageW

  IsDialogMessageW

  TranslateMessage

  DispatchMessageW

  PostQuitMessage

  GetCursorPos

  SetForegroundWindow

  TrackPopupMenuEx

  GetSubMenu

  SetWindowTextW

  RegisterWindowMessageW

  SetProcessDPIAware

  UpdateWindow

  AllowSetForegroundWindow

  LoadMenuIndirectW

  DialogBoxIndirectParamW

  CreateDialogIndirectParamW

  DrawEdge

  DrawStateW

  GetWindowTextW

  SetWindowPos

  MapWindowPoints

  GetWindowRect

  GetClientRect

  EnumWindows

  GetClassNameW

  GetLastActivePopup

  DestroyIcon

  ShowWindow

  DestroyMenu

  msvcrt

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  _unlock

  _lock

  _wcmdln

  _initterm

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  _callnewh

  malloc

  ?what@exception@@UBEPBDXZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  memcpy

  __CxxFrameHandler3

  _CxxThrowException

  wcschr

  _wcstoi64

  _wtoi

  wcsncpy_s

  _vsnwprintf_s

  _purecall

  wcsncat_s

  ??_V@YAXPAX@Z

  wcsnlen

  memmove

  ??3@YAXPAX@Z

  ??1exception@@UAE@XZ

  memset

  ole32

  CoInitialize

  CoCreateInstance

  shell32

  ShellExecuteW

  SHGetFolderPathW

  Shell_NotifyIconW

  oleaut32

  SysAllocString

  VariantClear

  SysFreeString

  wer

  WerReportCloseHandle

  WerReportAddFile

  WerReportSubmit

  WerReportSetParameter

  WerReportCreate

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/3fc278308168c0c7f245925212bb713f8096c6dc2241900be9db5027d384385a.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 509KB - Virtual size: 509KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4022b529efa2d5cfea939732cab5f0829c1129809b7b6813bd1e80e7e9b14dc1.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 231KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 904KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/40c50b90c67f6172ada13d2c893f1974a4424c6eb23619a13351fd315504a003.exe

  .exe windows:10 windows x86 arch:x86

  b6df92b17f27e1708240ec29f2498c77

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  ImeBroker.pdb

  Imports

  user32

  PeekMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  AllowSetForegroundWindow

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetSystemMetrics

  CharNextW

  WaitForInputIdle

  msvcrt

  wcsncat_s

  _initterm

  swscanf_s

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  _wcmdln

  _amsg_exit

  __p__commode

  _XcptFilter

  ?what@exception@@UBEPBDXZ

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  tolower

  wcsnlen

  wcsrchr

  wcsncpy_s

  _lock

  _unlock

  __dllonexit

  _onexit

  ??1type_info@@UAE@XZ

  ?terminate@@YAXXZ

  _controlfp

  _except_handler4_common

  _vsnwprintf

  free

  malloc

  memcpy

  vswprintf_s

  wcsncmp

  _wcsnicmp

  _vsnwprintf_s

  ??_V@YAXPAX@Z

  _wtoi

  __wgetmainargs

  memcmp

  _CIlog

  __CxxFrameHandler3

  _CxxThrowException

  _purecall

  memmove

  _CIexp

  memset

  api-ms-win-core-com-l1-1-1

  CoReleaseServerProcess

  CoAddRefServerProcess

  CreateStreamOnHGlobal

  CoInitializeSecurity

  CoInitializeEx

  CoRegisterClassObject

  CoResumeClassObjects

  CoTaskMemFree

  CoRevokeClassObject

  CoUninitialize

  CoCreateInstance

  CoTaskMemAlloc

  api-ms-win-core-synch-l1-2-0

  OpenEventW

  Sleep

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  SetEvent

  ReleaseMutex

  OpenMutexW

  CreateMutexW

  InitOnceComplete

  CreateEventW

  ReleaseSRWLockExclusive

  WaitForSingleObject

  InitOnceBeginInitialize

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-libraryloader-l1-2-0

  LoadResource

  FreeLibrary

  GetModuleHandleA

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  FindResourceExW

  FreeLibraryAndExitThread

  GetModuleFileNameA

  GetModuleHandleW

  LockResource

  SizeofResource

  api-ms-win-core-heap-l1-2-0

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-errorhandling-l1-1-1

  SetErrorMode

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-2

  ResumeThread

  GetCurrentProcessId

  GetCurrentProcess

  CreateThread

  OpenProcessToken

  CreateProcessW

  GetStartupInfoW

  GetExitCodeProcess

  GetCurrentThreadId

  TerminateProcess

  SetPriorityClass

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventWrite

  EventActivityIdControl

  EventUnregister

  EventRegister

  EventSetInformation

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetSystemDirectoryW

  GetSystemTime

  GetTickCount64

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-security-base-l1-2-0

  AllocateAndInitializeSid

  IsValidSid

  GetSidSubAuthority

  GetTokenInformation

  GetSidSubAuthorityCount

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegOpenKeyExW

  RegGetValueW

  RegQueryValueExW

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalAlloc

  GlobalFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysStringLen

  SysAllocString

  api-ms-win-core-localization-l1-2-1

  LCMapStringW

  FormatMessageW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-file-l1-2-1

  SetFileTime

  GetFileSize

  CreateFileW

  GetTempPathW

  CreateDirectoryW

  GetTempFileNameW

  FindFirstFileW

  FindNextFileW

  FindClose

  DeleteFileW

  WriteFile

  SetEndOfFile

  GetFileAttributesW

  SetFilePointer

  api-ms-win-core-memory-l1-1-2

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-core-string-l1-1-0

  CompareStringW

  advapi32

  SetEntriesInAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  shell32

  ord165

  SHGetFolderPathW

  SHCreateDirectoryExW

  ShellExecuteW

  shlwapi

  ord12

  PathFileExistsW

  api-ms-win-appmodel-runtime-l1-1-1

  GetCurrentPackageFullName

  GetPackageFullName

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  api-ms-win-security-trustee-l1-1-1

  BuildExplicitAccessWithNameW

  profapi

  ord104

  Sections

  .text

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\rje\tg\3sgd\obj\Re\ease\gqa.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/418e0add4eb6fb3db62e0fdae4dfe7b738e8348babc29a09f5cf9a0cac0a29db.exe

  .exe windows:5 windows x86 arch:x86

  7f2222d75bcebeb591b7d884c5b9299b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetCurrentThread

  FindNextFileW

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  WaitForSingleObject

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  CloseHandle

  GetLastError

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  CreateThread

  DuplicateHandle

  EnterCriticalSection

  GetCurrentProcess

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  DeleteFileW

  SetEnvironmentVariableA

  user32

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  CopyImage

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  UnregisterHotKey

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  DeleteMenu

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 557KB - Virtual size: 557KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 179KB - Virtual size: 179KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 161KB - Virtual size: 161KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/41915ffe249fb3ca4d56f818f326fc362fbb65da11e1bc46c556cc73a871f5ea.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  43:9d:39:80:ca:0c:a3:34:72:f5:e1:58:a6:80:70:1f:ad:a9:03:61:cd:61:9c:be:45:8b:d7:b5:49:d1:3e:fa

  Signer

  Actual PE Digest

  43:9d:39:80:ca:0c:a3:34:72:f5:e1:58:a6:80:70:1f:ad:a9:03:61:cd:61:9c:be:45:8b:d7:b5:49:d1:3e:fa

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\1m76k5dt48nppq\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4209036f5f98e658e2f62066c77968ccc0937064ca9a7869408c265bbee43b99.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4.8MB - Virtual size: 4.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 313KB - Virtual size: 476KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 205KB - Virtual size: 205KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/422abbc433aea072fec30ffcea48a4c5c13f0b9883b3e4782116e253bf33dbfc.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 34KB - Virtual size: 34KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/42ca144560a4c7cc6a244324a400014e7d6ee2f3b51f1a1f9183d460dccb7c6c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 72KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4311121804332b647e02280a9c551c85c16a46f24f2d2107a9bdceaa8923afa1.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 235KB - Virtual size: 234KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/44d0e959d4a9c31cc02dc12dacdf34b4fa4d0d9eda5a4c6d03dfff72045cda8b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  31:68:7f:ed:8a:32:81:b8:ed:23:b5:92:9a:3f:3b:e7:a6:25:b8:c6:dc:9d:bd:9c:3a:35:a4:3d:51:20:e2:ed

  Signer

  Actual PE Digest

  31:68:7f:ed:8a:32:81:b8:ed:23:b5:92:9a:3f:3b:e7:a6:25:b8:c6:dc:9d:bd:9c:3a:35:a4:3d:51:20:e2:ed

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\l0k90nbagbfsco\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/44f5ebb4facaba45274f08437a1f980bbbdb209cbd016ead76e4ec1afaca4dc2.exe

  .dll windows:6 windows x64 arch:x64

  7654de49588e8164879719d356bd8735

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\JENKINS\workspace\N_CleanActions\bin\x64\Release\ActionsShim.pdb

  Imports

  crypt32

  CertDuplicateCertificateContext

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertOpenStore

  CertCloseStore

  CertGetCertificateContextProperty

  CertEnumCertificatesInStore

  kernel32

  GetFileAttributesW

  SetLastError

  GetCurrentThreadId

  SetEndOfFile

  GetStdHandle

  FindNextFileW

  FindClose

  GetModuleHandleA

  GetCurrentDirectoryW

  SetEvent

  ResetEvent

  ReleaseMutex

  CreateMutexW

  CreateEventW

  WaitForMultipleObjects

  InitializeCriticalSectionAndSpinCount

  TerminateProcess

  GetStartupInfoW

  GetSystemTimeAsFileTime

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetFileType

  DeleteFiber

  QueryPerformanceCounter

  ConvertFiberToThread

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  WriteConsoleW

  HeapSize

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  GetTimeZoneInformation

  SystemTimeToTzSpecificLocalTime

  GetLocalTime

  GetTickCount

  GetFileSize

  HeapAlloc

  GetProcessHeap

  WaitForSingleObject

  QueryDosDeviceW

  GetLogicalDriveStringsW

  FindFirstFileW

  HeapFree

  GetFileInformationByHandle

  WriteFile

  ReadFile

  GetFileSizeEx

  FlushFileBuffers

  CreateFileW

  GetWindowsDirectoryW

  GetCurrentProcess

  GetModuleFileNameW

  FileTimeToSystemTime

  MultiByteToWideChar

  WideCharToMultiByte

  LocalFree

  FormatMessageW

  DeleteCriticalSection

  DecodePointer

  InitializeCriticalSectionEx

  VirtualQueryEx

  GetModuleHandleW

  Module32FirstW

  CreateToolhelp32Snapshot

  OpenProcess

  GetCurrentProcessId

  GetLastError

  CloseHandle

  GetProcAddress

  FreeLibrary

  LoadLibraryW

  GetACP

  IsValidCodePage

  FindFirstFileExW

  GetFullPathNameW

  HeapReAlloc

  SetStdHandle

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  SetFilePointerEx

  GetConsoleOutputCP

  PeekNamedPipe

  GetDriveTypeW

  SetConsoleCtrlHandler

  ExitProcess

  GetModuleHandleExW

  EnterCriticalSection

  LoadLibraryExW

  RtlPcToFileHeader

  InterlockedFlushSList

  InterlockedPushEntrySList

  RtlUnwindEx

  RaiseException

  OutputDebugStringW

  IsDebuggerPresent

  InitializeSListHead

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  SleepConditionVariableSRW

  WakeAllConditionVariable

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  GetCPInfo

  LCMapStringEx

  EncodePointer

  GetStringTypeW

  Sleep

  SwitchToThread

  LeaveCriticalSection

  user32

  GetProcessWindowStation

  MessageBoxW

  GetUserObjectInformationW

  advapi32

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  RegEnumKeyExW

  CryptAcquireContextW

  CryptCreateHash

  CryptReleaseContext

  CryptDestroyHash

  CryptEnumProvidersW

  CryptSignHashW

  CryptDecrypt

  CryptExportKey

  CryptGetUserKey

  CryptGetProvParam

  CryptSetHashParam

  CryptDestroyKey

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  oleaut32

  VariantClear

  psapi

  GetProcessImageFileNameW

  bcrypt

  BCryptImportKeyPair

  BCryptHashData

  BCryptDestroyHash

  BCryptGenRandom

  BCryptCreateHash

  BCryptCloseAlgorithmProvider

  BCryptFinishHash

  BCryptOpenAlgorithmProvider

  BCryptVerifySignature

  BCryptGetProperty

  BCryptDestroyKey

  version

  VerQueryValueW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  ws2_32

  recv

  WSAGetLastError

  WSAStartup

  WSACleanup

  send

  closesocket

  WSASetLastError

  Exports

  Exports

  ActionsShim_CancelAllOperations

  ActionsShim_Create

  ActionsShim_Destroy

  ActionsShim_FinishUpdate

  ActionsShim_GetDetectedThreats

  ActionsShim_GetDetectedThreatsV2

  ActionsShim_GetMajorAPIVersion

  ActionsShim_GetMinorAPIVersion

  ActionsShim_InitTargetDLL

  ActionsShim_IsDLLNewlyLoaded

  ActionsShim_PrepareUpdate

  ActionsShim_ProcessPendingActionsAfterReboot

  ActionsShim_ProcessThreatActions

  ActionsShim_ProcessThreatActionsV2

  ActionsShim_SetLogCallback

  ActionsShim_SetMaxLogLevel

  ActionsShim_ShutdownTargetDLL

  ActionsShim_Threat_Delete

  ActionsShim_Threat_GetBasicData

  ActionsShim_Threat_GetRegValueDeleteData

  ActionsShim_Threat_GetRegValueReplaceData

  ActionsShim_Threat_GetTxtReplaceData

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 741KB - Virtual size: 740KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 66KB - Virtual size: 65KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 500B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 247KB - Virtual size: 247KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 23KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4529554d09a020003227f1d879f6e202604c5875b89b9c3088a32c65211182b5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 60KB - Virtual size: 59KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/45aae4515b7076d25923730c3672cb9e8f462cf402828fd3eb2d3255d626df56.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 250KB - Virtual size: 249KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/45b33888ddb2748434643e4811f156f1fc2a5d339d3577945d8c9e9d88c5ff57.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  .text

  Size: 376KB - Virtual size: 376KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 22KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 16B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/45ba5f7c168cfa2a68d8f8d448ee037d35fca5dbb7e9d4deb55f8e0ba97ceacb.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 62KB - Virtual size: 62KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/46173d25c61f353cb1c5047b6108cae5d4eb30bf24e9981dfc94f78b85f92c69.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 69KB - Virtual size: 68KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/462fafaa4badf6b5bba91bd555eb567db6be610a72d7efd8f039e9387924480c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\cv31qrh6z\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 306KB - Virtual size: 306KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/46936b0fef991d2d3ee9af2d07d2a90f0cc8260fa2ade9d661c197319798d89b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .mvid

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/47cf5e11cfe6184962783d4a21d7d35cd057ec8ca299c8c5fe69673a03fe5364.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  xSjs.pdb

  Sections

  .text

  Size: 806KB - Virtual size: 806KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/49572fa3d9a71986235bda85410e9af9d4a6f087cc477e3813551a3789cdd148.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .mvid

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/499d69d5ab8ba263975d5780e3b639a2a8905c50f2a1379bf972889c3913add4.exe

  .exe windows:6 windows x64 arch:x64

  3e4dc544b32d46ff67e39ad1b3dbfdc4

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\Jenkins\workspace\N_MBAMWsc\bin\x64\Release\MBAMwsc.pdb

  Imports

  crypt32

  CertDuplicateCertificateContext

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertOpenStore

  CertCloseStore

  CertGetCertificateContextProperty

  CertEnumCertificatesInStore

  kernel32

  GlobalFree

  ExpandEnvironmentStringsW

  GetLongPathNameW

  GetWindowsDirectoryW

  LocalAlloc

  GetCurrentProcessId

  GetFileSizeEx

  ReadFile

  WriteFile

  GetFileSize

  SetEndOfFile

  GetStdHandle

  FindNextFileW

  FindClose

  GetModuleHandleA

  GetCurrentDirectoryW

  InitializeCriticalSectionAndSpinCount

  GetSystemTimeAsFileTime

  TerminateProcess

  GetStartupInfoW

  SetEvent

  ResetEvent

  ReleaseMutex

  CreateMutexW

  CreateEventW

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GetFileType

  DeleteFiber

  QueryPerformanceCounter

  ConvertFiberToThread

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  WriteConsoleW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  GetACP

  IsValidCodePage

  FindFirstFileExW

  FlushFileBuffers

  GetFileInformationByHandle

  DeleteFileW

  SetFileAttributesW

  RemoveDirectoryW

  CreateDirectoryW

  GetFileAttributesExW

  GetFileAttributesW

  FindFirstFileW

  WaitForMultipleObjects

  GetCurrentThread

  LoadLibraryW

  GetExitCodeProcess

  WaitForSingleObject

  CreateProcessW

  GlobalAlloc

  GetLogicalDriveStringsW

  SetLastError

  GetNativeSystemInfo

  IsWow64Process

  CopyFileW

  LocalFree

  GetCurrentProcess

  GetSystemInfo

  VerifyVersionInfoW

  VerSetConditionMask

  GetVersionExW

  MultiByteToWideChar

  WideCharToMultiByte

  OutputDebugStringW

  FileTimeToSystemTime

  CloseHandle

  CreateFileW

  GetTimeZoneInformation

  SystemTimeToTzSpecificLocalTime

  GetLocalTime

  GetModuleHandleW

  GetProcAddress

  GetTickCount

  SleepEx

  GetTickCount64

  GetModuleFileNameW

  GetProcessHeap

  DeleteCriticalSection

  DecodePointer

  HeapAlloc

  HeapReAlloc

  GetLastError

  HeapSize

  InitializeCriticalSectionEx

  HeapFree

  SwitchToThread

  EnterCriticalSection

  LeaveCriticalSection

  RtlUnwind

  GetFullPathNameW

  SetStdHandle

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  SetFilePointerEx

  GetConsoleOutputCP

  GetCommandLineW

  GetCommandLineA

  PeekNamedPipe

  GetDriveTypeW

  SetConsoleCtrlHandler

  GetModuleHandleExW

  ExitProcess

  LoadLibraryExW

  RtlPcToFileHeader

  InterlockedPushEntrySList

  RtlUnwindEx

  InitializeSListHead

  SleepConditionVariableSRW

  WakeAllConditionVariable

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  RaiseException

  IsDebuggerPresent

  GetCPInfo

  LCMapStringEx

  EncodePointer

  GetStringTypeW

  FormatMessageW

  CallNamedPipeW

  GetProcessId

  GetCurrentThreadId

  Sleep

  QueryDosDeviceW

  FreeLibrary

  user32

  GetProcessWindowStation

  MessageBoxW

  GetUserObjectInformationW

  advapi32

  SetEntriesInAclW

  CheckTokenMembership

  FreeSid

  StartServiceW

  NotifyServiceStatusChangeW

  CloseServiceHandle

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  RegEnumKeyExW

  IsTextUnicode

  OpenThreadToken

  OpenProcessToken

  OpenSCManagerW

  OpenServiceW

  QueryServiceStatusEx

  CryptEnumProvidersW

  CryptSignHashW

  CryptDecrypt

  CryptExportKey

  CryptGetUserKey

  CryptGetProvParam

  CryptSetHashParam

  CryptDestroyKey

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  CryptDestroyHash

  CryptReleaseContext

  CryptCreateHash

  CryptAcquireContextW

  CreateWellKnownSid

  GetSidSubAuthority

  GetSidSubAuthorityCount

  AreAllAccessesGranted

  MapGenericMask

  ConvertStringSidToSidW

  ConvertSidToStringSidW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  RegUnLoadKeyW

  RegSetValueExW

  RegSaveKeyW

  RegRestoreKeyW

  RegQueryInfoKeyW

  RegLoadAppKeyW

  RegLoadKeyW

  RegEnumValueW

  RegEnumKeyW

  RegDeleteValueW

  RegDeleteKeyW

  RegCreateKeyExW

  TreeSetNamedSecurityInfoW

  SetSecurityInfo

  GetSecurityInfo

  SetNamedSecurityInfoW

  GetNamedSecurityInfoW

  DeleteAce

  GetExplicitEntriesFromAclW

  QueryServiceConfigW

  AllocateAndInitializeSid

  shell32

  SHGetFolderPathW

  ShellExecuteW

  ole32

  CoUninitialize

  CoInitializeEx

  CoGetClassObject

  CoCreateInstance

  StringFromGUID2

  oleaut32

  SystemTimeToVariantTime

  VariantInit

  VariantClear

  VariantTimeToSystemTime

  VariantChangeType

  SysFreeString

  SysAllocString

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  mpr

  WNetGetConnectionW

  netapi32

  NetApiBufferFree

  NetWkstaGetInfo

  psapi

  GetProcessImageFileNameW

  sfc

  SfcIsFileProtected

  authz

  AuthzInitializeContextFromSid

  AuthzAccessCheck

  AuthzFreeContext

  AuthzFreeResourceManager

  AuthzInitializeResourceManager

  bcrypt

  BCryptGetProperty

  BCryptGenRandom

  BCryptCreateHash

  BCryptHashData

  BCryptImportKeyPair

  BCryptDestroyHash

  BCryptCloseAlgorithmProvider

  BCryptFinishHash

  BCryptDestroyKey

  BCryptVerifySignature

  BCryptOpenAlgorithmProvider

  ws2_32

  recv

  send

  WSACleanup

  WSAStartup

  WSAGetLastError

  WSASetLastError

  closesocket

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 806KB - Virtual size: 806KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 30KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 73KB - Virtual size: 73KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 500B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 313KB - Virtual size: 313KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/499df614b640e6e6531f32ceb3271d7d661f5256d49f57e9d360a4791d37943f.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Code Sign

  6b:19:6f:21:49:f6:7d:cb:7c:03:03:05:06:00:08:9b

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  12-09-2024 21:28

  Not After

  12-09-2025 21:28

  Subject

  CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

  Certificate

  Issuer

  CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-01-2024 00:00

  Not After

  14-04-2035 23:59

  Subject

  CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

  Certificate

  Issuer

  CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  22-03-2021 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3f:bf:89:86:77:47:90:7c:fc:7c:c5:e9:a4:ab:32:bd:06:d5:7b:e3:73:3d:f1:53:d9:a3:84:73:9c:b9:e1:73

  Signer

  Actual PE Digest

  3f:bf:89:86:77:47:90:7c:fc:7c:c5:e9:a4:ab:32:bd:06:d5:7b:e3:73:3d:f1:53:d9:a3:84:73:9c:b9:e1:73

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4a16685ec6d408bafc872fac39012bb670ff7bba818a7af9f7dd411a383869dd.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  ff:0b:41:7a:0b:07:51:05:66:c3:7b:40:c3:67:b2:09:87:c7:01:fd:68:f4:35:43:33:30:f5:ea:8c:1b:52:b6

  Signer

  Actual PE Digest

  ff:0b:41:7a:0b:07:51:05:66:c3:7b:40:c3:67:b2:09:87:c7:01:fd:68:f4:35:43:33:30:f5:ea:8c:1b:52:b6

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\6nkapr5pnz0d\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4ac2ddb4fa2d1917ae491b5ac623e7ebf23e5e34667c63e5acd433cc6696c23d.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 880B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4acf2f8eeb71da00b6b5356b63c472157b7e0936f1f7b8f5a06aa295482319fd.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\US\source\repos\BBBEEEEAFV\obj\Debug\BBBEEEEAFV.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 893KB - Virtual size: 892KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4ad7e405f5bcbfdf1cc163212428a779fa7d890a46500f579103333722986aa1.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4b6be11fd5704e5489c7911c1659f1bb7f9901e2d5c70c2f8f126512071093cc.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 226KB - Virtual size: 226KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4ceb69afc05b1475459075f2cd5688f6aa8fe6a9ff6cae0a25d742b650c62351.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 800B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4d0b50e69d551bf15ec0a44c8471f8766ca5b98bd3b462c3bf0e976c76c1308b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  5c:ca:a8:23:69:a2:6a:ee:30:d0:17:61:6b:1c:eb:69

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  23-02-2017 00:00

  Not After

  23-02-2018 23:59

  Subject

  CN=Wondershare Technology Co.\,Ltd,OU=Information Security,O=Wondershare Technology Co.\,Ltd,L=Lasa,ST=Xizang,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  24-05-2016 00:00

  Not After

  24-06-2027 00:00

  Subject

  CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  04:00:00:00:00:01:31:89:c6:50:04

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  02-08-2011 10:00

  Not After

  29-03-2029 10:00

  Subject

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  3d:57:24:d0:90:e9:62:0d:6f:f0:b1:84:72:79:a6:8d

  Certificate

  Issuer

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  22-02-2017 00:00

  Not After

  22-02-2018 23:59

  Subject

  CN=Wondershare Technology Co.\,Ltd,OU=Information Security,O=Wondershare Technology Co.\,Ltd,L=Lasa,ST=Xizang,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  10-12-2013 00:00

  Not After

  09-12-2023 23:59

  Subject

  CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  11:21:06:f1:0f:ce:68:f0:9b:fa:e5:5b:18:cd:8f:20:01:77

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Not Before

  24-05-2016 00:00

  Not After

  24-06-2027 00:00

  Subject

  CN=GlobalSign TSA for Advanced - G2,O=GMO GlobalSign Pte Ltd,C=SG

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  04:00:00:00:00:01:31:89:c6:50:04

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

  Not Before

  02-08-2011 10:00

  Not After

  29-03-2029 10:00

  Subject

  CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  54:1b:82:e4:11:33:09:c3:c0:09:fe:79:34:ff:2c:7f:32:81:f6:5c:dd:88:60:57:64:03:0c:ef:67:ed:b8:2c

  Signer

  Actual PE Digest

  54:1b:82:e4:11:33:09:c3:c0:09:fe:79:34:ff:2c:7f:32:81:f6:5c:dd:88:60:57:64:03:0c:ef:67:ed:b8:2c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  65:e1:15:d2:7b:e6:7a:14:bf:2d:20:ed:66:9f:25:a1:1a:90:dd:37

  Signer

  Actual PE Digest

  65:e1:15:d2:7b:e6:7a:14:bf:2d:20:ed:66:9f:25:a1:1a:90:dd:37

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 27KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4e20a0aa3d323c0a1aa676c7eb3656cdd34cb69da614b4dc8aa946f5bcb2be39.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  aa:fe:22:a2:7f:3a:6e:4c:ef:90:7f:53:33:6b:16:ab:12:85:3c:08:1b:49:55:47:71:60:f5:0b:f4:ce:e6:d5

  Signer

  Actual PE Digest

  aa:fe:22:a2:7f:3a:6e:4c:ef:90:7f:53:33:6b:16:ab:12:85:3c:08:1b:49:55:47:71:60:f5:0b:f4:ce:e6:d5

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\gvrftv2\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4e2c78a6bef2caef536cf00c467a54a7081adc8118e7741043e243c0eb4843d0.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 725KB - Virtual size: 724KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4e3b746d859d34f64c28a2079f76f84d3c46b65907f52cb3da7d0ddd2c0dc875.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4eae876a9c21fadb647a6fe14c83272189ace267ebed4b320c73da14e095dec7.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 557KB - Virtual size: 557KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 179KB - Virtual size: 179KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 202KB - Virtual size: 202KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4ed6d72fef68c583439e803871226e76588ce6436d10362011b21763e0ccf176.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\4ilc74pz5av0kq\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4f43043ac4f71ee0f3416e75534ab2616ae90eb887a083b6f2e39995b334c2bc.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.3MB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4f432ba1da38c64c9298fb2c2a0271c06dc333fb66e7f2b6deebf1ec6782c6b9.exe

  .exe windows:5 windows x86 arch:x86

  370f92f843c0b2c837cd36540e0a1b85

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\pcagamecenter\src\gamecenter\Release\minigameclient.pdb

  Imports

  ws2_32

  ntohs

  WSAGetLastError

  shutdown

  WSAStartup

  WSASetLastError

  getnameinfo

  getservbyname

  inet_ntoa

  gethostbyname

  gethostname

  ioctlsocket

  sendto

  recvfrom

  listen

  accept

  freeaddrinfo

  getaddrinfo

  WSAIoctl

  setsockopt

  WSACleanup

  htons

  getsockopt

  getsockname

  getpeername

  connect

  bind

  select

  __WSAFDIsSet

  socket

  send

  recv

  closesocket

  crypt32

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  CertOpenStore

  kernel32

  GetVersionExW

  CreateEventW

  LockResource

  FindResourceExW

  WideCharToMultiByte

  GetTickCount

  GetDriveTypeW

  lstrcpynW

  lstrcpyW

  GetFullPathNameW

  FreeLibraryAndExitThread

  ExitThread

  SystemTimeToTzSpecificLocalTime

  GetEnvironmentVariableW

  FindNextFileW

  FindFirstFileW

  GetModuleFileNameA

  QueryPerformanceCounter

  GetCommandLineW

  GlobalAddAtomW

  LoadLibraryW

  GetSystemTime

  ConvertThreadToFiber

  ConvertFiberToThread

  CreateFiber

  DeleteFiber

  SwitchToFiber

  SetConsoleMode

  ReadConsoleA

  VerifyVersionInfoA

  GetSystemDirectoryA

  GetModuleHandleA

  LoadLibraryA

  VerSetConditionMask

  FormatMessageA

  ExpandEnvironmentStringsA

  PeekNamedPipe

  WaitForMultipleObjects

  SleepEx

  InitializeCriticalSection

  SetEndOfFile

  WriteConsoleW

  DebugBreak

  CreateThread

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetOEMCP

  IsValidCodePage

  FindFirstFileExW

  FindClose

  SetConsoleCtrlHandler

  FlushFileBuffers

  ReadConsoleW

  SetFilePointerEx

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetConsoleCP

  GetTimeZoneInformation

  GetFileType

  GetACP

  GetStdHandle

  GetModuleHandleExW

  ExitProcess

  GetCommandLineA

  RtlUnwind

  GetCurrentProcessId

  GetStartupInfoW

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  ResetEvent

  GetFileSize

  CloseHandle

  CreateFileW

  ReadFile

  LoadLibraryExW

  lstrcmpiW

  FreeLibrary

  GetModuleHandleW

  GetProcAddress

  FindResourceW

  LoadResource

  SizeofResource

  MulDiv

  lstrcmpW

  GlobalUnlock

  InterlockedIncrement

  GlobalLock

  GlobalAlloc

  GetCurrentThreadId

  LeaveCriticalSection

  GetModuleFileNameW

  InterlockedDecrement

  EnterCriticalSection

  SetLastError

  CreateProcessA

  CreateProcessW

  GetCurrentThread

  MultiByteToWideChar

  GetProcessHeap

  SetEvent

  IsProcessorFeaturePresent

  InterlockedPushEntrySList

  InterlockedPopEntrySList

  InitializeSListHead

  OutputDebugStringW

  IsDebuggerPresent

  GetSystemTimeAsFileTime

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  Sleep

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  GetCPInfo

  EncodePointer

  FormatMessageW

  GetStringTypeW

  GetCurrentDirectoryW

  SystemTimeToFileTime

  FileTimeToSystemTime

  DeleteCriticalSection

  HeapDestroy

  DecodePointer

  HeapAlloc

  RaiseException

  HeapReAlloc

  GetCurrentProcess

  SuspendThread

  ResumeThread

  GetThreadContext

  SetThreadContext

  FlushInstructionCache

  VirtualAlloc

  VirtualFree

  GetConsoleMode

  WaitForSingleObject

  GetLastError

  HeapSize

  InitializeCriticalSectionAndSpinCount

  HeapFree

  WriteFile

  LoadLibraryExA

  VirtualQuery

  VirtualProtect

  GetFileAttributesExW

  SetStdHandle

  user32

  GetDlgItem

  GetClientRect

  SetWindowLongW

  SetCapture

  GetClassNameW

  LoadCursorW

  CharNextW

  SetFocus

  CreateAcceleratorTableW

  MoveWindow

  GetSysColor

  GetUserObjectInformationW

  GetProcessWindowStation

  IsChild

  DestroyAcceleratorTable

  ClientToScreen

  RedrawWindow

  InvalidateRgn

  IsWindow

  RegisterClassExW

  SetWindowTextW

  SendMessageW

  ScreenToClient

  CreateWindowExW

  GetDesktopWindow

  SetWindowPos

  GetDC

  DestroyWindow

  GetFocus

  GetWindow

  CallWindowProcW

  DefWindowProcW

  SubtractRect

  ReleaseDC

  wsprintfW

  CopyRect

  GetClassInfoExW

  GetParent

  RegisterWindowMessageW

  ReleaseCapture

  FillRect

  InvalidateRect

  GetWindowTextLengthW

  GetWindowLongW

  SetForegroundWindow

  FindWindowW

  TranslateMessage

  BringWindowToTop

  PeekMessageW

  DispatchMessageW

  ShowWindow

  SetActiveWindow

  GetMessageW

  PostMessageW

  PostQuitMessage

  MessageBoxW

  MessageBoxA

  SetMenu

  RegisterHotKey

  MapWindowPoints

  BeginPaint

  EndPaint

  GetWindowTextW

  UnregisterClassW

  UnregisterHotKey

  GetWindowRect

  MonitorFromWindow

  GetSystemMetrics

  GetWindowPlacement

  GetMonitorInfoW

  gdi32

  CreateSolidBrush

  DeleteObject

  DeleteDC

  GetDeviceCaps

  GetStockObject

  CreateCompatibleDC

  SelectObject

  CreateCompatibleBitmap

  BitBlt

  SetViewportOrgEx

  GetObjectW

  advapi32

  CryptEnumProvidersW

  CryptSignHashW

  RegisterEventSourceW

  ReportEventW

  CryptDestroyHash

  CryptCreateHash

  CryptDecrypt

  CryptExportKey

  CryptAcquireContextW

  CryptReleaseContext

  CryptGenRandom

  CryptDestroyKey

  CryptSetHashParam

  CryptGetProvParam

  RegQueryValueExW

  RegCloseKey

  RegQueryInfoKeyW

  RegDeleteKeyW

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegDeleteValueW

  CryptGetUserKey

  DeregisterEventSource

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHGetSpecialFolderPathW

  ShellExecuteW

  ole32

  CoUninitialize

  CoInitialize

  CoTaskMemRealloc

  OleLockRunning

  CLSIDFromString

  OleInitialize

  CreateStreamOnHGlobal

  CoTaskMemFree

  CLSIDFromProgID

  StringFromGUID2

  CoTaskMemAlloc

  OleUninitialize

  CoGetClassObject

  CoInitializeEx

  CoCreateInstance

  PropVariantClear

  oleaut32

  SafeArrayUnaccessData

  VariantChangeType

  VarUI4FromStr

  SafeArrayAccessData

  SafeArrayCreate

  LoadRegTypeLi

  VariantInit

  LoadTypeLi

  SysFreeString

  OleCreateFontIndirect

  SysAllocString

  DispCallFunc

  SysStringLen

  SysAllocStringLen

  VariantClear

  dsound

  ord11

  shlwapi

  PathRemoveFileSpecW

  PathAppendW

  PathRemoveFileSpecA

  PathFileExistsW

  winmm

  waveOutWrite

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  netapi32

  Netbios

  wldap32

  ord143

  ord217

  ord46

  ord211

  ord60

  ord50

  ord41

  ord22

  ord26

  ord27

  ord32

  ord301

  ord200

  ord30

  ord79

  ord35

  ord33

  Sections

  .text

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 638KB - Virtual size: 637KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 27KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .detourc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .detourd

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1024B - Virtual size: 756B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 121KB - Virtual size: 124KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 92KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/4fa525bb40e57606312d30bcc45e697e6c92e9826e4ece20a5f74af64c22a5f7.exe

  .exe windows:10 windows x86 arch:x86

  9703ae33b2923ce0dd0212619f962e0b

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  AudioDG.pdb

  Imports

  msvcrt

  _ftol2

  memcmp

  _CxxThrowException

  _unlock

  _lock

  wcstoul

  ?terminate@@YAXXZ

  _except_handler4_common

  __dllonexit

  _wcmdln

  _onexit

  _initterm

  ??1type_info@@UAE@XZ

  __p__fmode

  _cexit

  _exit

  wcsncpy_s

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  memset

  __CxxFrameHandler3

  _callnewh

  _vsnwprintf

  memcpy_s

  _wcsicmp

  memmove_s

  _resetstkoflw

  malloc

  _purecall

  _errno

  free

  realloc

  __setusermatherr

  _controlfp

  memcpy

  api-ms-win-core-processenvironment-l1-2-0

  GetCommandLineW

  api-ms-win-core-com-l1-1-1

  CoTaskMemFree

  CoImpersonateClient

  CoRevertToSelf

  CLSIDFromString

  StringFromCLSID

  CoUninitialize

  CoTaskMemRealloc

  CoTaskMemAlloc

  PropVariantClear

  CoInitializeSecurity

  CoCreateInstance

  CoInitializeEx

  CoRevokeClassObject

  CoResumeClassObjects

  CoRegisterClassObject

  rpcrt4

  RpcServerRegisterIf3

  I_RpcBindingInqTransportType

  RpcServerUseProtseqEpW

  NdrServerCall2

  RpcRevertToSelf

  I_RpcBindingInqLocalClientPID

  RpcImpersonateClient

  RpcServerUnregisterIfEx

  api-ms-win-core-synch-l1-2-0

  LeaveCriticalSection

  ResetEvent

  DeleteCriticalSection

  EnterCriticalSection

  InitOnceBeginInitialize

  WaitForSingleObject

  Sleep

  InitializeCriticalSection

  WaitForMultipleObjectsEx

  WaitForSingleObjectEx

  CreateEventW

  SetEvent

  InitOnceExecuteOnce

  api-ms-win-core-libraryloader-l1-2-0

  GetProcAddress

  GetModuleFileNameW

  FreeLibrary

  GetModuleHandleA

  LockResource

  SizeofResource

  LoadResource

  FindResourceExW

  LoadLibraryExW

  GetModuleHandleW

  api-ms-win-core-processthreads-l1-1-2

  GetCurrentThreadId

  CreateThread

  GetCurrentProcessId

  GetThreadId

  GetCurrentProcess

  OpenProcess

  GetProcessId

  GetStartupInfoW

  TerminateProcess

  api-ms-win-core-errorhandling-l1-1-1

  UnhandledExceptionFilter

  RaiseException

  SetUnhandledExceptionFilter

  SetLastError

  GetLastError

  api-ms-win-core-handle-l1-1-0

  GetHandleInformation

  DuplicateHandle

  CloseHandle

  api-ms-win-security-base-l1-2-0

  MakeAbsoluteSD

  api-ms-win-core-registry-l1-1-0

  RegQueryValueExW

  RegCloseKey

  RegQueryInfoKeyW

  RegCreateKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegGetValueW

  api-ms-win-core-heap-l2-1-0

  LocalAlloc

  LocalFree

  api-ms-win-core-heap-l1-2-0

  HeapFree

  HeapSize

  HeapReAlloc

  HeapDestroy

  HeapAlloc

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceFrequency

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetLogicalProcessorInformationEx

  GetSystemTimeAsFileTime

  GetTickCount

  api-ms-win-core-memory-l1-1-2

  GetProcessWorkingSetSizeEx

  SetProcessWorkingSetSizeEx

  UnmapViewOfFile

  MapViewOfFile

  VirtualLock

  CreateFileMappingW

  VirtualUnlock

  api-ms-win-core-string-l2-1-0

  CharNextW

  api-ms-win-core-string-l1-1-0

  MultiByteToWideChar

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringA

  ntdll

  NtQueryInformationProcess

  EtwLogTraceEvent

  NtSetInformationProcess

  NtSetInformationThread

  RtlPublishWnfStateData

  NtQuerySystemInformation

  NtSetSystemInformation

  EtwEventWrite

  EtwEventWriteTransfer

  EtwGetTraceLoggerHandle

  NtDeleteWnfStateName

  EtwUnregisterTraceGuids

  NtCreateWnfStateName

  EtwEventUnregister

  EtwRegisterTraceGuidsW

  EtwTraceMessage

  EtwEventRegister

  RtlExtendMemoryBlockLookaside

  RtlFreeMemoryBlockLookaside

  RtlCreateMemoryBlockLookaside

  RtlLockMemoryZone

  RtlAllocateMemoryZone

  RtlNtStatusToDosError

  RtlCreateMemoryZone

  RtlAllocateMemoryBlockLookaside

  RtlUnlockMemoryZone

  RtlDestroyMemoryBlockLookaside

  RtlDestroyMemoryZone

  RtlSetLastWin32ErrorAndNtStatusFromNtStatus

  AlpcGetMessageAttribute

  NtAlpcCreatePort

  NtAlpcOpenSenderProcess

  RtlRandomEx

  NtClose

  NtAlpcSendWaitReceivePort

  NtAlpcAcceptConnectPort

  NtAlpcConnectPort

  RtlInitUnicodeStringEx

  AlpcInitializeMessageAttribute

  ShipAssertMsgW

  EtwEventSetInformation

  EtwGetTraceEnableFlags

  EtwGetTraceEnableLevel

  ShipAssert

  WinSqmIncrementDWORD

  api-ms-win-core-windowserrorreporting-l1-1-0

  WerRegisterMemoryBlock

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  api-ms-win-core-threadpool-legacy-l1-1-0

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  mmdevapi

  ord8

  ord2

  ord9

  api-ms-win-eventing-classicprovider-l1-1-0

  TraceMessage

  TraceEvent

  api-ms-win-eventing-provider-l1-1-0

  EventWrite

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  DelayLoadFailureHook

  Sections

  .text

  Size: 246KB - Virtual size: 245KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_CODE

  Size: 1024B - Virtual size: 784B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  RT_BSS

  Size: - Virtual size: 40B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_DATA

  Size: 512B - Virtual size: 176B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_CONST

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5030cfa10a9c06fbe2182aea828e449850e49c9f437c17e5bf8f7b634c48cd2b.exe

  .exe windows:10 windows x86 arch:x86

  b6df92b17f27e1708240ec29f2498c77

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  ImeBroker.pdb

  Imports

  user32

  PeekMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  AllowSetForegroundWindow

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetSystemMetrics

  CharNextW

  WaitForInputIdle

  msvcrt

  wcsncat_s

  _initterm

  swscanf_s

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  _wcmdln

  _amsg_exit

  __p__commode

  _XcptFilter

  ?what@exception@@UBEPBDXZ

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  tolower

  wcsnlen

  wcsrchr

  wcsncpy_s

  _lock

  _unlock

  __dllonexit

  _onexit

  ??1type_info@@UAE@XZ

  ?terminate@@YAXXZ

  _controlfp

  _except_handler4_common

  _vsnwprintf

  free

  malloc

  memcpy

  vswprintf_s

  wcsncmp

  _wcsnicmp

  _vsnwprintf_s

  ??_V@YAXPAX@Z

  _wtoi

  __wgetmainargs

  memcmp

  _CIlog

  __CxxFrameHandler3

  _CxxThrowException

  _purecall

  memmove

  _CIexp

  memset

  api-ms-win-core-com-l1-1-1

  CoReleaseServerProcess

  CoAddRefServerProcess

  CreateStreamOnHGlobal

  CoInitializeSecurity

  CoInitializeEx

  CoRegisterClassObject

  CoResumeClassObjects

  CoTaskMemFree

  CoRevokeClassObject

  CoUninitialize

  CoCreateInstance

  CoTaskMemAlloc

  api-ms-win-core-synch-l1-2-0

  OpenEventW

  Sleep

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  SetEvent

  ReleaseMutex

  OpenMutexW

  CreateMutexW

  InitOnceComplete

  CreateEventW

  ReleaseSRWLockExclusive

  WaitForSingleObject

  InitOnceBeginInitialize

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-libraryloader-l1-2-0

  LoadResource

  FreeLibrary

  GetModuleHandleA

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  FindResourceExW

  FreeLibraryAndExitThread

  GetModuleFileNameA

  GetModuleHandleW

  LockResource

  SizeofResource

  api-ms-win-core-heap-l1-2-0

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-errorhandling-l1-1-1

  SetErrorMode

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-2

  ResumeThread

  GetCurrentProcessId

  GetCurrentProcess

  CreateThread

  OpenProcessToken

  CreateProcessW

  GetStartupInfoW

  GetExitCodeProcess

  GetCurrentThreadId

  TerminateProcess

  SetPriorityClass

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventWrite

  EventActivityIdControl

  EventUnregister

  EventRegister

  EventSetInformation

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetSystemDirectoryW

  GetSystemTime

  GetTickCount64

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-security-base-l1-2-0

  AllocateAndInitializeSid

  IsValidSid

  GetSidSubAuthority

  GetTokenInformation

  GetSidSubAuthorityCount

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegOpenKeyExW

  RegGetValueW

  RegQueryValueExW

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalAlloc

  GlobalFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysStringLen

  SysAllocString

  api-ms-win-core-localization-l1-2-1

  LCMapStringW

  FormatMessageW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-file-l1-2-1

  SetFileTime

  GetFileSize

  CreateFileW

  GetTempPathW

  CreateDirectoryW

  GetTempFileNameW

  FindFirstFileW

  FindNextFileW

  FindClose

  DeleteFileW

  WriteFile

  SetEndOfFile

  GetFileAttributesW

  SetFilePointer

  api-ms-win-core-memory-l1-1-2

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-core-string-l1-1-0

  CompareStringW

  advapi32

  SetEntriesInAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  shell32

  ord165

  SHGetFolderPathW

  SHCreateDirectoryExW

  ShellExecuteW

  shlwapi

  ord12

  PathFileExistsW

  api-ms-win-appmodel-runtime-l1-1-1

  GetCurrentPackageFullName

  GetPackageFullName

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  api-ms-win-security-trustee-l1-1-1

  BuildExplicitAccessWithNameW

  profapi

  ord104

  Sections

  .text

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 187KB - Virtual size: 186KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 115KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/509e77fcd7effd3229cfdaba1c52fc413e20197e91b5af414b4c14257097b1c6.exe

  .exe windows:4 windows x64 arch:x64

  5dd6297e01c431750dea36d4bfacd868

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  SystemFunction036

  bcrypt

  BCryptGenRandom

  kernel32

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  AddVectoredExceptionHandler

  CloseHandle

  CreateFileMappingA

  CreateFileW

  CreateMutexA

  CreateThread

  CreateToolhelp32Snapshot

  DuplicateHandle

  FormatMessageW

  GetConsoleMode

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentThread

  GetEnvironmentVariableW

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFullPathNameW

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetProcessHeap

  GetStartupInfoA

  GetStdHandle

  HeapAlloc

  HeapCreate

  HeapFree

  HeapReAlloc

  InitOnceBeginInitialize

  InitOnceComplete

  MapViewOfFile

  Module32FirstW

  Module32NextW

  MultiByteToWideChar

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetLastError

  SetThreadStackGuarantee

  SetUnhandledExceptionFilter

  Sleep

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TryAcquireSRWLockExclusive

  UnmapViewOfFile

  WaitForSingleObject

  WriteConsoleW

  DeleteCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  RaiseException

  RtlUnwindEx

  VirtualProtect

  VirtualQuery

  __C_specific_handler

  ntdll

  NtWriteFile

  RtlNtStatusToDosError

  user32

  MessageBoxW

  msvcrt

  __getmainargs

  __initenv

  __iob_func

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _commode

  _fmode

  _fpreset

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcmp

  memcpy

  memmove

  memset

  signal

  strlen

  strncmp

  vfprintf

  Sections

  .text

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 400B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 3.0MB - Virtual size: 3.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 576B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 112B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 423KB - Virtual size: 422KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/52883bc653857e9cf8fc2c8fa9e5fad985fa8e193aecba917aa9f4cc09e8fa09.exe

  .exe windows:4 windows x86 arch:x86

  74aaf0b5a0230a863603c8c6bcd8756b

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  printf

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  Exports

  Exports

  main

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 234KB - Virtual size: 234KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.0MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 77KB - Virtual size: 77KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 105KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/52f9a067ce90bc745bc9a9d467a70e17f612f0d3944d730249fd980cdf5c3c79.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 800B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/531c3ed73ae00747f7bcb790e442981b3d677998abcf7067be1bdd4c6b4c9e53.exe

  .exe windows:4 windows x64 arch:x64

  147442e63270e287ed57d33257638324

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CloseHandle

  ConnectNamedPipe

  CreateFileA

  CreateNamedPipeA

  CreateThread

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetStartupInfoA

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  ReadFile

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualAlloc

  VirtualProtect

  VirtualQuery

  WriteFile

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _fmode

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcpy

  signal

  sprintf

  strlen

  strncmp

  vfprintf

  Sections

  .text

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 303KB - Virtual size: 303KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 1024B - Virtual size: 696B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 1024B - Virtual size: 568B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/53493edddf3e4509f791d0e26ea80d8b2283aa95a0f4e263ebb8fc1e7d8d9c82.exe

  .dll windows:6 windows x64 arch:x64

  2a7f4fc96fd45bdad3d7c578da691ffe

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  C:\Users\uyfguyi\source\repos\Dll1\x64\Release\Dll1.pdb

  Imports

  kernel32

  GetTempPathW

  CreateProcessW

  WaitForSingleObject

  CloseHandle

  WriteConsoleW

  CreateFileW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwindEx

  InterlockedFlushSList

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  LCMapStringW

  GetProcessHeap

  GetStdHandle

  GetFileType

  GetStringTypeW

  HeapSize

  HeapReAlloc

  SetStdHandle

  FlushFileBuffers

  WriteFile

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  user32

  wsprintfW

  Sections

  .text

  Size: 55KB - Virtual size: 54KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 248B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5374d3d072c93828f4d1a0feaa8ce21e3c3c005849bdc2d1d92da3123b09a68f.exe

  .exe windows:4 windows x86 arch:x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/53f4fa5d151b80d4e0a88ab863f6a5c85c652aafaf2b02d050f902e2bcccc7a0.exe

  .exe windows:6 windows x64 arch:x64

  0c4ded3ebc2b84ab280b022088f6fafa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  winspool.drv

  DocumentPropertiesW

  ClosePrinter

  OpenPrinterW

  GetDefaultPrinterW

  EnumPrintersW

  comdlg32

  FindTextW

  ChooseFontW

  ChooseColorW

  GetSaveFileNameW

  GetOpenFileNameW

  comctl32

  ImageList_GetImageInfo

  FlatSB_SetScrollInfo

  InitCommonControls

  ImageList_DragMove

  ImageList_Destroy

  _TrackMouseEvent

  ImageList_DragShowNolock

  ImageList_Add

  FlatSB_SetScrollProp

  ImageList_GetDragImage

  ImageList_Create

  ImageList_EndDrag

  ImageList_DrawEx

  ImageList_SetImageCount

  FlatSB_GetScrollPos

  FlatSB_SetScrollPos

  InitializeFlatSB

  ImageList_Copy

  FlatSB_GetScrollInfo

  ImageList_Write

  ImageList_DrawIndirect

  ImageList_SetBkColor

  ImageList_GetBkColor

  ImageList_BeginDrag

  ImageList_GetIcon

  ImageList_Replace

  ImageList_GetImageCount

  ImageList_DragEnter

  ImageList_GetIconSize

  ImageList_SetIconSize

  ImageList_Read

  ImageList_DragLeave

  ImageList_LoadImageW

  ImageList_Draw

  ImageList_Remove

  ImageList_ReplaceIcon

  ImageList_SetOverlayImage

  shell32

  Shell_NotifyIconW

  SHAppBarMessage

  user32

  MoveWindow

  CopyImage

  SetMenuItemInfoW

  GetMenuItemInfoW

  DefFrameProcW

  GetDlgCtrlID

  FrameRect

  RegisterWindowMessageW

  GetMenuStringW

  FillRect

  SendMessageA

  EnumWindows

  ShowOwnedPopups

  GetClassInfoW

  GetScrollRange

  SetActiveWindow

  GetActiveWindow

  DrawEdge

  GetKeyboardLayoutList

  LoadBitmapW

  EnumChildWindows

  GetScrollBarInfo

  UnhookWindowsHookEx

  SetCapture

  GetCapture

  ShowCaret

  CreatePopupMenu

  GetMenuItemID

  CharLowerBuffW

  PostMessageW

  IsZoomed

  SetParent

  DrawMenuBar

  GetClientRect

  IsChild

  SendDlgItemMessageW

  IsIconic

  CallNextHookEx

  ShowWindow

  GetWindowTextW

  SetForegroundWindow

  GetWindowTextLengthW

  IsDialogMessageW

  DestroyWindow

  RegisterClassW

  EndMenu

  CharNextW

  GetFocus

  GetDC

  SetFocus

  ReleaseDC

  SetScrollRange

  DrawTextW

  PeekMessageA

  MessageBeep

  RemovePropW

  GetSubMenu

  DestroyIcon

  IsWindowVisible

  DispatchMessageA

  UnregisterClassW

  GetTopWindow

  SendMessageW

  GetWindowLongPtrW

  SetWindowLongPtrW

  LoadStringW

  CreateMenu

  CharLowerW

  SetWindowRgn

  SetWindowPos

  GetMenuItemCount

  GetSysColorBrush

  GetWindowDC

  DrawTextExW

  GetScrollInfo

  SetWindowTextW

  GetMessageExtraInfo

  GetSysColor

  EnableScrollBar

  TrackPopupMenu

  DrawIconEx

  GetClassNameW

  GetMessagePos

  GetIconInfo

  SetScrollInfo

  GetKeyNameTextW

  GetDesktopWindow

  SetCursorPos

  GetCursorPos

  SetMenu

  GetMenuState

  GetMenu

  SetRect

  GetKeyState

  ValidateRect

  GetCursor

  KillTimer

  WaitMessage

  TranslateMDISysAccel

  GetWindowPlacement

  CreateIconIndirect

  CreateWindowExW

  GetMessageW

  GetDCEx

  PeekMessageW

  MonitorFromWindow

  GetUpdateRect

  SetTimer

  WindowFromPoint

  BeginPaint

  RegisterClipboardFormatW

  MapVirtualKeyW

  OffsetRect

  IsWindowUnicode

  DispatchMessageW

  CreateAcceleratorTableW

  DefMDIChildProcW

  GetSystemMenu

  SetScrollPos

  GetScrollPos

  DrawFocusRect

  ReleaseCapture

  LoadCursorW

  ScrollWindow

  GetLastActivePopup

  GetSystemMetrics

  CharUpperBuffW

  SetClassLongPtrW

  GetClassLongPtrW

  SetClipboardData

  GetClipboardData

  ClientToScreen

  SetWindowPlacement

  GetMonitorInfoW

  CheckMenuItem

  CharUpperW

  DefWindowProcW

  GetForegroundWindow

  EnableWindow

  GetWindowThreadProcessId

  RedrawWindow

  EndPaint

  MsgWaitForMultipleObjectsEx

  LoadKeyboardLayoutW

  ActivateKeyboardLayout

  GetParent

  MonitorFromRect

  InsertMenuItemW

  GetPropW

  MessageBoxW

  SetPropW

  UpdateWindow

  MsgWaitForMultipleObjects

  DestroyMenu

  SetWindowsHookExW

  EmptyClipboard

  GetDlgItem

  AdjustWindowRectEx

  IsWindow

  DrawIcon

  EnumThreadWindows

  InvalidateRect

  GetKeyboardState

  ScreenToClient

  DrawFrameControl

  BringWindowToTop

  SetCursor

  CreateIcon

  RemoveMenu

  GetKeyboardLayoutNameW

  OpenClipboard

  TranslateMessage

  MapWindowPoints

  EnumDisplayMonitors

  CallWindowProcW

  CloseClipboard

  DestroyCursor

  CopyIcon

  PostQuitMessage

  ShowScrollBar

  EnableMenuItem

  HideCaret

  FindWindowExW

  LoadIconW

  SystemParametersInfoW

  MonitorFromPoint

  GetWindow

  GetWindowRect

  InsertMenuW

  IsWindowEnabled

  IsDialogMessageA

  FindWindowW

  GetKeyboardLayout

  DeleteMenu

  version

  GetFileVersionInfoSizeW

  VerQueryValueW

  GetFileVersionInfoW

  urlmon

  URLDownloadToFileW

  oleaut32

  SafeArrayPutElement

  GetErrorInfo

  VariantInit

  VariantClear

  SysFreeString

  SafeArrayAccessData

  SysReAllocStringLen

  SafeArrayCreate

  SafeArrayGetElement

  SysAllocStringLen

  SafeArrayUnaccessData

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetUBound

  SafeArrayGetLBound

  VariantCopyInd

  VariantChangeType

  advapi32

  RegSetValueExW

  RegConnectRegistryW

  RegEnumKeyExW

  RegLoadKeyW

  RegDeleteKeyW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegUnLoadKeyW

  RegSaveKeyW

  RegDeleteValueW

  RegReplaceKeyW

  RegFlushKey

  RegQueryValueExW

  RegEnumValueW

  RegCloseKey

  RegCreateKeyExW

  RegRestoreKeyW

  msvcrt

  memcpy

  memset

  kernel32

  RtlUnwindEx

  GetACP

  LocalFree

  CloseHandle

  GetCurrentProcessId

  SizeofResource

  QueryPerformanceFrequency

  IsDebuggerPresent

  FindNextFileW

  GetFullPathNameW

  VirtualFree

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  RtlUnwind

  GetCPInfo

  EnumSystemLocalesW

  GetStdHandle

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  GetModuleHandleW

  FreeLibrary

  TryEnterCriticalSection

  HeapDestroy

  FileTimeToDosDateTime

  ReadFile

  GetLastError

  GetModuleFileNameW

  SetLastError

  GlobalAlloc

  GlobalUnlock

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  MulDiv

  FreeResource

  GetVersion

  RaiseException

  GlobalAddAtomW

  GetSystemTimeAsFileTime

  FormatMessageW

  OpenProcess

  SwitchToThread

  GetExitCodeThread

  OutputDebugStringW

  GetCurrentThread

  IsBadReadPtr

  LoadLibraryExW

  TerminateProcess

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  GlobalFindAtomW

  VirtualQueryEx

  GlobalFree

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetStartupInfoW

  GlobalDeleteAtom

  GetFileAttributesW

  InitializeCriticalSection

  GetThreadPriority

  GetCurrentProcess

  SetThreadPriority

  GlobalLock

  VirtualAlloc

  GetSystemInfo

  GetCommandLineW

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  WinExec

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  LCMapStringW

  GetDiskFreeSpaceW

  VerSetConditionMask

  FindFirstFileW

  GetUserDefaultUILanguage

  lstrlenW

  QueryPerformanceCounter

  SetEndOfFile

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  CreateFileW

  GetLocaleInfoW

  EnumResourceNamesW

  DeleteFileW

  GetLocalTime

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  GetDateFormatW

  TlsGetValue

  SetErrorMode

  GetComputerNameW

  IsValidLocale

  TlsSetValue

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  RemoveDirectoryW

  CreateEventW

  WaitForMultipleObjectsEx

  SetThreadLocale

  GetThreadLocale

  ole32

  IsEqualGUID

  OleInitialize

  OleUninitialize

  CoInitialize

  CoCreateInstance

  CoUninitialize

  CoTaskMemFree

  CoTaskMemAlloc

  gdi32

  Pie

  SetBkMode

  CreateCompatibleBitmap

  GetEnhMetaFileHeader

  RectVisible

  AngleArc

  ResizePalette

  SetAbortProc

  SetTextColor

  StretchBlt

  RoundRect

  SelectClipRgn

  RestoreDC

  SetRectRgn

  GetTextMetricsW

  GetWindowOrgEx

  CreatePalette

  PolyBezierTo

  CreateICW

  CreateDCW

  GetStockObject

  CreateSolidBrush

  Polygon

  MoveToEx

  PlayEnhMetaFile

  Ellipse

  StartPage

  GetBitmapBits

  StartDocW

  AbortDoc

  GetSystemPaletteEntries

  GetEnhMetaFileBits

  GetEnhMetaFilePaletteEntries

  CreatePenIndirect

  CreateFontIndirectW

  PolyBezier

  EndDoc

  GetObjectW

  GetWinMetaFileBits

  SetROP2

  GetEnhMetaFileDescriptionW

  ArcTo

  Arc

  SelectPalette

  ExcludeClipRect

  MaskBlt

  SetWindowOrgEx

  EndPage

  DeleteEnhMetaFile

  Chord

  SetDIBits

  SetViewportOrgEx

  CreateRectRgn

  RealizePalette

  SetDIBColorTable

  GetDIBColorTable

  CreateBrushIndirect

  PatBlt

  SetEnhMetaFileBits

  Rectangle

  SaveDC

  DeleteDC

  FrameRgn

  BitBlt

  GetDeviceCaps

  GetTextExtentPoint32W

  GetClipBox

  IntersectClipRect

  Polyline

  CreateBitmap

  SetWinMetaFileBits

  GetStretchBltMode

  CreateDIBitmap

  SetStretchBltMode

  GetDIBits

  CreateDIBSection

  LineTo

  GetRgnBox

  EnumFontsW

  CreateHalftonePalette

  SelectObject

  DeleteObject

  ExtFloodFill

  UnrealizeObject

  CopyEnhMetaFileW

  SetBkColor

  CreateCompatibleDC

  GetBrushOrgEx

  GetCurrentPositionEx

  GetNearestPaletteIndex

  GetTextExtentPointW

  ExtTextOutW

  SetBrushOrgEx

  GetPixel

  GdiFlush

  SetPixel

  EnumFontFamiliesExW

  StretchDIBits

  GetPaletteEntries

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 4.0MB - Virtual size: 4.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 378KB - Virtual size: 378KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 53KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 154B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 644B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 109B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 187KB - Virtual size: 187KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 211KB - Virtual size: 210KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11.5MB - Virtual size: 11.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .debug

  Size: 11.7MB - Virtual size: 11.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/546bd73bca7e70f8597b7841f90214b86c0a04163a6ac0b5023b0ebebe81c043.exe

  .exe windows:4 windows x64 arch:x64

  c4631f4d6e96dca90c09fbad041b2727

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CloseHandle

  CreateRemoteThread

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetFileAttributesA

  GetLastError

  GetStartupInfoA

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  WaitForSingleObject

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _fmode

  _initterm

  _onexit

  _time64

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcpy

  printf

  signal

  strchr

  strlen

  strncmp

  vfprintf

  Sections

  .text

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 1024B - Virtual size: 684B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 1024B - Virtual size: 572B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/5511f60a092a4c75f07d693c190f6857322462b75d27699f639a198a07a15c5e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5594d3f8cdacf2136eb394a5fd2ac2f6f641a820c19153179bc05ff22a4cab30.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/563f6936421d587af73cab59d466deb7bfe961fd7bb119b3366f20bb5be45915.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/56ae5bba6fe924b256f6bae52762d29816fe2b92500b7be0baba2ca0ec396db4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  f5:87:ad:5b:bb:5e:52:1e:99:fd:0b:c5:89:f4:d6:0f:e3:ea:da:09:44:5b:ee:bd:e9:6a:5c:61:c1:fd:a5:31

  Signer

  Actual PE Digest

  f5:87:ad:5b:bb:5e:52:1e:99:fd:0b:c5:89:f4:d6:0f:e3:ea:da:09:44:5b:ee:bd:e9:6a:5c:61:c1:fd:a5:31

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\rtdg3x6mpx\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5756eb17961a1facf1f1c972dde0185932f10f7e7a6b3e756ac785418887eb26.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  28:c8:d9:3e:b3:a9:f8:da:d2:0d:9c:e7:1f:12:b4:9b:73:b8:c4:a4:e7:05:b7:44:26:f5:f0:b6:a6:f7:65:14

  Signer

  Actual PE Digest

  28:c8:d9:3e:b3:a9:f8:da:d2:0d:9c:e7:1f:12:b4:9b:73:b8:c4:a4:e7:05:b7:44:26:f5:f0:b6:a6:f7:65:14

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\unsnla1p\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/57d8364e9b83c591614899eaf932214b094a1d07370ac32d562936eaf2cf5e21.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 172KB - Virtual size: 172KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/58831c96d6fa9be6ef43ed5eace458ed89201421b1248298f24c1597129d40cd.exe

  .exe windows:6 windows x64 arch:x64

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.6MB - Virtual size: 2.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 333KB - Virtual size: 704KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 60KB - Virtual size: 60KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 512B - Virtual size: 168B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 48KB - Virtual size: 47KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5a4308d45dc245870376ece2209450e5ca46872e632c81c3c61178f139ef223d.exe

  .exe windows:6 windows x86 arch:x86

  53ff33fd5198e78ab468db682bbdf2b7

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WaitForSingleObject

  LoadLibraryW

  CreateThread

  MultiByteToWideChar

  GetStringTypeW

  WideCharToMultiByte

  CloseHandle

  GetCurrentThreadId

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  EncodePointer

  DecodePointer

  LCMapStringEx

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  GetModuleHandleW

  GetProcAddress

  GetCPInfo

  IsProcessorFeaturePresent

  GetCurrentProcessId

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  GetCurrentProcess

  TerminateProcess

  SetEndOfFile

  RaiseException

  RtlUnwind

  GetLastError

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  ExitProcess

  GetCommandLineA

  GetCommandLineW

  HeapAlloc

  HeapFree

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetFileType

  GetConsoleOutputCP

  GetConsoleMode

  GetFileSizeEx

  SetFilePointerEx

  FlushFileBuffers

  ReadFile

  HeapReAlloc

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  GetProcessHeap

  CreateFileW

  ReadConsoleW

  HeapSize

  WriteConsoleW

  Sections

  .text

  Size: 145KB - Virtual size: 145KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 54KB - Virtual size: 53KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .cSs

  Size: 927KB - Virtual size: 926KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5b81bfd4f69e9db7eddd2bacb2033ae1936bdcefd4b73e164181c5a6cc5852d8.exe

  .exe windows:6 windows x64 arch:x64

  7b434ed49e0435158e43ed531f33dcdf

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\ssasr\x64\Release\ssasr.pdb

  Imports

  kernel32

  GetProcAddress

  LoadLibraryA

  QueryFullProcessImageNameW

  CopyFileA

  GetComputerNameA

  GetModuleFileNameA

  WideCharToMultiByte

  CreateToolhelp32Snapshot

  Process32First

  Process32Next

  K32GetModuleFileNameExA

  SetEndOfFile

  GetSystemTimeAsFileTime

  OpenProcess

  CreateProcessW

  ResumeThread

  SuspendThread

  CreateThread

  TerminateProcess

  GetProcessTimes

  Sleep

  CreateEventA

  WaitForSingleObject

  SetEvent

  GetLastError

  MultiByteToWideChar

  CloseHandle

  WriteConsoleW

  HeapSize

  FormatMessageA

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  LocalFree

  GetLocaleInfoEx

  EncodePointer

  DecodePointer

  LCMapStringEx

  GetStringTypeW

  CompareStringEx

  GetCPInfo

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  GetCurrentProcess

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  InitializeSListHead

  RtlPcToFileHeader

  RaiseException

  RtlUnwindEx

  InterlockedPushEntrySList

  InterlockedFlushSList

  SetLastError

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  GetStdHandle

  WriteFile

  GetCommandLineA

  GetCommandLineW

  GetCurrentThread

  HeapFree

  HeapAlloc

  GetTempPathW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  IsThreadAFiber

  VirtualProtect

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetFileType

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  ReadFile

  GetFileSizeEx

  SetFilePointerEx

  ReadConsoleW

  CreateDirectoryW

  HeapReAlloc

  SetConsoleCtrlHandler

  GetTimeZoneInformation

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  GetProcessHeap

  OutputDebugStringW

  SetStdHandle

  CreateFileW

  RtlUnwind

  advapi32

  StartServiceW

  StartServiceA

  StartServiceCtrlDispatcherA

  SetServiceStatus

  RegisterServiceCtrlHandlerA

  QueryServiceStatusEx

  OpenServiceW

  OpenServiceA

  OpenSCManagerW

  OpenSCManagerA

  CreateServiceA

  ControlService

  CloseServiceHandle

  ChangeServiceConfig2A

  shell32

  SHFileOperationA

  Sections

  .text

  Size: 1005KB - Virtual size: 1004KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 164KB - Virtual size: 163KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 373B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .fptable

  Size: 1024B - Virtual size: 563B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5b9481d9022b0efcaed04513d338048de4aa3e1328bacc0966486ef322c0d086.exe

  .exe windows:6 windows x64 arch:x64

  49403c7fa5940d83b3c1972c644d5f4b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  GetStringTypeW

  GetFileType

  SetStdHandle

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  IsValidCodePage

  FindNextFileW

  FindFirstFileExW

  FindClose

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  TerminateProcess

  HeapSize

  GetCurrentProcess

  GetModuleFileNameW

  WriteFile

  GetStdHandle

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  HeapReAlloc

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  CreateFileW

  CloseHandle

  WriteConsoleW

  ExitProcess

  GetModuleHandleA

  user32

  UpdateLayeredWindow

  AnimateWindow

  ShowWindow

  GetClassInfoExA

  CallWindowProcA

  DefWindowProcA

  DrawCaption

  GetMouseMovePointsEx

  ToUnicodeEx

  SetLayeredWindowAttributes

  ShowWindowAsync

  GetWindowPlacement

  DeferWindowPos

  GetClipboardSequenceNumber

  GetClipboardViewer

  EmptyClipboard

  IsClipboardFormatAvailable

  GetPriorityClipboardFormat

  GetOpenClipboardWindow

  CharToOemBuffA

  CharNextExA

  CharPrevExA

  IsCharAlphaNumericA

  GetAltTabInfoA

  RealGetWindowClassA

  GetComboBoxInfo

  GetWindowModuleFileNameA

  ChangeDisplaySettingsExA

  TileWindows

  DlgDirSelectExA

  GetIconInfo

  DrawIconEx

  CheckMenuRadioItem

  IsGUIThread

  GetParent

  GetClassLongA

  SetClassWord

  SetWindowLongA

  PtInRect

  SubtractRect

  SetRect

  SetSysColors

  MapWindowPoints

  ScreenToClient

  SetCaretBlinkTime

  SetCursorPos

  MessageBoxIndirectA

  AdjustWindowRect

  EnumPropsExA

  ShowScrollBar

  ScrollWindow

  LockWindowUpdate

  ValidateRgn

  InvalidateRgn

  GetWindowRgnBox

  GetWindowDC

  GetDC

  WindowFromDC

  PaintDesktop

  MenuItemFromPoint

  SetMenuDefaultItem

  SetMenuItemInfoA

  TrackPopupMenu

  ModifyMenuA

  GetMenuItemID

  GetSubMenu

  GetMenuStringA

  IsWindowEnabled

  EnableWindow

  IsWindowUnicode

  GetCapture

  VkKeyScanA

  ToAscii

  GetKeyboardState

  GetKeyState

  GetActiveWindow

  winspool.drv

  ResetPrinterA

  SetJobA

  EnumJobsA

  SetPrinterA

  GetPrinterA

  WritePrinter

  FlushPrinter

  AbortPrinter

  ReadPrinter

  GetPrinterDataA

  ConnectToPrinterDlg

  ConfigurePortA

  GetPrinterDataExA

  EnumPrinterDataA

  EnumPrinterDataExA

  EnumPrinterKeyA

  SetPrinterDataA

  FindNextPrinterChangeNotification

  FindClosePrinterChangeNotification

  GetFormA

  SetPortA

  comdlg32

  ChooseColorA

  FindTextA

  ReplaceTextA

  GetOpenFileNameA

  PrintDlgA

  PrintDlgExA

  CommDlgExtendedError

  PageSetupDlgA

  ChooseFontA

  GetFileTitleA

  GetSaveFileNameA

  advapi32

  DecryptFileA

  shell32

  ShellExecuteExA

  ord716

  SHPathPrepareForWriteA

  SHBindToParent

  ord176

  ord47

  SHGetDataFromIDListA

  SHGetInstanceExplorer

  ord645

  ord644

  DragQueryFileA

  DragQueryPoint

  DragFinish

  DragAcceptFiles

  ShellExecuteA

  ShellAboutA

  DuplicateIcon

  ExtractIconExA

  SHFileOperationA

  ord4

  SHGetFileInfoA

  SHGetDiskFreeSpaceExA

  ord179

  SHSetLocalizedName

  ord727

  SHGetIconOverlayIndexA

  ord19

  ord25

  ord155

  ord153

  ord152

  ord24

  ord21

  ord23

  ord27

  ord189

  SHBrowseForFolderA

  SHGetDesktopFolder

  SHChangeNotify

  ord191

  ord2

  dxgi

  CreateDXGIFactory

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 42KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5c79b3fea3eeca766d7e1296493f17d3f827a37662cd93ee012574218a9c93a3.exe

  .exe windows:6 windows x64 arch:x64

  cb5b4e6c568d424c61939b08a4fe8769

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  E:\BRONKZ BACKUP 16 02 2024\Loaders C# Bronkz Private Store\Spoofer Valorant C#\Bypass Valorant TPM C++\KeyAuth-CPP-Example-main\x64\Release\11wY50.pdb

  Imports

  kernel32

  GetFileType

  ReadFile

  PeekNamedPipe

  WaitForMultipleObjects

  CreateFileA

  GetFileSizeEx

  WideCharToMultiByte

  AcquireSRWLockExclusive

  WakeAllConditionVariable

  SleepConditionVariableSRW

  RtlCaptureContext

  FreeLibrary

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetSystemDirectoryA

  QueryPerformanceFrequency

  VerSetConditionMask

  SleepEx

  MultiByteToWideChar

  EnterCriticalSection

  FormatMessageA

  SetLastError

  LocalFree

  CloseHandle

  GetCurrentProcess

  GetProcessHeap

  DeleteCriticalSection

  HeapDestroy

  HeapAlloc

  HeapReAlloc

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetModuleHandleW

  GetCurrentProcessId

  GetCurrentThreadId

  GetEnvironmentVariableA

  WaitForSingleObjectEx

  MoveFileExA

  GetTickCount

  QueryPerformanceCounter

  VerifyVersionInfoA

  LoadLibraryA

  GetProcAddress

  LeaveCriticalSection

  GetSystemTimeAsFileTime

  GetModuleHandleA

  GetLastError

  HeapSize

  InitializeCriticalSectionEx

  HeapFree

  GetConsoleWindow

  SetConsoleTitleA

  SetConsoleTextAttribute

  SetConsoleScreenBufferInfoEx

  GetConsoleScreenBufferInfoEx

  SetConsoleMode

  GetConsoleMode

  Sleep

  RtlLookupFunctionEntry

  GetStdHandle

  InitializeSListHead

  OutputDebugStringW

  ReleaseSRWLockExclusive

  user32

  SetWindowLongA

  MoveWindow

  GetWindowRect

  GetWindowLongA

  MessageBoxA

  advapi32

  CryptEncrypt

  GetTokenInformation

  GetLengthSid

  OpenProcessToken

  IsValidSid

  CopySid

  ConvertSidToStringSidA

  CryptAcquireContextA

  CryptReleaseContext

  CryptGetHashParam

  CryptGenRandom

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  CryptDestroyKey

  CryptImportKey

  shell32

  ShellExecuteA

  msvcp140

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

  ?id@?$ctype@D@std@@2V0locale@2@A

  ?_Xbad_function_call@std@@YAXXZ

  ??0_Lockit@std@@QEAA@H@Z

  ??1_Lockit@std@@QEAA@XZ

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?uncaught_exception@std@@YA_NXZ

  _Cnd_do_broadcast_at_thread_exit

  ?_Throw_Cpp_error@std@@YAXH@Z

  ??Bid@locale@std@@QEAA_KXZ

  ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

  ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?width@ios_base@std@@QEBA_JXZ

  ?width@ios_base@std@@QEAA_J_J@Z

  ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

  ?_Random_device@std@@YAIXZ

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  urlmon

  URLDownloadToFileA

  normaliz

  IdnToAscii

  wldap32

  ord33

  ord46

  ord35

  ord27

  ord26

  ord22

  ord41

  ord32

  ord45

  ord60

  ord211

  ord217

  ord143

  ord79

  ord30

  ord200

  ord301

  ord50

  crypt32

  CertFreeCertificateChain

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertGetNameStringA

  CertFindExtension

  CertAddCertificateContextToStore

  CryptDecodeObjectEx

  PFXImportCertStore

  CryptStringToBinaryA

  CertFreeCertificateContext

  CertFindCertificateInStore

  CertEnumCertificatesInStore

  CertOpenStore

  CertCloseStore

  ws2_32

  ntohl

  gethostname

  sendto

  recvfrom

  freeaddrinfo

  getaddrinfo

  select

  __WSAFDIsSet

  ioctlsocket

  listen

  htonl

  accept

  WSACleanup

  WSAIoctl

  WSASetLastError

  socket

  setsockopt

  ntohs

  htons

  getsockopt

  getsockname

  getpeername

  connect

  bind

  WSAGetLastError

  send

  recv

  closesocket

  WSAStartup

  userenv

  UnloadUserProfile

  vcruntime140

  __std_exception_destroy

  _CxxThrowException

  __std_exception_copy

  memchr

  __std_terminate

  memcpy

  memmove

  memset

  __C_specific_handler

  __current_exception_context

  __current_exception

  memcmp

  strstr

  strrchr

  strchr

  vcruntime140_1

  __CxxFrameHandler4

  api-ms-win-crt-runtime-l1-1-0

  _initterm_e

  __sys_nerr

  _errno

  _invalid_parameter_noinfo_noreturn

  exit

  strerror

  _invalid_parameter_noinfo

  _getpid

  system

  _beginthreadex

  terminate

  _register_thread_local_exe_atexit_callback

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  _cexit

  _seh_filter_exe

  _set_app_type

  _c_exit

  _get_initial_narrow_environment

  _resetstkoflw

  _initterm

  _exit

  __p___argv

  __p___argc

  api-ms-win-crt-heap-l1-1-0

  calloc

  malloc

  _set_new_mode

  realloc

  free

  _callnewh

  api-ms-win-crt-utility-l1-1-0

  rand

  qsort

  api-ms-win-crt-stdio-l1-1-0

  feof

  fseek

  __stdio_common_vfprintf

  __acrt_iob_func

  __p__commode

  ftell

  __stdio_common_vsscanf

  fputs

  _read

  _write

  _close

  _open

  _set_fmode

  fopen

  _lseeki64

  fgets

  fclose

  __stdio_common_vsprintf

  fflush

  fread

  fwrite

  fputc

  api-ms-win-crt-convert-l1-1-0

  strtoul

  strtol

  strtoull

  strtod

  atoi

  strtoll

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  localeconv

  api-ms-win-crt-time-l1-1-0

  _time64

  _gmtime64

  api-ms-win-crt-string-l1-1-0

  strncmp

  strpbrk

  strspn

  strncpy

  strcmp

  _strdup

  strcspn

  tolower

  isupper

  api-ms-win-crt-filesystem-l1-1-0

  _unlink

  _access

  _fstat64

  _stat64

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  _dclass

  Sections

  .text

  Size: 399KB - Virtual size: 399KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 96KB - Virtual size: 96KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5dadc4b400540ed0ce0cc4947ce32817c32d0e2b808c5c5a8519bcf7d56ce810.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  eSbb.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 952KB - Virtual size: 952KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5e3a1a463e8db9ecffcce81fcd53169562dc8dc0e8974e09376639aaef0e61ae.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  gxNN.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 897KB - Virtual size: 897KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5e4365fd2f80dee215bee29d3aeab95088317d09141449faf0d655cc6094cf66.exe

  .exe windows:4 windows x64 arch:x64

  147442e63270e287ed57d33257638324

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  CloseHandle

  ConnectNamedPipe

  CreateFileA

  CreateNamedPipeA

  CreateThread

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetStartupInfoA

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  ReadFile

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualAlloc

  VirtualProtect

  VirtualQuery

  WriteFile

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _fmode

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcpy

  signal

  sprintf

  strlen

  strncmp

  vfprintf

  Sections

  .text

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 303KB - Virtual size: 303KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 1024B - Virtual size: 696B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 1024B - Virtual size: 568B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/5ee0d7eda49cc7bcf2e445c36be3253e971ce4e8147537a8d4a02918411777f3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  29:cd:f4:31:5d:81:68:c7:e7:e9:af:10:82:a4:5e:ce:5f:ec:21:bb:81:55:ce:05:80:15:94:0c:1f:8c:4a:f3

  Signer

  Actual PE Digest

  29:cd:f4:31:5d:81:68:c7:e7:e9:af:10:82:a4:5e:ce:5f:ec:21:bb:81:55:ce:05:80:15:94:0c:1f:8c:4a:f3

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\1was77aaf\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5ef26f795226e5f0d2919f1a62001139585d0da64530e20976db9879695c2186.exe

  .exe windows:5 windows x86 arch:x86

  00be6e6c4f9e287672c8301b72bdabf3

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

  Imports

  kernel32

  GetLastError

  SetLastError

  GetCurrentProcess

  DeviceIoControl

  SetFileTime

  CloseHandle

  CreateDirectoryW

  RemoveDirectoryW

  CreateFileW

  DeleteFileW

  CreateHardLinkW

  GetShortPathNameW

  GetLongPathNameW

  MoveFileW

  GetFileType

  GetStdHandle

  WriteFile

  ReadFile

  FlushFileBuffers

  SetEndOfFile

  SetFilePointer

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetVersionExW

  GetCurrentDirectoryW

  GetFullPathNameW

  FoldStringW

  GetModuleFileNameW

  GetModuleHandleW

  FindResourceW

  FreeLibrary

  GetProcAddress

  GetCurrentProcessId

  ExitProcess

  SetThreadExecutionState

  Sleep

  LoadLibraryW

  GetSystemDirectoryW

  CompareStringW

  AllocConsole

  FreeConsole

  AttachConsole

  WriteConsoleW

  GetProcessAffinityMask

  CreateThread

  SetThreadPriority

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  WaitForSingleObject

  CreateEventW

  CreateSemaphoreW

  GetSystemTime

  SystemTimeToTzSpecificLocalTime

  TzSpecificLocalTimeToSystemTime

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  LocalFileTimeToFileTime

  FileTimeToSystemTime

  GetCPInfo

  IsDBCSLeadByte

  MultiByteToWideChar

  WideCharToMultiByte

  GlobalAlloc

  GetTickCount

  LockResource

  GlobalLock

  GlobalUnlock

  GlobalFree

  LoadResource

  SizeofResource

  SetCurrentDirectoryW

  GetExitCodeProcess

  GetLocalTime

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  OpenFileMappingW

  GetCommandLineW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  GetTempPathW

  MoveFileExW

  GetLocaleInfoW

  GetTimeFormatW

  GetDateFormatW

  GetNumberFormatW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapSize

  SetStdHandle

  GetProcessHeap

  RaiseException

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  IsProcessorFeaturePresent

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  TerminateProcess

  RtlUnwind

  EncodePointer

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  QueryPerformanceFrequency

  GetModuleHandleExW

  GetModuleFileNameA

  GetACP

  HeapFree

  HeapAlloc

  HeapReAlloc

  GetStringTypeW

  LCMapStringW

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  DecodePointer

  gdiplus

  GdiplusShutdown

  GdiplusStartup

  GdipCreateHBITMAPFromBitmap

  GdipCreateBitmapFromStreamICM

  GdipCreateBitmapFromStream

  GdipDisposeImage

  GdipCloneImage

  GdipFree

  GdipAlloc

  Sections

  .text

  Size: 186KB - Virtual size: 186KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 512B - Virtual size: 232B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 56KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5f20ea0b27db955d122e3cc2a7ad411550bb4b73692fb474ba01aeed0f182979.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  56:50:d8:12:ef:bd:ec:ff:56:8a:16:01:c0:15:46:cb:c3:30:61:59:27:be:9a:68:c1:1f:74:36:fe:96:41:d1

  Signer

  Actual PE Digest

  56:50:d8:12:ef:bd:ec:ff:56:8a:16:01:c0:15:46:cb:c3:30:61:59:27:be:9a:68:c1:1f:74:36:fe:96:41:d1

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\9ehey4w1m7v\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 316KB - Virtual size: 315KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/5fe11452c901b9eb15809a33ecc6bb94c9d1ec87553708eac94ad19969cbaa8c.exe

  .exe windows:1 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/60054c4447cabaeca4828be3aa11dedd4d8492f9f0b4aff940400e2067da6dee.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .mvid

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6010ea1717d7d8686b599dc76f56ba73200d7a468fdf8ac15f62c93d7474ca6d.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/60bb3a6004eda4dd946b5da7d1abd7f42dec2fd50d2da94aaeb4e21989c0bf32.exe

  .exe windows:5 windows x64 arch:x64

  e8a30656287fe831c9782204ed10cd68

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb

  Imports

  kernel32

  LocalFree

  GetLastError

  SetLastError

  FormatMessageW

  GetFileType

  GetStdHandle

  WriteFile

  ReadFile

  FlushFileBuffers

  SetEndOfFile

  SetFilePointer

  SetFileTime

  CloseHandle

  CreateFileW

  GetCurrentProcessId

  CreateDirectoryW

  RemoveDirectoryW

  SetFileAttributesW

  GetFileAttributesW

  DeleteFileW

  MoveFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetVersionExW

  GetModuleFileNameW

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetFullPathNameW

  FoldStringW

  GetModuleHandleW

  FindResourceW

  FreeLibrary

  GetProcAddress

  ExpandEnvironmentStringsW

  ExitProcess

  SetThreadExecutionState

  Sleep

  LoadLibraryW

  GetSystemDirectoryW

  CompareStringW

  AllocConsole

  FreeConsole

  AttachConsole

  WriteConsoleW

  SystemTimeToTzSpecificLocalTime

  TzSpecificLocalTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  FileTimeToSystemTime

  GetCPInfo

  IsDBCSLeadByte

  MultiByteToWideChar

  WideCharToMultiByte

  GlobalAlloc

  LockResource

  GlobalLock

  GlobalUnlock

  GlobalFree

  LoadResource

  SizeofResource

  GetTimeFormatW

  GetDateFormatW

  GetCurrentProcess

  GetExitCodeProcess

  WaitForSingleObject

  GetLocalTime

  GetTickCount

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  OpenFileMappingW

  GetCommandLineW

  SetEnvironmentVariableW

  GetTempPathW

  MoveFileExW

  GetLocaleInfoW

  GetNumberFormatW

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapReAlloc

  HeapSize

  SetStdHandle

  GetProcessHeap

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  RaiseException

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  IsDebuggerPresent

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlPcToFileHeader

  RtlUnwindEx

  EncodePointer

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  QueryPerformanceFrequency

  GetModuleHandleExW

  GetModuleFileNameA

  GetACP

  HeapFree

  HeapAlloc

  GetStringTypeW

  LCMapStringW

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  GetOEMCP

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  gdiplus

  GdipCloneImage

  GdipAlloc

  GdipDisposeImage

  GdipCreateBitmapFromStream

  GdipCreateHBITMAPFromBitmap

  GdiplusStartup

  GdiplusShutdown

  GdipFree

  Sections

  .text

  Size: 230KB - Virtual size: 230KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 68KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 123KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 1024B - Virtual size: 776B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 92KB - Virtual size: 91KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/61b3a4a9ae0b5189dd42a97b9c680e3787d9d3da3b481701e5795d16480141b1.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 448KB - Virtual size: 448KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/61fb9e763a84b168aaabdd61c45e218d2aa1b2673d9e160ffb73be78e830472c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  E:\Code\JX\Jx2PheakPoipet\Autoupdate_New\Autoupdate\obj\Release\Autoupdate.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 7.5MB - Virtual size: 7.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/624c73ea3478b17b95adb3240d601ec9f0e133daed5031d401267f80f647c3f7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\xampp\htdocs\default\HttpEmulator\obj\Release\net6.0\LtpFaker.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/627abde1ac08188262c07053a41251ca45b1810480bbf76d6e20e80732495e1a.exe

  .exe windows:4 windows x64 arch:x64

  c712cc046fb6a9cb6958849d9e4d49ec

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  AddAtomA

  AddVectoredExceptionHandler

  CloseHandle

  CreateEventA

  CreateMutexA

  CreateSemaphoreA

  DeleteAtom

  DeleteCriticalSection

  DuplicateHandle

  EnterCriticalSection

  FindAtomA

  FormatMessageA

  GetAtomNameA

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetHandleInformation

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetProcessAffinityMask

  GetStartupInfoA

  GetSystemTimeAsFileTime

  GetThreadContext

  GetThreadPriority

  GetTickCount

  InitializeCriticalSection

  IsDebuggerPresent

  LeaveCriticalSection

  LocalFree

  OpenProcess

  OutputDebugStringA

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReleaseMutex

  ReleaseSemaphore

  RemoveVectoredExceptionHandler

  ResetEvent

  ResumeThread

  SetEvent

  SetLastError

  SetProcessAffinityMask

  SetThreadContext

  SetThreadPriority

  SetUnhandledExceptionFilter

  Sleep

  SuspendThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TryEnterCriticalSection

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  __C_specific_handler

  msvcrt

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _beginthreadex

  _cexit

  _commode

  _endthreadex

  _errno

  _fmode

  _initterm

  _memccpy

  _onexit

  _setjmp

  _strdup

  _ultoa

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  longjmp

  malloc

  memcpy

  memmove

  memset

  printf

  realloc

  signal

  strlen

  strncmp

  vfprintf

  Sections

  .text

  Size: 46KB - Virtual size: 45KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 1KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 112B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 136B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6283c33ea65fdcb9a942dcbc1ce5df6d64676413accf26a58a0c625546313aa7.exe

  .exe windows:5 windows x86 arch:x86

  1389569a3a39186f3eb453b501cfe688

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FindNextFileA

  ExpandEnvironmentStringsA

  GetLongPathNameW

  CopyFileW

  GetLocaleInfoA

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  VirtualProtect

  SetLastError

  VirtualFree

  VirtualAlloc

  GetNativeSystemInfo

  HeapAlloc

  GetProcessHeap

  FreeLibrary

  IsBadReadPtr

  GetTempPathW

  OpenProcess

  OpenMutexA

  lstrcatW

  GetCurrentProcessId

  GetTempFileNameW

  UnmapViewOfFile

  DuplicateHandle

  CreateFileMappingW

  MapViewOfFile

  GetSystemDirectoryA

  GlobalAlloc

  GlobalLock

  GetTickCount

  GlobalUnlock

  WriteProcessMemory

  ResumeThread

  GetThreadContext

  ReadProcessMemory

  CreateProcessW

  SetThreadContext

  LocalAlloc

  GlobalFree

  MulDiv

  SizeofResource

  QueryDosDeviceW

  FindFirstVolumeW

  GetConsoleScreenBufferInfo

  SetConsoleTextAttribute

  lstrlenW

  GetStdHandle

  SetFilePointer

  FindResourceA

  LockResource

  LoadResource

  LocalFree

  FindVolumeClose

  GetVolumePathNamesForVolumeNameW

  lstrcpyW

  FindFirstFileA

  FormatMessageA

  FindNextVolumeW

  AllocConsole

  lstrcmpW

  GetModuleFileNameA

  lstrcpynA

  QueryPerformanceFrequency

  QueryPerformanceCounter

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  HeapSize

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExA

  ReadConsoleW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  HeapReAlloc

  GetACP

  GetModuleHandleExW

  MoveFileExW

  RtlUnwind

  RaiseException

  LoadLibraryExW

  GetCPInfo

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetFileSize

  TerminateThread

  GetLastError

  CreateDirectoryW

  GetModuleHandleA

  RemoveDirectoryW

  MoveFileW

  SetFilePointerEx

  GetLogicalDriveStringsA

  DeleteFileW

  DeleteFileA

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  lstrlenA

  GetDriveTypeA

  FindNextFileW

  GetFileSizeEx

  FindFirstFileW

  GetModuleHandleW

  ExitProcess

  CreateMutexA

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  CreateProcessA

  PeekNamedPipe

  CreatePipe

  TerminateProcess

  ReadFile

  HeapFree

  HeapCreate

  CreateEventA

  GetLocalTime

  CreateThread

  SetEvent

  CreateEventW

  WaitForSingleObject

  Sleep

  GetModuleFileNameW

  CloseHandle

  ExitThread

  CreateFileW

  WriteFile

  SetConsoleOutputCP

  InitializeCriticalSectionAndSpinCount

  MultiByteToWideChar

  DecodePointer

  EncodePointer

  WideCharToMultiByte

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  WaitForSingleObjectEx

  ResetEvent

  SetEndOfFile

  user32

  GetMessageA

  GetWindowTextW

  wsprintfW

  GetClipboardData

  UnhookWindowsHookEx

  GetForegroundWindow

  ToUnicodeEx

  GetKeyboardLayout

  SetWindowsHookExA

  CloseClipboard

  OpenClipboard

  GetKeyboardState

  CallNextHookEx

  GetKeyboardLayoutNameA

  GetKeyState

  GetWindowTextLengthW

  DispatchMessageA

  SetForegroundWindow

  SetClipboardData

  EnumWindows

  ExitWindowsEx

  EmptyClipboard

  ShowWindow

  SetWindowTextW

  MessageBoxW

  IsWindowVisible

  CloseWindow

  SendInput

  EnumDisplaySettingsW

  mouse_event

  CreatePopupMenu

  TranslateMessage

  TrackPopupMenu

  DefWindowProcA

  CreateWindowExA

  AppendMenuA

  GetSystemMetrics

  RegisterClassExA

  GetCursorPos

  SystemParametersInfoW

  GetWindowThreadProcessId

  MapVirtualKeyA

  DrawIcon

  GetIconInfo

  gdi32

  BitBlt

  CreateCompatibleBitmap

  SelectObject

  CreateCompatibleDC

  StretchBlt

  GetDIBits

  DeleteObject

  CreateDCA

  GetObjectA

  DeleteDC

  advapi32

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  GetUserNameW

  RegEnumKeyExA

  QueryServiceStatus

  CloseServiceHandle

  OpenSCManagerW

  OpenSCManagerA

  ControlService

  StartServiceW

  QueryServiceConfigW

  ChangeServiceConfigW

  OpenServiceW

  EnumServicesStatusW

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  RegCreateKeyA

  RegCloseKey

  RegQueryInfoKeyW

  RegQueryValueExA

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegSetValueExA

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyW

  RegDeleteValueW

  RegEnumValueW

  RegQueryValueExW

  RegDeleteKeyA

  shell32

  ShellExecuteExA

  Shell_NotifyIconA

  ExtractIconA

  ShellExecuteW

  ole32

  CoInitializeEx

  CoUninitialize

  CoGetObject

  shlwapi

  PathFileExistsW

  PathFileExistsA

  StrToIntA

  winmm

  waveInOpen

  waveInStart

  waveInAddBuffer

  PlaySoundW

  mciSendStringA

  mciSendStringW

  waveInClose

  waveInStop

  waveInPrepareHeader

  waveInUnprepareHeader

  ws2_32

  gethostbyname

  send

  WSAStartup

  closesocket

  inet_ntoa

  htons

  htonl

  getservbyname

  ntohs

  getservbyport

  gethostbyaddr

  inet_addr

  WSASetLastError

  WSAGetLastError

  recv

  connect

  socket

  urlmon

  URLOpenBlockingStreamW

  URLDownloadToFileW

  gdiplus

  GdipSaveImageToStream

  GdipGetImageEncodersSize

  GdipFree

  GdipDisposeImage

  GdipAlloc

  GdipCloneImage

  GdipGetImageEncoders

  GdiplusStartup

  GdipLoadImageFromStream

  wininet

  InternetOpenUrlW

  InternetOpenW

  InternetCloseHandle

  InternetReadFile

  Sections

  .text

  Size: 348KB - Virtual size: 348KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 94KB - Virtual size: 94KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1024B - Virtual size: 560B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/63677bd6ede0b7bdac542753b3f11a78af6f220bdaaed364e6cd9a8ec9636a73.exe

  .exe windows:10 windows x86 arch:x86

  b6df92b17f27e1708240ec29f2498c77

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  ImeBroker.pdb

  Imports

  user32

  PeekMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  AllowSetForegroundWindow

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetSystemMetrics

  CharNextW

  WaitForInputIdle

  msvcrt

  wcsncat_s

  _initterm

  swscanf_s

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  _wcmdln

  _amsg_exit

  __p__commode

  _XcptFilter

  ?what@exception@@UBEPBDXZ

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  tolower

  wcsnlen

  wcsrchr

  wcsncpy_s

  _lock

  _unlock

  __dllonexit

  _onexit

  ??1type_info@@UAE@XZ

  ?terminate@@YAXXZ

  _controlfp

  _except_handler4_common

  _vsnwprintf

  free

  malloc

  memcpy

  vswprintf_s

  wcsncmp

  _wcsnicmp

  _vsnwprintf_s

  ??_V@YAXPAX@Z

  _wtoi

  __wgetmainargs

  memcmp

  _CIlog

  __CxxFrameHandler3

  _CxxThrowException

  _purecall

  memmove

  _CIexp

  memset

  api-ms-win-core-com-l1-1-1

  CoReleaseServerProcess

  CoAddRefServerProcess

  CreateStreamOnHGlobal

  CoInitializeSecurity

  CoInitializeEx

  CoRegisterClassObject

  CoResumeClassObjects

  CoTaskMemFree

  CoRevokeClassObject

  CoUninitialize

  CoCreateInstance

  CoTaskMemAlloc

  api-ms-win-core-synch-l1-2-0

  OpenEventW

  Sleep

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  SetEvent

  ReleaseMutex

  OpenMutexW

  CreateMutexW

  InitOnceComplete

  CreateEventW

  ReleaseSRWLockExclusive

  WaitForSingleObject

  InitOnceBeginInitialize

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-libraryloader-l1-2-0

  LoadResource

  FreeLibrary

  GetModuleHandleA

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  FindResourceExW

  FreeLibraryAndExitThread

  GetModuleFileNameA

  GetModuleHandleW

  LockResource

  SizeofResource

  api-ms-win-core-heap-l1-2-0

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-errorhandling-l1-1-1

  SetErrorMode

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-2

  ResumeThread

  GetCurrentProcessId

  GetCurrentProcess

  CreateThread

  OpenProcessToken

  CreateProcessW

  GetStartupInfoW

  GetExitCodeProcess

  GetCurrentThreadId

  TerminateProcess

  SetPriorityClass

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventWrite

  EventActivityIdControl

  EventUnregister

  EventRegister

  EventSetInformation

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetSystemDirectoryW

  GetSystemTime

  GetTickCount64

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-security-base-l1-2-0

  AllocateAndInitializeSid

  IsValidSid

  GetSidSubAuthority

  GetTokenInformation

  GetSidSubAuthorityCount

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegOpenKeyExW

  RegGetValueW

  RegQueryValueExW

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalAlloc

  GlobalFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysStringLen

  SysAllocString

  api-ms-win-core-localization-l1-2-1

  LCMapStringW

  FormatMessageW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-file-l1-2-1

  SetFileTime

  GetFileSize

  CreateFileW

  GetTempPathW

  CreateDirectoryW

  GetTempFileNameW

  FindFirstFileW

  FindNextFileW

  FindClose

  DeleteFileW

  WriteFile

  SetEndOfFile

  GetFileAttributesW

  SetFilePointer

  api-ms-win-core-memory-l1-1-2

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-core-string-l1-1-0

  CompareStringW

  advapi32

  SetEntriesInAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  shell32

  ord165

  SHGetFolderPathW

  SHCreateDirectoryExW

  ShellExecuteW

  shlwapi

  ord12

  PathFileExistsW

  api-ms-win-appmodel-runtime-l1-1-1

  GetCurrentPackageFullName

  GetPackageFullName

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  api-ms-win-security-trustee-l1-1-1

  BuildExplicitAccessWithNameW

  profapi

  ord104

  Sections

  .text

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/65a95ebb11d9f2916453cb3c2b7e45b583ba360af7bfd915547de103b78cfe5e.exe

  .exe windows:4 windows x86 arch:x86

  4ea4df5d94204fc550be1874e1b77ea7

  
  

  Code Sign

  4b:b3:5f:a7:d5:2b:3f:7a:4b:df:54:ac:33:52:ac:c3:a7:e3:73:a2

  Certificate

  Issuer

  CN=Outguard Investorerne Aljofaina\ ,O=Idrtsstvner,L=Edge,ST=England,C=GB

  Not Before

  30-07-2024 08:36

  Not After

  30-07-2027 08:36

  Subject

  CN=Outguard Investorerne Aljofaina\ ,O=Idrtsstvner,L=Edge,ST=England,C=GB

  4b:b3:5f:a7:d5:2b:3f:7a:4b:df:54:ac:33:52:ac:c3:a7:e3:73:a2

  Certificate

  Issuer

  CN=Outguard Investorerne Aljofaina\ ,O=Idrtsstvner,L=Edge,ST=England,C=GB

  Not Before

  30-07-2024 08:36

  Not After

  30-07-2027 08:36

  Subject

  CN=Outguard Investorerne Aljofaina\ ,O=Idrtsstvner,L=Edge,ST=England,C=GB

  a8:cf:55:23:0b:03:c7:12:2d:d6:f4:83:84:49:06:27:45:6a:b8:05:21:0a:5c:b1:5b:51:85:d5:fd:5d:f9:85

  Signer

  Actual PE Digest

  a8:cf:55:23:0b:03:c7:12:2d:d6:f4:83:84:49:06:27:45:6a:b8:05:21:0a:5c:b1:5b:51:85:d5:fd:5d:f9:85

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  82:83:1a:f5:97:0d:cc:57:b7:fc:4b:9c:b3:cf:78:a1:4b:35:c3:40

  Signer

  Actual PE Digest

  82:83:1a:f5:97:0d:cc:57:b7:fc:4b:9c:b3:cf:78:a1:4b:35:c3:40

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetCurrentDirectoryW

  GetFileAttributesW

  GetFullPathNameW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  MoveFileW

  SetFileAttributesW

  GetModuleFileNameW

  CopyFileW

  ExitProcess

  SetEnvironmentVariableW

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  GetVersion

  SetErrorMode

  WaitForSingleObject

  GetCurrentProcess

  CompareFileTime

  GlobalUnlock

  GlobalLock

  CreateThread

  GetLastError

  CreateDirectoryW

  CreateProcessW

  RemoveDirectoryW

  lstrcmpiA

  GetTempFileNameW

  WriteFile

  lstrcpyA

  lstrcpyW

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  GetProcAddress

  GetModuleHandleA

  GlobalFree

  GlobalAlloc

  GetShortPathNameW

  SearchPathW

  lstrcmpiW

  SetFileTime

  CloseHandle

  ExpandEnvironmentStringsW

  lstrcmpW

  GetDiskFreeSpaceW

  lstrlenW

  lstrcpynW

  GetExitCodeProcess

  FindFirstFileW

  FindNextFileW

  DeleteFileW

  SetFilePointer

  ReadFile

  FindClose

  MulDiv

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleW

  user32

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  EnableMenuItem

  SetWindowPos

  GetSysColor

  GetWindowLongW

  SetCursor

  LoadCursorW

  CheckDlgButton

  GetMessagePos

  LoadBitmapW

  CallWindowProcW

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  wsprintfW

  ScreenToClient

  GetWindowRect

  GetSystemMetrics

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharPrevW

  CharNextA

  wsprintfA

  DispatchMessageW

  PeekMessageW

  GetDC

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  LoadImageW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  ShowWindow

  GetDlgItem

  IsWindow

  SetWindowLongW

  FindWindowExW

  TrackPopupMenu

  AppendMenuW

  CreatePopupMenu

  DrawTextW

  EndPaint

  CreateDialogParamW

  SendMessageTimeoutW

  SetForegroundWindow

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectW

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  advapi32

  RegDeleteKeyW

  SetFileSecurityW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegOpenKeyExW

  RegEnumValueW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumKeyW

  comctl32

  ImageList_AddMasked

  ord17

  ImageList_Destroy

  ImageList_Create

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  Sections

  .text

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 200KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 55KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/65f25ac4a4a913ba247966013b44cb92b0fab945d9d91cd561d3aa6d15577270.exe

  .exe windows:5 windows x64 arch:x64

  2ac23c52e7647c5bbea38e98bb68c652

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Not Before

  29-09-2021 00:00

  Not After

  28-09-2024 23:59

  Subject

  SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  d0:ad:49:ce:8a:78:0a:1b:89:57:fa:87:43:17:6c:88:0e:cd:1d:60:2c:1b:9f:74:05:f3:6b:19:50:1c:e3:8c

  Signer

  Actual PE Digest

  d0:ad:49:ce:8a:78:0a:1b:89:57:fa:87:43:17:6c:88:0e:cd:1d:60:2c:1b:9f:74:05:f3:6b:19:50:1c:e3:8c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  CreateWindowExW

  PostMessageW

  GetMessageW

  MessageBoxW

  MessageBoxA

  SystemParametersInfoW

  DestroyIcon

  SetWindowLongPtrW

  GetWindowLongPtrW

  GetClientRect

  InvalidateRect

  ReleaseDC

  GetDC

  DrawTextW

  GetDialogBaseUnits

  EndDialog

  DialogBoxIndirectParamW

  MoveWindow

  SendMessageW

  comctl32

  ord380

  kernel32

  GetACP

  IsValidCodePage

  GetStringTypeW

  GetFileAttributesExW

  SetEnvironmentVariableW

  FlushFileBuffers

  GetCurrentDirectoryW

  GetOEMCP

  GetCPInfo

  GetModuleHandleW

  MulDiv

  GetLastError

  FormatMessageW

  GetModuleFileNameW

  SetDllDirectoryW

  CreateSymbolicLinkW

  GetProcAddress

  CreateDirectoryW

  GetCommandLineW

  GetEnvironmentVariableW

  GetEnvironmentStringsW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetDriveTypeW

  RemoveDirectoryW

  GetTempPathW

  CloseHandle

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LoadLibraryExW

  LocalFree

  SetConsoleCtrlHandler

  CreateFileW

  FindFirstFileExW

  GetFinalPathNameByHandleW

  MultiByteToWideChar

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  ExpandEnvironmentStringsW

  QueryPerformanceCounter

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  RtlUnwindEx

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  GetCommandLineA

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ReadFile

  GetFullPathNameW

  SetStdHandle

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  CompareStringW

  LCMapStringW

  advapi32

  OpenProcessToken

  GetTokenInformation

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidW

  gdi32

  SelectObject

  DeleteObject

  CreateFontIndirectW

  Sections

  .text

  Size: 164KB - Virtual size: 163KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 73KB - Virtual size: 73KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/66055934b163379c3ac488cfbcedc30387108193a2f283a6589b846b9041bc61.exe

  .exe windows:10 windows x86 arch:x86

  b6df92b17f27e1708240ec29f2498c77

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  ImeBroker.pdb

  Imports

  user32

  PeekMessageW

  PostQuitMessage

  MsgWaitForMultipleObjects

  AllowSetForegroundWindow

  GetMessageW

  TranslateMessage

  DispatchMessageW

  GetSystemMetrics

  CharNextW

  WaitForInputIdle

  msvcrt

  wcsncat_s

  _initterm

  swscanf_s

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  _wcmdln

  _amsg_exit

  __p__commode

  _XcptFilter

  ?what@exception@@UBEPBDXZ

  ??1exception@@UAE@XZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  tolower

  wcsnlen

  wcsrchr

  wcsncpy_s

  _lock

  _unlock

  __dllonexit

  _onexit

  ??1type_info@@UAE@XZ

  ?terminate@@YAXXZ

  _controlfp

  _except_handler4_common

  _vsnwprintf

  free

  malloc

  memcpy

  vswprintf_s

  wcsncmp

  _wcsnicmp

  _vsnwprintf_s

  ??_V@YAXPAX@Z

  _wtoi

  __wgetmainargs

  memcmp

  _CIlog

  __CxxFrameHandler3

  _CxxThrowException

  _purecall

  memmove

  _CIexp

  memset

  api-ms-win-core-com-l1-1-1

  CoReleaseServerProcess

  CoAddRefServerProcess

  CreateStreamOnHGlobal

  CoInitializeSecurity

  CoInitializeEx

  CoRegisterClassObject

  CoResumeClassObjects

  CoTaskMemFree

  CoRevokeClassObject

  CoUninitialize

  CoCreateInstance

  CoTaskMemAlloc

  api-ms-win-core-synch-l1-2-0

  OpenEventW

  Sleep

  InitializeCriticalSectionEx

  AcquireSRWLockExclusive

  SetEvent

  ReleaseMutex

  OpenMutexW

  CreateMutexW

  InitOnceComplete

  CreateEventW

  ReleaseSRWLockExclusive

  WaitForSingleObject

  InitOnceBeginInitialize

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-libraryloader-l1-2-0

  LoadResource

  FreeLibrary

  GetModuleHandleA

  LoadLibraryExW

  GetProcAddress

  GetModuleHandleExW

  FindResourceExW

  FreeLibraryAndExitThread

  GetModuleFileNameA

  GetModuleHandleW

  LockResource

  SizeofResource

  api-ms-win-core-heap-l1-2-0

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-errorhandling-l1-1-1

  SetErrorMode

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-processthreads-l1-1-2

  ResumeThread

  GetCurrentProcessId

  GetCurrentProcess

  CreateThread

  OpenProcessToken

  CreateProcessW

  GetStartupInfoW

  GetExitCodeProcess

  GetCurrentThreadId

  TerminateProcess

  SetPriorityClass

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventWrite

  EventActivityIdControl

  EventUnregister

  EventRegister

  EventSetInformation

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetSystemDirectoryW

  GetSystemTime

  GetTickCount64

  GetTickCount

  GetSystemTimeAsFileTime

  GetVersionExW

  api-ms-win-security-base-l1-2-0

  AllocateAndInitializeSid

  IsValidSid

  GetSidSubAuthority

  GetTokenInformation

  GetSidSubAuthorityCount

  api-ms-win-core-registry-l1-1-0

  RegCreateKeyExW

  RegSetValueExW

  RegCloseKey

  RegOpenKeyExW

  RegGetValueW

  RegQueryValueExW

  api-ms-win-security-sddl-l1-1-0

  ConvertSidToStringSidW

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  api-ms-win-core-heap-l2-1-0

  LocalFree

  GlobalAlloc

  GlobalFree

  oleaut32

  SysFreeString

  SysAllocStringLen

  SysStringLen

  SysAllocString

  api-ms-win-core-localization-l1-2-1

  LCMapStringW

  FormatMessageW

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringW

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-file-l1-2-1

  SetFileTime

  GetFileSize

  CreateFileW

  GetTempPathW

  CreateDirectoryW

  GetTempFileNameW

  FindFirstFileW

  FindNextFileW

  FindClose

  DeleteFileW

  WriteFile

  SetEndOfFile

  GetFileAttributesW

  SetFilePointer

  api-ms-win-core-memory-l1-1-2

  OpenFileMappingW

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  FlushViewOfFile

  api-ms-win-core-timezone-l1-1-0

  SystemTimeToFileTime

  api-ms-win-core-string-l1-1-0

  CompareStringW

  advapi32

  SetEntriesInAclW

  GetNamedSecurityInfoW

  SetNamedSecurityInfoW

  shell32

  ord165

  SHGetFolderPathW

  SHCreateDirectoryExW

  ShellExecuteW

  shlwapi

  ord12

  PathFileExistsW

  api-ms-win-appmodel-runtime-l1-1-1

  GetCurrentPackageFullName

  GetPackageFullName

  api-ms-win-core-processenvironment-l1-2-0

  ExpandEnvironmentStringsW

  api-ms-win-security-trustee-l1-1-1

  BuildExplicitAccessWithNameW

  profapi

  ord104

  Sections

  .text

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/665a4e8e49ccc2b3b36f58d627acebc6dfe6d3791a81b3b0d9dc9b43d4e98857.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/66ed0de08ae8ac234622b3fc58f006939f123272d856cdabc7ca4bfad6c0aed6.exe

  .exe windows:6 windows x64 arch:x64

  0efdda2d31c844ed640ca8ca81440cf9

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  C:\Users\IDA\source\repos\TestShell\x64\Release\TestShell.pdb

  Imports

  kernel32

  CopyFileA

  RtlVirtualUnwind

  UnhandledExceptionFilter

  VirtualAlloc

  VirtualFree

  RtlLookupFunctionEntry

  GetConsoleWindow

  GetModuleFileNameA

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlCaptureContext

  user32

  ShowWindow

  advapi32

  RegSetValueExA

  RegOpenKeyExA

  RegCloseKey

  shell32

  SHGetFolderPathA

  msvcp140

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?good@ios_base@std@@QEBA_NXZ

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?uncaught_exception@std@@YA_NXZ

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  wininet

  InternetCloseHandle

  InternetOpenUrlA

  InternetOpenA

  InternetReadFile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __std_terminate

  __std_exception_copy

  memset

  __std_exception_destroy

  memcpy

  __current_exception_context

  __current_exception

  _CxxThrowException

  memmove

  __C_specific_handler

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  _set_fmode

  __stdio_common_vsprintf

  api-ms-win-crt-runtime-l1-1-0

  _register_onexit_function

  _register_thread_local_exe_atexit_callback

  _initterm

  _crt_atexit

  _get_narrow_winmain_command_line

  _initialize_narrow_environment

  _configure_narrow_argv

  _initialize_onexit_table

  _set_app_type

  _seh_filter_exe

  _c_exit

  _cexit

  _exit

  exit

  _initterm_e

  terminate

  _invalid_parameter_noinfo_noreturn

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  _callnewh

  malloc

  free

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 708B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 488B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/67042f0de57638c97d125bf1c9897fdfa295566761fe17c80bfe05e19461a98e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  75:82:14:ad:0f:fd:12:57:e9:20:62:49:96:77:45:af:19:ff:7b:2a:98:4e:f1:23:34:81:72:01:63:03:e5:03

  Signer

  Actual PE Digest

  75:82:14:ad:0f:fd:12:57:e9:20:62:49:96:77:45:af:19:ff:7b:2a:98:4e:f1:23:34:81:72:01:63:03:e5:03

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\tcgjv3aby4922\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6779c558aa40040574565f2eb2e129185377c8b05a8e567650f5d5fa12562dea.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 204KB - Virtual size: 203KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/695cd128002012ec8d9def80c1ef282520e9b142f7bcfffbcb1a920a3829b67a.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/699ab96ab77fb83fb6468bfc51531a91899fe94048e526ae232fb6fe9ac52290.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  UxqX.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 897KB - Virtual size: 896KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/69b553a93584155eaaab3e949c15f3bc78e91c6200b16b46cabd9764bbfe7d10.exe

  .exe windows:6 windows x64 arch:x64

  3adb91702748b00a499880faa2356089

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetLastError

  VirtualAlloc

  IsProcessorFeaturePresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleHandleW

  msvcp140

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

  ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ

  ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

  ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?_Xbad_alloc@std@@YAXXZ

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?uncaught_exception@std@@YA_NXZ

  ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?width@ios_base@std@@QEAA_J_J@Z

  ?width@ios_base@std@@QEBA_JXZ

  ?setf@ios_base@std@@QEAAHHH@Z

  ?flags@ios_base@std@@QEBAHXZ

  ??Bios_base@std@@QEBA_NXZ

  ?good@ios_base@std@@QEBA_NXZ

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  wininet

  InternetOpenUrlA

  InternetCloseHandle

  InternetOpenA

  InternetReadFile

  vcruntime140

  memset

  __C_specific_handler

  __current_exception

  __std_exception_destroy

  __std_exception_copy

  memmove

  _CxxThrowException

  __current_exception_context

  memcpy

  vcruntime140_1

  __CxxFrameHandler4

  api-ms-win-crt-runtime-l1-1-0

  _c_exit

  _cexit

  _initialize_onexit_table

  _register_onexit_function

  _crt_atexit

  terminate

  __p___argv

  __p___argc

  _exit

  _register_thread_local_exe_atexit_callback

  exit

  _initterm_e

  _seh_filter_exe

  _initterm

  _initialize_narrow_environment

  _get_initial_narrow_environment

  _invalid_parameter_noinfo_noreturn

  _configure_narrow_argv

  _set_app_type

  api-ms-win-crt-string-l1-1-0

  strlen

  api-ms-win-crt-heap-l1-1-0

  _callnewh

  free

  malloc

  _set_new_mode

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  _set_fmode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 22KB - Virtual size: 22KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 136B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/69d7e14e2d5fc77e347add9b897623a3615e1c9c483f9ef408b59ec44024fe94.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\Administrator\Documents\CryptoObfuscator_Output\BXCJKS1233.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6a30746cdee768d2e9385f43973680837513905d9804f04781ed77c74a8bca80.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 122KB - Virtual size: 122KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 68KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6b11a91599104b307955a4cde5942d89ed2aa29e833fa229e21368a73139186d.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  30:73:d7:6f:71:ca:e0:c6:a6:fb:2f:1d:3e:55:56:dc:cb:9b:19:60:a7:0b:bb:2a:de:55:4e:bf:fa:a9:2a:4c

  Signer

  Actual PE Digest

  30:73:d7:6f:71:ca:e0:c6:a6:fb:2f:1d:3e:55:56:dc:cb:9b:19:60:a7:0b:bb:2a:de:55:4e:bf:fa:a9:2a:4c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\n00b6jdtzokpw\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6b4e58208e93a43d08c3a720f7ec85b39e2212b75d3ed278b070e4c05b2e3aad.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 849KB - Virtual size: 848KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6b6b6dcf20260d92fbf0fd6cea9d4bdabf29e047af19ad026b58c4aaf448a67e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  2d:6a:51:84:55:08:5b:31:83:02:d0:6a:18:a1:9e:a9:ad:3b:bb:2c:82:17:a5:f1:1d:9f:57:7d:31:c1:28:24

  Signer

  Actual PE Digest

  2d:6a:51:84:55:08:5b:31:83:02:d0:6a:18:a1:9e:a9:ad:3b:bb:2c:82:17:a5:f1:1d:9f:57:7d:31:c1:28:24

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\pmjl8m16\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6b89ca3745f66447d9dab6fc2bd79820dd3ee4ce5edc40c25d1c7bf2c9250352.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6c77c2a923fae249f3f2c0d4c2f5153896a09076ffd9699b3a067b7f7d1da0fe.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 241KB - Virtual size: 240KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6c7ccc122fac3ed22879b0b82b2874a375ec9236827127ec784eafc607740a83.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6c9fcfe5c1673bf732478c3ca43d2d4f35837e116b002eff5bb92b1a4aafdaf3.exe

  .exe windows:4 windows x86 arch:x86

  59a4a44a250c4cf4f2d9de2b3fe5d95f

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetTickCount

  GetFullPathNameA

  MoveFileA

  SetCurrentDirectoryA

  GetFileAttributesA

  GetLastError

  CreateDirectoryA

  SetFileAttributesA

  SearchPathA

  GetShortPathNameA

  CreateFileA

  GetFileSize

  GetModuleFileNameA

  ReadFile

  GetCurrentProcess

  CopyFileA

  ExitProcess

  SetEnvironmentVariableA

  Sleep

  CloseHandle

  GetCommandLineA

  SetErrorMode

  LoadLibraryA

  lstrlenA

  lstrcpynA

  GetDiskFreeSpaceA

  GlobalUnlock

  GlobalLock

  CreateThread

  CreateProcessA

  RemoveDirectoryA

  GetTempFileNameA

  lstrcpyA

  lstrcatA

  GetSystemDirectoryA

  GetVersion

  GetProcAddress

  GlobalAlloc

  CompareFileTime

  SetFileTime

  ExpandEnvironmentStringsA

  lstrcmpiA

  lstrcmpA

  WaitForSingleObject

  GlobalFree

  GetExitCodeProcess

  GetModuleHandleA

  GetTempPathA

  GetWindowsDirectoryA

  LoadLibraryExA

  FindFirstFileA

  FindNextFileA

  DeleteFileA

  SetFilePointer

  WriteFile

  FindClose

  WritePrivateProfileStringA

  MultiByteToWideChar

  MulDiv

  GetPrivateProfileStringA

  FreeLibrary

  user32

  CreateWindowExA

  EndDialog

  ScreenToClient

  GetWindowRect

  EnableMenuItem

  GetSystemMenu

  SetClassLongA

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongA

  SetCursor

  LoadCursorA

  CheckDlgButton

  GetMessagePos

  LoadBitmapA

  CallWindowProcA

  IsWindowVisible

  CloseClipboard

  GetDC

  SystemParametersInfoA

  RegisterClassA

  TrackPopupMenu

  AppendMenuA

  CreatePopupMenu

  GetSystemMetrics

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CharPrevA

  DispatchMessageA

  PeekMessageA

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageA

  DefWindowProcA

  BeginPaint

  GetClientRect

  FillRect

  DrawTextA

  GetClassInfoA

  DialogBoxParamA

  CharNextA

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamA

  SetTimer

  GetDlgItem

  wsprintfA

  SetForegroundWindow

  ShowWindow

  IsWindow

  LoadImageA

  SetWindowLongA

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  EndPaint

  PostQuitMessage

  FindWindowExA

  SendMessageTimeoutA

  SetWindowTextA

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectA

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListA

  SHBrowseForFolderA

  SHGetFileInfoA

  ShellExecuteA

  SHFileOperationA

  advapi32

  RegCloseKey

  RegOpenKeyExA

  RegDeleteKeyA

  RegDeleteValueA

  RegEnumValueA

  RegCreateKeyExA

  RegSetValueExA

  RegQueryValueExA

  RegEnumKeyA

  comctl32

  ImageList_Create

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ole32

  CoCreateInstance

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  version

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  VerQueryValueA

  Sections

  .text

  Size: 23KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1024B - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 76KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 103KB - Virtual size: 102KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6d8192c01d191baa76250cf31aceba5ebf250db393a2fd09f9c5ea4a863765c7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  UgXC.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 890KB - Virtual size: 890KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6e5973188ce549705c6e4effed906bc95a3d4dff32e9289ef829d5ee509ead35.exe

  .dll windows:4 windows x64 arch:x64

  2b85eda5e2ca4805e05003741ab3fe72

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetLastError

  GetModuleHandleA

  GetProcAddress

  InitializeCriticalSection

  LeaveCriticalSection

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  msvcrt

  __iob_func

  _amsg_exit

  _initterm

  _lock

  _unlock

  abort

  calloc

  free

  fwrite

  memmove

  realloc

  strlen

  strncmp

  vfprintf

  Exports

  Exports

  iYycnKBk

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4.1MB - Virtual size: 4.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 512B - Virtual size: 356B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 288B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 73B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1024B - Virtual size: 976B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 88B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 96B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /4

  Size: 1024B - Virtual size: 640B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 157KB - Virtual size: 156KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /70

  Size: 1024B - Virtual size: 765B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /81

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /92

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6eaa6aa231466412153bcbc19216cfc828e3fbe8e1ef0139095dab1fc1acc253.exe

  .exe windows:6 windows x86 arch:x86

  84bb2aff56eab52b0bfbd8f1d67713aa

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetEnvironmentVariableW

  CreateMutexW

  FindClose

  LocalAlloc

  CreateFileW

  GetLogicalDriveStringsW

  GetLastError

  CreateThread

  SetFilePointer

  GetFileSize

  ExitProcess

  CreateProcessW

  GetDriveTypeW

  FlushFileBuffers

  WriteConsoleW

  CloseHandle

  ExpandEnvironmentStringsW

  WriteFile

  FindNextFileW

  FindFirstFileW

  LocalFree

  ReadFile

  SetFilePointerEx

  GetConsoleMode

  GetConsoleOutputCP

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  GetCurrentProcess

  TerminateProcess

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  GetStdHandle

  GetModuleFileNameW

  GetModuleHandleExW

  HeapAlloc

  HeapFree

  FindFirstFileExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetStdHandle

  GetFileType

  GetStringTypeW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeCriticalSectionEx

  VirtualProtect

  LCMapStringW

  GetProcessHeap

  HeapSize

  HeapReAlloc

  DecodePointer

  user32

  wsprintfW

  advapi32

  CryptAcquireContextW

  CryptGenRandom

  RegSetValueExW

  RegCreateKeyW

  RegCloseKey

  ntdll

  NtDelayExecution

  NtClose

  RtlAdjustPrivilege

  Sections

  .text

  Size: 75KB - Virtual size: 75KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .fptable

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6fd1db15e4ae01b98ee1d755d1136562dde0fe8bca44f3587a0f1416bec4baa2.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 287KB - Virtual size: 287KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/6fe769091973f45bdb8ddf8ea1674751200b6422ec0defba6403c0322c7887fa.exe

  .exe windows:4 windows x86 arch:x86

  4ea4df5d94204fc550be1874e1b77ea7

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetCurrentDirectoryW

  GetFileAttributesW

  GetFullPathNameW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  MoveFileW

  SetFileAttributesW

  GetModuleFileNameW

  CopyFileW

  ExitProcess

  SetEnvironmentVariableW

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  GetVersion

  SetErrorMode

  WaitForSingleObject

  GetCurrentProcess

  CompareFileTime

  GlobalUnlock

  GlobalLock

  CreateThread

  GetLastError

  CreateDirectoryW

  CreateProcessW

  RemoveDirectoryW

  lstrcmpiA

  GetTempFileNameW

  WriteFile

  lstrcpyA

  lstrcpyW

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  GetProcAddress

  GetModuleHandleA

  GlobalFree

  GlobalAlloc

  GetShortPathNameW

  SearchPathW

  lstrcmpiW

  SetFileTime

  CloseHandle

  ExpandEnvironmentStringsW

  lstrcmpW

  GetDiskFreeSpaceW

  lstrlenW

  lstrcpynW

  GetExitCodeProcess

  FindFirstFileW

  FindNextFileW

  DeleteFileW

  SetFilePointer

  ReadFile

  FindClose

  MulDiv

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleW

  user32

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  EnableMenuItem

  SetWindowPos

  GetSysColor

  GetWindowLongW

  SetCursor

  LoadCursorW

  CheckDlgButton

  GetMessagePos

  LoadBitmapW

  CallWindowProcW

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  wsprintfW

  ScreenToClient

  GetWindowRect

  GetSystemMetrics

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharPrevW

  CharNextA

  wsprintfA

  DispatchMessageW

  PeekMessageW

  GetDC

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  LoadImageW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  ShowWindow

  GetDlgItem

  IsWindow

  SetWindowLongW

  FindWindowExW

  TrackPopupMenu

  AppendMenuW

  CreatePopupMenu

  DrawTextW

  EndPaint

  CreateDialogParamW

  SendMessageTimeoutW

  SetForegroundWindow

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectW

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  advapi32

  RegDeleteKeyW

  SetFileSecurityW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegOpenKeyExW

  RegEnumValueW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumKeyW

  comctl32

  ImageList_AddMasked

  ord17

  ImageList_Destroy

  ImageList_Create

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  Sections

  .text

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 200KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 220KB - Virtual size: 220KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/70c7a307852a0d3fbf20f964e1c191ddea93c75907c45e203edc1badb6978a47.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  76:41:98:49:f1:3b:a5:57:a7:24:ff:1f:3b:d5:b8:55:10:97:35:b6:6e:f3:bf:75:6c:ff:e4:9a:1f:29:14:a4

  Signer

  Actual PE Digest

  76:41:98:49:f1:3b:a5:57:a7:24:ff:1f:3b:d5:b8:55:10:97:35:b6:6e:f3:bf:75:6c:ff:e4:9a:1f:29:14:a4

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\k0krw71g6e\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 316KB - Virtual size: 315KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7105d584cafc03a35bbae8956fa58360da5b330d07d214d6e53c6352fddfc8ec.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/71b814a0a6c6d9cd59504a14918e29f59d2b77d981dca01d22a97f098c89c782.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 10.3MB - Virtual size: 10.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10.6MB - Virtual size: 10.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1.2MB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 588KB - Virtual size: 588KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 426KB - Virtual size: 426KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/72837dda6a46fef393a6420f045e6ae543908430d3a09fe8d4bfb6f6679c5b53.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 376KB - Virtual size: 376KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7333d9620b2d6517b3c1d3c4abfb28299973478693bb588f07d8da2cdbf59a07.exe

  .exe windows:4 windows x86 arch:x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7420c3495d69fd75b868fae0c578036bd832b24bd643726c9cbb4c4939ce91c7.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 431KB - Virtual size: 431KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/75448819c4887713e7e8302b04dd7dc4f454a65584b04582739e49d7ff42be48.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 73KB - Virtual size: 73KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 197KB - Virtual size: 196KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7605e6672cf788c7e666ce3855dad7a0aa7f69cff512ff22105ea3f189c2c382.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7631726b15a0cba30f88268df626df7a053c044efc78f772ade21e879cc7ae58.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 926KB - Virtual size: 926KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 984B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/76fe69849ddbda008d54ff757bf77599f77c33245dd8f28d3b1c53e3940980f4.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 454KB - Virtual size: 454KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/774529f26b02e6ac05bafff286f930882b7c8f10b73222b040f7d47430d2a888.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/77e5bef9aaab4a5b63dbaa9619266b483fc8fdfb99d73b9cdab6d9d0e986ebd9.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 481KB - Virtual size: 480KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/781d0d748c28efa7f9120dd199be4f0587cc02699b340e36ee439957bf6ac61e.exe

  .exe windows:4 windows x86 arch:x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/78470469575e6f64738a6d7b38e1a970922f52c791fcc859630655c8c3acceb2.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 73KB - Virtual size: 72KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/78888643cd53e6a7d75e2efd8019e5132b69005719b662cf6048f6b1349a2f79.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  e0:08:e9:e3:39:70:ed:a8:97:f9:c0:ce:53:b0:7f:18:25:54:d6:65:f6:0d:de:04:7c:b8:94:5b:3f:d0:75:ab

  Signer

  Actual PE Digest

  e0:08:e9:e3:39:70:ed:a8:97:f9:c0:ce:53:b0:7f:18:25:54:d6:65:f6:0d:de:04:7c:b8:94:5b:3f:d0:75:ab

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  8e:b5:2f:cc:6f:a9:4e:e4:df:41:69:73:8d:3c:4a:ce:74:79:ae:07

  Signer

  Actual PE Digest

  8e:b5:2f:cc:6f:a9:4e:e4:df:41:69:73:8d:3c:4a:ce:74:79:ae:07

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  JOJR.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 742KB - Virtual size: 741KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/78dee99bb9db69e5d0025dd91db3e03ff5f67ed475596abc4d949c64bc62df20.exe

  .exe windows:4 windows x86 arch:x86

  30a1b89a914b47b29db5c0cd9eb4a4b5

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Imports

  oleaut32

  SysFreeString

  SysReAllocStringLen

  SysAllocStringLen

  GetErrorInfo

  GetActiveObject

  SysFreeString

  SafeArrayPtrOfIndex

  SafeArrayGetElement

  SafeArrayGetUBound

  SafeArrayGetLBound

  SafeArrayCreate

  VariantChangeType

  VariantCopyInd

  VariantCopy

  VariantClear

  VariantInit

  advapi32

  RegQueryValueExA

  RegOpenKeyExA

  RegCloseKey

  RegSetValueExA

  RegQueryValueExA

  RegOpenKeyExA

  RegFlushKey

  RegCreateKeyExA

  RegCloseKey

  OpenThreadToken

  OpenProcessToken

  GetUserNameA

  GetTokenInformation

  FreeSid

  EqualSid

  AllocateAndInitializeSid

  user32

  GetKeyboardType

  DestroyWindow

  LoadStringA

  MessageBoxA

  CharNextA

  CreateWindowExA

  WindowFromPoint

  WaitMessage

  UpdateWindow

  UnregisterClassA

  UnhookWindowsHookEx

  TranslateMessage

  TranslateMDISysAccel

  TrackPopupMenu

  SystemParametersInfoA

  ShowWindow

  ShowScrollBar

  ShowOwnedPopups

  SetWindowsHookExA

  SetWindowTextA

  SetWindowPos

  SetWindowPlacement

  SetWindowLongW

  SetWindowLongA

  SetTimer

  SetScrollRange

  SetScrollPos

  SetScrollInfo

  SetRect

  SetPropA

  SetParent

  SetMenuItemInfoA

  SetMenu

  SetForegroundWindow

  SetFocus

  SetCursor

  SetClipboardData

  SetClassLongA

  SetCapture

  SetActiveWindow

  SendMessageW

  SendMessageA

  ScrollWindow

  ScreenToClient

  RemovePropA

  RemoveMenu

  ReleaseDC

  ReleaseCapture

  RegisterWindowMessageA

  RegisterClipboardFormatA

  RegisterClassA

  RedrawWindow

  PtInRect

  PostQuitMessage

  PostMessageA

  PeekMessageW

  PeekMessageA

  OpenClipboard

  OffsetRect

  OemToCharA

  MsgWaitForMultipleObjects

  MessageBoxA

  MessageBeep

  MapWindowPoints

  MapVirtualKeyA

  LoadStringA

  LoadKeyboardLayoutA

  LoadIconA

  LoadCursorA

  LoadBitmapA

  KillTimer

  IsZoomed

  IsWindowVisible

  IsWindowUnicode

  IsWindowEnabled

  IsWindow

  IsRectEmpty

  IsIconic

  IsDialogMessageW

  IsDialogMessageA

  IsChild

  InvalidateRect

  IntersectRect

  InsertMenuItemA

  InsertMenuA

  InflateRect

  GetWindowThreadProcessId

  GetWindowTextA

  GetWindowRect

  GetWindowPlacement

  GetWindowLongW

  GetWindowLongA

  GetWindowDC

  GetTopWindow

  GetSystemMetrics

  GetSystemMenu

  GetSysColorBrush

  GetSysColor

  GetSubMenu

  GetScrollRange

  GetScrollPos

  GetScrollInfo

  GetPropA

  GetParent

  GetWindow

  GetMessagePos

  GetMenuStringA

  GetMenuState

  GetMenuItemInfoA

  GetMenuItemID

  GetMenuItemCount

  GetMenu

  GetLastActivePopup

  GetKeyboardState

  GetKeyboardLayoutNameA

  GetKeyboardLayoutList

  GetKeyboardLayout

  GetKeyState

  GetKeyNameTextA

  GetIconInfo

  GetForegroundWindow

  GetFocus

  GetDesktopWindow

  GetDCEx

  GetDC

  GetCursorPos

  GetCursor

  GetClipboardData

  GetClientRect

  GetClassLongA

  GetClassInfoA

  GetCapture

  GetActiveWindow

  FrameRect

  FindWindowA

  FillRect

  EqualRect

  EnumWindows

  EnumThreadWindows

  EnumChildWindows

  EndPaint

  EnableWindow

  EnableScrollBar

  EnableMenuItem

  EmptyClipboard

  DrawTextA

  DrawMenuBar

  DrawIconEx

  DrawIcon

  DrawFrameControl

  DrawFocusRect

  DrawEdge

  DispatchMessageW

  DispatchMessageA

  DestroyWindow

  DestroyMenu

  DestroyIcon

  DestroyCursor

  DeleteMenu

  DefWindowProcA

  DefMDIChildProcA

  DefFrameProcA

  CreatePopupMenu

  CreateMenu

  CreateIcon

  CloseClipboard

  ClientToScreen

  CheckMenuItem

  CallWindowProcA

  CallNextHookEx

  BeginPaint

  CharNextA

  CharLowerBuffA

  CharLowerA

  CharUpperBuffA

  CharToOemA

  AdjustWindowRectEx

  ActivateKeyboardLayout

  kernel32

  GetACP

  Sleep

  VirtualFree

  VirtualAlloc

  GetTickCount

  QueryPerformanceCounter

  GetCurrentThreadId

  InterlockedDecrement

  InterlockedIncrement

  VirtualQuery

  WideCharToMultiByte

  MultiByteToWideChar

  lstrlenA

  lstrcpynA

  LoadLibraryExA

  GetThreadLocale

  GetStartupInfoA

  GetProcAddress

  GetModuleHandleA

  GetModuleFileNameA

  GetLocaleInfoA

  GetLastError

  GetCommandLineA

  FreeLibrary

  FindFirstFileA

  FindClose

  ExitProcess

  ExitThread

  CreateThread

  CompareStringA

  WriteFile

  UnhandledExceptionFilter

  SetFilePointer

  SetEndOfFile

  RtlUnwind

  ReadFile

  RaiseException

  GetStdHandle

  GetFileSize

  GetFileType

  CreateFileA

  CloseHandle

  TlsSetValue

  TlsGetValue

  LocalAlloc

  GetModuleHandleA

  lstrcpyA

  WritePrivateProfileStringA

  WriteFile

  WinExec

  WaitForSingleObject

  VirtualQuery

  VirtualAlloc

  VerLanguageNameA

  UnlockFile

  Sleep

  SizeofResource

  SetThreadLocale

  SetLocalTime

  SetFilePointer

  SetEvent

  SetErrorMode

  SetEndOfFile

  ResumeThread

  ResetEvent

  RemoveDirectoryA

  ReadFile

  RaiseException

  QueryPerformanceFrequency

  QueryPerformanceCounter

  MultiByteToWideChar

  MulDiv

  LockResource

  LockFile

  LoadResource

  LoadLibraryA

  LeaveCriticalSection

  InitializeCriticalSection

  GlobalUnlock

  GlobalHandle

  GlobalLock

  GlobalFree

  GlobalFindAtomA

  GlobalDeleteAtom

  GlobalAlloc

  GlobalAddAtomA

  GetVolumeInformationA

  GetVersionExA

  GetVersion

  GetTimeZoneInformation

  GetTickCount

  GetThreadLocale

  GetTempPathA

  GetSystemDefaultLangID

  GetStdHandle

  GetProcAddress

  GetPrivateProfileStringA

  GetModuleHandleA

  GetModuleFileNameA

  GetLocaleInfoA

  GetLocalTime

  GetLastError

  GetFullPathNameA

  GetFileTime

  GetFileSize

  GetFileAttributesA

  GetExitCodeThread

  GetDriveTypeA

  GetDiskFreeSpaceA

  GetDateFormatA

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcessId

  GetCurrentProcess

  GetComputerNameA

  GetCPInfo

  FreeResource

  InterlockedIncrement

  InterlockedExchange

  InterlockedDecrement

  FreeLibrary

  FormatMessageA

  FlushFileBuffers

  FindResourceA

  FindNextFileA

  FindFirstFileA

  FindClose

  FileTimeToLocalFileTime

  FileTimeToDosDateTime

  EnumCalendarInfoA

  EnterCriticalSection

  DeviceIoControl

  DeleteFileA

  DeleteCriticalSection

  CreateThread

  CreateFileA

  CreateEventA

  CreateDirectoryA

  CopyFileA

  CompareStringA

  CloseHandle

  Sleep

  gdi32

  UnrealizeObject

  StretchBlt

  SetWindowOrgEx

  SetWinMetaFileBits

  SetViewportOrgEx

  SetTextColor

  SetStretchBltMode

  SetROP2

  SetPixel

  SetEnhMetaFileBits

  SetDIBColorTable

  SetBrushOrgEx

  SetBkMode

  SetBkColor

  SelectPalette

  SelectObject

  SaveDC

  RoundRect

  RestoreDC

  Rectangle

  RectVisible

  RealizePalette

  Polyline

  PlayEnhMetaFile

  PatBlt

  MoveToEx

  MaskBlt

  LineTo

  IntersectClipRect

  GetWindowOrgEx

  GetWinMetaFileBits

  GetTextMetricsA

  GetTextExtentPointA

  GetTextExtentPoint32A

  GetSystemPaletteEntries

  GetStockObject

  GetRgnBox

  GetPixel

  GetPaletteEntries

  GetObjectA

  GetEnhMetaFilePaletteEntries

  GetEnhMetaFileHeader

  GetEnhMetaFileBits

  GetDeviceCaps

  GetDIBits

  GetDIBColorTable

  GetDCOrgEx

  GetCurrentPositionEx

  GetClipBox

  GetBrushOrgEx

  GetBitmapBits

  GdiFlush

  ExtTextOutA

  ExcludeClipRect

  Ellipse

  DeleteObject

  DeleteEnhMetaFile

  DeleteDC

  CreateSolidBrush

  CreatePenIndirect

  CreatePalette

  CreateHalftonePalette

  CreateFontIndirectA

  CreateDIBitmap

  CreateDIBSection

  CreateCompatibleDC

  CreateCompatibleBitmap

  CreateBrushIndirect

  CreateBitmap

  CopyEnhMetaFileA

  BitBlt

  version

  VerQueryValueA

  GetFileVersionInfoSizeA

  GetFileVersionInfoA

  mpr

  WNetGetUserA

  ole32

  CoTaskMemFree

  ProgIDFromCLSID

  StringFromCLSID

  CoCreateInstance

  CoUninitialize

  CoInitialize

  IsEqualGUID

  comctl32

  _TrackMouseEvent

  ImageList_SetIconSize

  ImageList_GetIconSize

  ImageList_Write

  ImageList_Read

  ImageList_GetDragImage

  ImageList_DragShowNolock

  ImageList_DragMove

  ImageList_DragLeave

  ImageList_DragEnter

  ImageList_EndDrag

  ImageList_BeginDrag

  ImageList_Remove

  ImageList_DrawEx

  ImageList_Replace

  ImageList_Draw

  ImageList_GetBkColor

  ImageList_SetBkColor

  ImageList_Add

  ImageList_GetImageCount

  ImageList_Destroy

  ImageList_Create

  InitCommonControls

  urlmon

  URLDownloadToFileA

  wininet

  InternetGetConnectedState

  InternetReadFile

  InternetOpenA

  InternetConnectA

  InternetCloseHandle

  HttpSendRequestA

  HttpOpenRequestA

  DeleteUrlCacheEntry

  shell32

  ShellExecuteA

  SHGetSpecialFolderPathA

  SHGetPathFromIDListA

  SHBrowseForFolderA

  wsock32

  WSAStartup

  gethostbyname

  netapi32

  Netbios

  NetUserGetInfo

  NetApiBufferFree

  NetUserGetLocalGroups

  iphlpapi

  GetIfTable

  Sections

  .text

  Size: 929KB - Virtual size: 928KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 17KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 52B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 65KB - Virtual size: 65KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 61KB - Virtual size: 61KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/78f4bcd5439f72e13af6e96ac3722fee9e5373dae844da088226158c9e81a078.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/791208bfe4570f8a24ab86732be79ac17a1193fa140187f58964825c16539565.exe

  .exe windows:6 windows x86 arch:x86

  733f21ebd0062e4a15fd5f0e92de28df

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\LV\source\repos\App\Release\App.pdb

  Imports

  kernel32

  CreateFileW

  WriteConsoleW

  FreeConsole

  CreateProcessA

  GetEnvironmentVariableA

  CloseHandle

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwind

  GetLastError

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  EncodePointer

  RaiseException

  GetStdHandle

  WriteFile

  GetModuleFileNameW

  ExitProcess

  GetModuleHandleExW

  GetCommandLineA

  GetCommandLineW

  GetFileType

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  SetStdHandle

  GetStringTypeW

  CompareStringW

  LCMapStringW

  GetProcessHeap

  ReadFile

  GetConsoleMode

  ReadConsoleW

  HeapSize

  HeapReAlloc

  FlushFileBuffers

  GetConsoleOutputCP

  SetFilePointerEx

  DecodePointer

  user32

  MessageBoxW

  advapi32

  CryptHashData

  CryptDestroyHash

  CryptReleaseContext

  CryptDestroyKey

  CryptAcquireContextW

  CryptDecrypt

  CryptCreateHash

  CryptDeriveKey

  dnsapi

  DnsQuery_A

  Sections

  .text

  Size: 57KB - Virtual size: 57KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/796b9a4aae5c85eb695dfa324a856b6feec2c555b609731126fd66a59768846d.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/79b1315cab839553008486cf182981ce0a36c1755a83e37f7b107cdb7266f0cb.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 911KB - Virtual size: 911KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7a3de858fad4871d76df43dea61f493be5c47ccee5bd29d907cddd649ae94f1d.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7c7bab8714baa65f7842be4c7d17a724b589476de45734caa29d013abd9dd348.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\l4lc5\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7c88bd71a3530b4731d6e6233d0927d8f7b01c4e97cf796fa2d53b554f1d6ed9.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 911KB - Virtual size: 910KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7edfcaa1350e432f5da4287025db54d7390cce532808f441609d89f8e9be3793.exe

  .exe windows:6 windows x64 arch:x64

  4f37c18012091e638ba43dc2708c7c99

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  C:\Users\Mikz\Desktop\User Mode\User Mode\build\usermode\Usermode.pdb

  Imports

  kernel32

  EnterCriticalSection

  OutputDebugStringW

  LeaveCriticalSection

  AreFileApisANSI

  QueryPerformanceFrequency

  QueryPerformanceCounter

  FindFirstFileW

  Process32First

  DeviceIoControl

  FindClose

  CreateFileW

  CreateToolhelp32Snapshot

  Sleep

  GetLastError

  Process32Next

  CloseHandle

  CreateThread

  GetFileAttributesExW

  CreateDirectoryW

  GetCurrentDirectoryW

  GetLocaleInfoEx

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  IsDebuggerPresent

  IsProcessorFeaturePresent

  TerminateProcess

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  RtlVirtualUnwind

  GetConsoleWindow

  lstrcmpiA

  RtlLookupFunctionEntry

  RtlCaptureContext

  SleepConditionVariableSRW

  WakeAllConditionVariable

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  WideCharToMultiByte

  GetFileSizeEx

  CreateFileA

  WaitForMultipleObjects

  PeekNamedPipe

  ReadFile

  GetFileType

  GetStdHandle

  GetEnvironmentVariableA

  MultiByteToWideChar

  WaitForSingleObjectEx

  MoveFileExA

  GetTickCount

  VerifyVersionInfoA

  LoadLibraryA

  GetProcAddress

  FreeLibrary

  GetSystemDirectoryA

  VerSetConditionMask

  SleepEx

  HeapDestroy

  HeapAlloc

  HeapReAlloc

  HeapFree

  HeapSize

  GetProcessHeap

  InitializeCriticalSectionEx

  DeleteCriticalSection

  GetCurrentProcess

  VirtualProtect

  CreateFileMappingW

  MapViewOfFile

  UnmapViewOfFile

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  QueryFullProcessImageNameW

  SetLastError

  FormatMessageA

  LocalFree

  GetFileInformationByHandleEx

  user32

  MessageBoxA

  GetSystemMetrics

  msvcp140

  ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

  ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Xbad_function_call@std@@YAXXZ

  ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  _Query_perf_frequency

  ??1_Lockit@std@@QEAA@XZ

  ??0_Lockit@std@@QEAA@H@Z

  ?uncaught_exceptions@std@@YAHXZ

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

  ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z

  ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?setf@ios_base@std@@QEAAHHH@Z

  ??7ios_base@std@@QEBA_NXZ

  ??Bid@locale@std@@QEAA_KXZ

  ?always_noconv@codecvt_base@std@@QEBA_NXZ

  ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?good@ios_base@std@@QEBA_NXZ

  ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

  ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A

  ?_Xbad_alloc@std@@YAXXZ

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?_Winerror_map@std@@YAHH@Z

  ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

  ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ?id@?$ctype@D@std@@2V0locale@2@A

  ?_Xlength_error@std@@YAXPEBD@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  _Query_perf_counter

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

  ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z

  ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z

  ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

  ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  normaliz

  IdnToAscii

  wldap32

  ord30

  ord301

  ord79

  ord35

  ord33

  ord32

  ord27

  ord200

  ord143

  ord22

  ord41

  ord50

  ord45

  ord60

  ord211

  ord46

  ord217

  ord26

  crypt32

  CertOpenStore

  CertCloseStore

  CertFreeCertificateChain

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertFreeCertificateContext

  CryptStringToBinaryA

  PFXImportCertStore

  CryptDecodeObjectEx

  CertAddCertificateContextToStore

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertCreateCertificateChainEngine

  CryptQueryObject

  CertGetNameStringA

  CertFindExtension

  ws2_32

  select

  closesocket

  recv

  ntohl

  send

  gethostname

  sendto

  WSAGetLastError

  recvfrom

  freeaddrinfo

  getaddrinfo

  __WSAFDIsSet

  ioctlsocket

  listen

  htonl

  accept

  WSACleanup

  bind

  connect

  WSAStartup

  WSAIoctl

  WSASetLastError

  socket

  getpeername

  getsockname

  setsockopt

  ntohs

  getsockopt

  htons

  shlwapi

  PathFindFileNameW

  rpcrt4

  UuidCreate

  UuidToStringA

  RpcStringFreeA

  psapi

  GetModuleInformation

  userenv

  UnloadUserProfile

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __std_terminate

  strstr

  strchr

  __std_exception_destroy

  __std_exception_copy

  _CxxThrowException

  memchr

  memcmp

  memcpy

  memmove

  memset

  strrchr

  __current_exception

  __current_exception_context

  __C_specific_handler

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  __acrt_iob_func

  fwrite

  _lseeki64

  _read

  __stdio_common_vsprintf

  fflush

  fread

  feof

  fputs

  __stdio_common_vsscanf

  _write

  _close

  _open

  fseek

  fclose

  fputc

  fgetc

  ftell

  _popen

  _pclose

  fgets

  _set_fmode

  _get_stream_buffer_pointers

  fopen

  _fseeki64

  fsetpos

  ungetc

  setvbuf

  fgetpos

  api-ms-win-crt-string-l1-1-0

  _strdup

  isupper

  strspn

  strncmp

  strncpy

  tolower

  strcspn

  strcmp

  strpbrk

  api-ms-win-crt-utility-l1-1-0

  qsort

  api-ms-win-crt-heap-l1-1-0

  _set_new_mode

  _callnewh

  malloc

  calloc

  free

  realloc

  api-ms-win-crt-convert-l1-1-0

  strtol

  atoi

  strtoul

  strtod

  strtoull

  strtoll

  api-ms-win-crt-runtime-l1-1-0

  _initialize_narrow_environment

  _errno

  system

  strerror

  __sys_nerr

  abort

  _invalid_parameter_noinfo

  _resetstkoflw

  exit

  _beginthreadex

  _getpid

  terminate

  _register_thread_local_exe_atexit_callback

  _c_exit

  __p___argv

  __p___argc

  _exit

  _initterm_e

  _initterm

  _get_initial_narrow_environment

  _set_app_type

  _seh_filter_exe

  _cexit

  _crt_atexit

  _register_onexit_function

  _initialize_onexit_table

  _invalid_parameter_noinfo_noreturn

  _configure_narrow_argv

  api-ms-win-crt-filesystem-l1-1-0

  _access

  _lock_file

  _unlock_file

  _fstat64

  _stat64

  _unlink

  api-ms-win-crt-math-l1-1-0

  _dsign

  _dclass

  __setusermatherr

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-time-l1-1-0

  _time64

  strftime

  _gmtime64

  _localtime64

  api-ms-win-crt-locale-l1-1-0

  localeconv

  _configthreadlocale

  ___lc_codepage_func

  advapi32

  ConvertSidToStringSidA

  OpenProcessToken

  AddAccessAllowedAce

  GetLengthSid

  GetTokenInformation

  InitializeAcl

  IsValidSid

  SetSecurityInfo

  CopySid

  CryptEncrypt

  CryptAcquireContextA

  CryptReleaseContext

  CryptGetHashParam

  CryptGenRandom

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  CryptDestroyKey

  CryptImportKey

  shell32

  ShellExecuteA

  Sections

  .text

  Size: 458KB - Virtual size: 457KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 112KB - Virtual size: 115KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 20KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7f70e00cb673f52e3feb31834e2e2c4ad2091a690a56735a1f517c7ebc52a3be.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 21KB - Virtual size: 21KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 576B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7f7219150a44e397a72f82fe9c4232887e991f0b3f0469c29d5cd2b8e3f3d0a7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 650KB - Virtual size: 649KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7f7bc308f1a31734af163c5b00fc0e1159d2ebdcebbe46b7c5113677f84fcea7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 615KB - Virtual size: 614KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 212KB - Virtual size: 212KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/7fe8eb1d71fbf75851d70673fa7e5d90c95c643437be3b5b0a7e104439263684.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 557KB - Virtual size: 557KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 179KB - Virtual size: 179KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 413KB - Virtual size: 413KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8161fb4c042aac76e73980d52138488cbb52b0581a34ea312510e3af3413a0c9.exe

  .exe windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  UPX0

  Size: - Virtual size: 300KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 224KB - Virtual size: 224KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/8239559d5c986284031b5918e229e63e61ea790e35cd1e972241bd3ff36b5087.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\Administrator\Desktop\2023CryptsDone\hosh genetic\obj\Debug\Toslan.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/84a3bc78a6676d66031cb313cd0711224f9d7a650cc547811f34285c1acf8491.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  xSiO.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 740KB - Virtual size: 740KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8656b524b106546155ad9e187692535d0b4b62ec1584f97277ff67cf4379c035.exe

  .exe windows:4 windows x86 arch:x86

  9b827673b71dda8dc951da9c5741c483

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvfw32

  DrawDibDraw

  avifil32

  AVIStreamGetFrame

  AVIStreamInfoA

  iphlpapi

  GetAdaptersInfo

  winmm

  waveOutRestart

  midiStreamRestart

  midiStreamClose

  midiOutReset

  midiStreamStop

  PlaySoundA

  waveOutUnprepareHeader

  waveOutPrepareHeader

  waveOutWrite

  waveOutPause

  waveOutReset

  waveOutClose

  midiStreamOut

  midiOutPrepareHeader

  midiStreamProperty

  midiStreamOpen

  midiOutUnprepareHeader

  waveOutOpen

  waveOutGetNumDevs

  ws2_32

  inet_addr

  inet_ntoa

  gethostbyname

  WSAStartup

  WSACleanup

  select

  send

  closesocket

  htons

  socket

  setsockopt

  recvfrom

  ioctlsocket

  WSAAsyncSelect

  connect

  recv

  getpeername

  ntohl

  WSAGetLastError

  ntohs

  getservbyname

  shutdown

  accept

  rasapi32

  RasGetConnectStatusA

  RasHangUpA

  kernel32

  GetTimeZoneInformation

  GetLocaleInfoA

  GetVersion

  TerminateThread

  CreateMutexA

  ReleaseMutex

  SuspendThread

  InterlockedIncrement

  InterlockedDecrement

  MapViewOfFile

  UnmapViewOfFile

  GetSystemInfo

  IsProcessorFeaturePresent

  lstrcmpiA

  SetNamedPipeHandleState

  WaitNamedPipeA

  OpenFileMappingA

  OpenEventA

  TlsAlloc

  TlsFree

  TlsSetValue

  TlsGetValue

  LocalFree

  FileTimeToLocalFileTime

  lstrcpynA

  DuplicateHandle

  FlushFileBuffers

  LockFile

  UnlockFile

  SetEndOfFile

  GlobalDeleteAtom

  GlobalFindAtomA

  GlobalAddAtomA

  GlobalGetAtomNameA

  lstrcmpA

  LocalAlloc

  GlobalHandle

  LocalReAlloc

  GetFileTime

  GetCurrentThread

  GlobalFlags

  SetErrorMode

  GetProcessVersion

  GetCPInfo

  GetOEMCP

  GetStartupInfoA

  RtlUnwind

  GetSystemTime

  GetLocalTime

  RaiseException

  HeapSize

  GetACP

  SetStdHandle

  GetFileType

  UnhandledExceptionFilter

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  SetHandleCount

  GetStdHandle

  GetEnvironmentVariableA

  HeapDestroy

  HeapCreate

  VirtualFree

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  LCMapStringA

  LCMapStringW

  VirtualAlloc

  IsBadWritePtr

  SetUnhandledExceptionFilter

  GetStringTypeA

  GetStringTypeW

  IsValidLocale

  IsValidCodePage

  EnumSystemLocalesA

  CompareStringA

  CompareStringW

  IsBadReadPtr

  IsBadCodePtr

  GetLocaleInfoW

  SetLastError

  TerminateProcess

  GetFileSize

  SetFilePointer

  GetCurrentProcess

  GetWindowsDirectoryA

  GetSystemDirectoryA

  CreateSemaphoreA

  ResumeThread

  ReleaseSemaphore

  EnterCriticalSection

  LeaveCriticalSection

  GetProfileStringA

  WriteFile

  WaitForMultipleObjects

  CreateFileA

  SetEvent

  FindResourceA

  LoadResource

  LockResource

  ReadFile

  GetModuleFileNameA

  WideCharToMultiByte

  MultiByteToWideChar

  GetCurrentThreadId

  ExitProcess

  GlobalSize

  GlobalFree

  DeleteCriticalSection

  InitializeCriticalSection

  lstrcatA

  lstrlenA

  WinExec

  lstrcpyA

  FindNextFileA

  GetDriveTypeA

  GlobalReAlloc

  HeapFree

  HeapReAlloc

  GetProcessHeap

  HeapAlloc

  GetUserDefaultLCID

  GetFullPathNameA

  FreeLibrary

  LoadLibraryA

  GetLastError

  GetVersionExA

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  CreateThread

  CreateEventA

  Sleep

  ExpandEnvironmentStringsA

  GlobalAlloc

  GlobalLock

  GlobalUnlock

  FindFirstFileA

  FindClose

  GetFileAttributesA

  DeleteFileA

  GetCurrentDirectoryA

  SetCurrentDirectoryA

  GetVolumeInformationA

  GetModuleHandleA

  GetProcAddress

  MulDiv

  GetCommandLineA

  GetTickCount

  CreateProcessA

  WaitForSingleObject

  CloseHandle

  InterlockedExchange

  FileTimeToSystemTime

  user32

  GetSysColorBrush

  GetMenuCheckMarkDimensions

  SetMenuItemBitmaps

  CheckMenuItem

  IsDialogMessageA

  ScrollWindowEx

  SendDlgItemMessageA

  MapWindowPoints

  AdjustWindowRectEx

  GetScrollPos

  RegisterClassA

  GetClassLongA

  RemovePropA

  GetMessageTime

  GetLastActivePopup

  RegisterWindowMessageA

  GetWindowPlacement

  EndDialog

  CreateDialogIndirectParamA

  DestroyWindow

  EndPaint

  BeginPaint

  CharUpperA

  GetWindowTextLengthA

  GetDlgItem

  GetClassNameA

  GetDesktopWindow

  UnregisterHotKey

  RegisterHotKey

  CreateWindowExA

  GetWindowTextA

  SetWindowTextA

  GetMenuItemCount

  GetMenuItemID

  GetMenuStringA

  GetMenuState

  GetTabbedTextExtentA

  GrayStringA

  TabbedTextOutA

  WindowFromDC

  EnumChildWindows

  GetWindowDC

  UnhookWindowsHookEx

  CallNextHookEx

  SetWindowsHookExA

  GetPropA

  MoveWindow

  CallWindowProcA

  SetPropA

  DrawTextA

  GetCursor

  DrawStateA

  FrameRect

  GetNextDlgTabItem

  GetForegroundWindow

  LoadIconA

  TranslateMessage

  DrawFrameControl

  DrawEdge

  DrawFocusRect

  WindowFromPoint

  GetMessageA

  DispatchMessageA

  SetRectEmpty

  CreateIconFromResourceEx

  CreateIconFromResource

  DrawIconEx

  CreatePopupMenu

  AppendMenuA

  ModifyMenuA

  CreateMenu

  CreateAcceleratorTableA

  GetDlgCtrlID

  GetSubMenu

  EnableMenuItem

  ClientToScreen

  EnumDisplaySettingsA

  LoadImageA

  SystemParametersInfoA

  ShowWindow

  IsWindowEnabled

  TranslateAcceleratorA

  GetKeyState

  CopyAcceleratorTableA

  PostQuitMessage

  IsZoomed

  GetClassInfoA

  DefWindowProcA

  GetSystemMenu

  DeleteMenu

  GetMenu

  SetMenu

  PeekMessageA

  IsIconic

  SetFocus

  GetActiveWindow

  GetWindow

  DestroyAcceleratorTable

  SetWindowRgn

  GetMessagePos

  ScreenToClient

  ChildWindowFromPointEx

  CopyRect

  LoadBitmapA

  WinHelpA

  KillTimer

  SetTimer

  ReleaseCapture

  GetCapture

  SetCapture

  GetScrollRange

  SetScrollRange

  SetScrollPos

  SetRect

  InflateRect

  IntersectRect

  DestroyIcon

  PtInRect

  OffsetRect

  EnableWindow

  RedrawWindow

  GetWindowLongA

  SetWindowLongA

  GetSysColor

  SetActiveWindow

  SetCursorPos

  LoadCursorA

  SetCursor

  GetDC

  FillRect

  IsRectEmpty

  ReleaseDC

  IsChild

  TrackPopupMenu

  DestroyMenu

  SetForegroundWindow

  GetWindowRect

  EqualRect

  UpdateWindow

  ValidateRect

  InvalidateRect

  GetClientRect

  GetFocus

  GetParent

  GetTopWindow

  PostMessageA

  IsWindow

  SetParent

  DestroyCursor

  SendMessageA

  SetWindowPos

  MessageBoxA

  GetCursorPos

  GetSystemMetrics

  EmptyClipboard

  SetClipboardData

  OpenClipboard

  GetClipboardData

  CloseClipboard

  wsprintfA

  WaitForInputIdle

  LoadStringA

  RegisterClipboardFormatA

  IsWindowVisible

  UnregisterClassA

  gdi32

  FillRgn

  CreateRectRgn

  CombineRgn

  PatBlt

  CreatePen

  SelectObject

  CreatePatternBrush

  CreateBitmap

  CreateBrushIndirect

  CreateDCA

  CreateCompatibleBitmap

  GetPolyFillMode

  GetStretchBltMode

  GetROP2

  GetBkColor

  GetBkMode

  GetTextColor

  CreateRoundRectRgn

  CreateEllipticRgn

  PathToRegion

  EndPath

  BeginPath

  GetWindowOrgEx

  GetViewportOrgEx

  GetWindowExtEx

  ExtTextOutA

  Escape

  TranslateCharsetInfo

  CreateSolidBrush

  SetPolyFillMode

  SetROP2

  SetMapMode

  SetViewportOrgEx

  OffsetViewportOrgEx

  SetViewportExtEx

  ScaleViewportExtEx

  SetWindowExtEx

  ScaleWindowExtEx

  GetClipBox

  ExcludeClipRect

  CreateFontIndirectA

  MoveToEx

  LineTo

  ExtSelectClipRgn

  GetViewportExtEx

  GetTextMetricsA

  CreateFontA

  SetDIBitsToDevice

  SetTextColor

  SetBkMode

  TextOutA

  SetBkColor

  CreateRectRgnIndirect

  CreateDIBSection

  SetPixel

  SetStretchBltMode

  GetClipRgn

  CreatePolygonRgn

  SelectClipRgn

  DeleteObject

  CreateDIBitmap

  GetSystemPaletteEntries

  CreatePalette

  StretchBlt

  SelectPalette

  RealizePalette

  GetDIBits

  RectVisible

  PtVisible

  CreatePenIndirect

  RestoreDC

  Ellipse

  Rectangle

  LPtoDP

  DPtoLP

  GetCurrentObject

  RoundRect

  SaveDC

  SetWindowOrgEx

  GetStockObject

  GetObjectA

  EndPage

  EndDoc

  DeleteDC

  StartDocA

  StartPage

  BitBlt

  GetPixel

  CreateCompatibleDC

  GetTextExtentPoint32A

  SetPixelV

  GetDeviceCaps

  msimg32

  GradientFill

  winspool.drv

  OpenPrinterA

  DocumentPropertiesA

  ClosePrinter

  comdlg32

  ChooseColorA

  GetOpenFileNameA

  GetSaveFileNameA

  GetFileTitleA

  advapi32

  RegCreateKeyExA

  RegOpenKeyA

  RegQueryValueA

  RegSetValueExA

  RegOpenKeyExA

  RegQueryValueExA

  RegCloseKey

  RegEnumValueA

  shell32

  SHGetFileInfoA

  DragAcceptFiles

  DragFinish

  ShellExecuteA

  Shell_NotifyIconA

  DragQueryFileA

  ole32

  ReleaseStgMedium

  RevokeDragDrop

  RegisterDragDrop

  OleUninitialize

  CLSIDFromString

  CoCreateInstance

  OleInitialize

  oleaut32

  RegisterTypeLi

  LoadTypeLi

  UnRegisterTypeLi

  comctl32

  ImageList_DragLeave

  ImageList_DragEnter

  ImageList_Destroy

  ImageList_Create

  ImageList_BeginDrag

  ImageList_Add

  ImageList_DragMove

  ImageList_Draw

  _TrackMouseEvent

  ImageList_SetBkColor

  ImageList_GetImageCount

  ImageList_GetImageInfo

  ImageList_GetIcon

  ImageList_DragShowNolock

  ImageList_EndDrag

  ord17

  ImageList_Read

  ImageList_DrawIndirect

  ImageList_AddMasked

  ImageList_Duplicate

  wldap32

  ord29

  wininet

  InternetSetOptionA

  InternetCrackUrlA

  HttpOpenRequestA

  HttpSendRequestA

  HttpQueryInfoA

  InternetReadFile

  InternetOpenA

  InternetCloseHandle

  InternetConnectA

  InternetCanonicalizeUrlA

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1008KB - Virtual size: 1006KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 864KB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 36KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/86ac79d7d3fd1d50c8e00da55a888081e21047afa61df076ea8c295f1bedf710.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 12.2MB - Virtual size: 12.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 15.2MB - Virtual size: 15.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 636KB - Virtual size: 835KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 698KB - Virtual size: 697KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/891306bc14e8d196e6f229dfe9d713bb1e81af30efe5ea786672648cbe6fd032.exe

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 51KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8cc0ee20c6dbfaad5fbd5c38f8bc90159ecce6348cb182cd94520755d867cad9.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 225KB - Virtual size: 224KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 904KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8d1e882db67c9f10fae58b7bfa178d9c9cd0be3b961e92284042e7a3e4b3ffa9.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 252KB - Virtual size: 252KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8d2c226bbf82d366a7eac2634ccb6028ae5e30a3997b838820ac1687c2eaed1f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 509KB - Virtual size: 509KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1012B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8d6646dfb95d92e22e4a895c54a0a21534387170682c60357a92eb1a57695230.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 251KB - Virtual size: 251KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8d89bc9e20d0ef06258026fce8c5538c1e4e82ac4c643a207bb135321b44e2e9.exe

  .exe windows:4 windows x64 arch:x64

  77e7e46c6e31b8fa8f0d7c011e3a7610

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  GetFileSecurityW

  RegCloseKey

  RegConnectRegistryW

  RegCreateKeyExW

  RegCreateKeyW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyW

  RegEnumValueW

  RegFlushKey

  RegLoadKeyW

  RegNotifyChangeKeyValue

  RegOpenKeyExW

  RegOpenKeyW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegQueryValueW

  RegReplaceKeyW

  RegRestoreKeyW

  RegSaveKeyW

  RegSetValueExW

  RegSetValueW

  RegUnLoadKeyW

  gdi32

  AngleArc

  Arc

  ArcTo

  BeginPath

  BitBlt

  CancelDC

  Chord

  CloseFigure

  CombineRgn

  CreateBitmap

  CreateBitmapIndirect

  CreateCompatibleBitmap

  CreateCompatibleDC

  CreateDIBPatternBrushPt

  CreateDIBitmap

  CreateEllipticRgn

  CreateEllipticRgnIndirect

  CreateFontW

  CreateHatchBrush

  CreatePatternBrush

  CreatePen

  CreatePolygonRgn

  CreateRectRgn

  CreateRectRgnIndirect

  CreateRoundRectRgn

  CreateSolidBrush

  DeleteDC

  DeleteObject

  Ellipse

  EndPath

  EqualRgn

  ExtSelectClipRgn

  FillPath

  FillRgn

  FlattenPath

  FrameRgn

  GetArcDirection

  GetBitmapDimensionEx

  GetBkColor

  GetBkMode

  GetBrushOrgEx

  GetCurrentObject

  GetDCOrgEx

  GetDIBits

  GetGraphicsMode

  GetMiterLimit

  GetObjectW

  GetPolyFillMode

  GetRgnBox

  GetStockObject

  GetStretchBltMode

  GetTextAlign

  GetTextCharacterExtra

  GetTextColor

  GetTextExtentPoint32W

  InvertRgn

  LineTo

  MaskBlt

  MoveToEx

  OffsetRgn

  PaintRgn

  PathToRegion

  Pie

  PlgBlt

  PolyBezier

  PolyBezierTo

  Polygon

  Polyline

  PolylineTo

  PtInRegion

  RectInRegion

  Rectangle

  RestoreDC

  RoundRect

  SaveDC

  SelectClipPath

  SelectClipRgn

  SelectObject

  SelectPalette

  SetArcDirection

  SetBitmapDimensionEx

  SetBkColor

  SetBkMode

  SetBrushOrgEx

  SetDIBits

  SetGraphicsMode

  SetMiterLimit

  SetPolyFillMode

  SetStretchBltMode

  SetTextAlign

  SetTextCharacterExtra

  SetTextColor

  StretchBlt

  StrokeAndFillPath

  StrokePath

  TextOutW

  WidenPath

  kernel32

  CloseHandle

  CreateEventA

  CreateFileW

  CreatePipe

  CreateProcessW

  CreateSemaphoreA

  CreateThread

  CreateTimerQueue

  CreateTimerQueueTimer

  DeleteCriticalSection

  DeleteTimerQueueEx

  DeleteTimerQueueTimer

  DuplicateHandle

  EnterCriticalSection

  FindFirstVolumeW

  FindNextVolumeW

  FindVolumeClose

  FlushConsoleInputBuffer

  FormatMessageA

  FormatMessageW

  FreeEnvironmentStringsA

  FreeLibrary

  GetACP

  GetCPInfo

  GetConsoleCP

  GetConsoleMode

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDiskFreeSpaceExW

  GetEnvironmentStrings

  GetExitCodeProcess

  GetFileAttributesA

  GetFileInformationByHandle

  GetFileSizeEx

  GetFileType

  GetLastError

  GetModuleFileNameA

  GetModuleHandleA

  GetProcAddress

  GetProcessTimes

  GetStartupInfoA

  GetStdHandle

  GetSystemInfo

  GetSystemTime

  GetSystemTimeAsFileTime

  GetThreadTimes

  GetTickCount

  GetTimeZoneInformation

  GetVolumeInformationW

  GlobalAlloc

  GlobalFree

  GlobalMemoryStatusEx

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryW

  LocalFree

  MultiByteToWideChar

  OutputDebugStringA

  PeekConsoleInputA

  PeekNamedPipe

  QueryPerformanceCounter

  QueryPerformanceFrequency

  ReadConsoleInputA

  ReleaseSemaphore

  ResetEvent

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetConsoleCtrlHandler

  SetConsoleMode

  SetEndOfFile

  SetEvent

  SetFilePointer

  SetHandleInformation

  SetLastError

  SetUnhandledExceptionFilter

  Sleep

  SystemTimeToFileTime

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  UnmapViewOfFile

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  WaitForMultipleObjects

  WaitForSingleObject

  WideCharToMultiByte

  WriteFile

  __C_specific_handler

  msvcrt

  _access

  _chmod

  _close

  _creat

  _dup

  _dup2

  _getpid

  _isatty

  _mkdir

  _read

  _setmode

  _strdup

  _umask

  _unlink

  _wcsdup

  _write

  __dllonexit

  __getmainargs

  __initenv

  __iob_func

  __isascii

  __lconv_init

  __mb_cur_max

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _beginthreadex

  _cexit

  _ctime64

  _environ

  _errno

  _findclose

  _findfirst64

  _findnext64

  _fmode

  _fstat64

  _fullpath

  _get_osfhandle

  _getpid

  _gmtime64

  _initterm

  _isatty

  _localtime64

  _lock

  _lseeki64

  _mktime64

  _onexit

  _open_osfhandle

  _time64

  _timezone

  _tzname

  _unlock

  _vsnprintf

  _wchmod

  _wfopen

  _wsopen

  _wstat64

  abort

  acos

  asin

  atan

  atof

  atoi

  bsearch

  calloc

  cosh

  exit

  fclose

  feof

  ferror

  fflush

  fopen

  fopen_s

  fprintf

  fputc

  fread

  free

  fseek

  ftell

  fwrite

  getc

  getenv

  isalnum

  isalpha

  iscntrl

  isdigit

  islower

  isprint

  ispunct

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memchr

  memcmp

  memcpy

  memmove

  memset

  printf

  putc

  putchar

  puts

  raise

  realloc

  setlocale

  signal

  sinh

  sprintf

  sscanf

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strrchr

  strtol

  swprintf

  tan

  tanh

  ungetc

  vfprintf

  vsprintf

  wcscmp

  wcscpy

  wcslen

  wprintf

  shell32

  CommandLineToArgvW

  SHGetFolderPathW

  user32

  ChildWindowFromPoint

  ChildWindowFromPointEx

  DefWindowProcW

  DispatchMessageW

  GetMessageW

  GetWindowLongPtrW

  MenuItemFromPoint

  MessageBoxA

  SetWindowLongPtrW

  TranslateMessage

  winmm

  timeBeginPeriod

  timeEndPeriod

  timeGetDevCaps

  timeGetTime

  wsock32

  WSAGetLastError

  bind

  closesocket

  connect

  gethostbyaddr

  gethostbyname

  gethostname

  getprotobyname

  getprotobynumber

  getservbyname

  getservbyport

  htonl

  htons

  inet_addr

  inet_ntoa

  listen

  ntohs

  recv

  recvfrom

  select

  send

  shutdown

  Exports

  Exports

  Mac

  Sections

  .text

  Size: 748KB - Virtual size: 747KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 111KB - Virtual size: 110KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rodata

  Size: 76KB - Virtual size: 75KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 54KB - Virtual size: 54KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 51KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /4

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 93KB - Virtual size: 93KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /31

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /45

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /57

  Size: 10KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /70

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /81

  Size: 93KB - Virtual size: 92KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /92

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8dd3a8d57533cddb053799ed6f14291ed97042e9209870f8daa0a8eeb9223d38.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 1.1MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 371KB - Virtual size: 372KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 565KB - Virtual size: 568KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/8de7b187adc0998018ded36fd12f8bf51c1bc77c0b1b8c66347ece6f2d66cb6a.exe

  .exe windows:1 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 592B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  02-07-2021 00:00

  Not After

  10-07-2024 23:59

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=Unknown issuer

  Not Before

  01-01-2013 10:00

  Not After

  01-04-2013 10:00

  Subject

  CN=Dummy certificate

  Extended Key Usages

  Key Usages

  KeyUsageCertSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  10:c3:a2:42:2c:75:76:17:5d:23:8d:95:24:4f:9c:3b:a2:64:e5:18:c6:c7:58:70:2d:7e:e5:a3:13:0c:3d:8e

  Signer

  Actual PE Digest

  10:c3:a2:42:2c:75:76:17:5d:23:8d:95:24:4f:9c:3b:a2:64:e5:18:c6:c7:58:70:2d:7e:e5:a3:13:0c:3d:8e

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  cDSR.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 694KB - Virtual size: 694KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 220KB - Virtual size: 219KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8e63b1f7f8e29b9a714f796e2e8ca0cd1094086e2d0a5de21601e23e1792a906.exe

  .exe windows:6 windows x64 arch:x64

  8a0d4922e8722fe4880f97321db0e8ae

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetEnvironmentStringsW

  SetCurrentDirectoryW

  FindCloseChangeNotification

  FindFirstFileW

  FindFirstFileExW

  FindFirstVolumeW

  FindNextFileW

  FindVolumeClose

  GetDiskFreeSpaceW

  GetDriveTypeW

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileSize

  GetFileSizeEx

  GetLogicalDriveStringsW

  GetTempFileNameW

  LockFile

  QueryDosDeviceW

  ReadFileEx

  SetEndOfFile

  SetFilePointer

  SetFilePointerEx

  SetFileValidData

  WriteFile

  GetVolumePathNamesForVolumeNameW

  AreFileApisANSI

  SetFileApisToANSI

  PostQueuedCompletionStatus

  SleepEx

  GetProcessTimes

  GetExitCodeProcess

  GetCurrentThreadId

  SetThreadPriority

  GetThreadPriority

  TerminateThread

  TlsGetValue

  TlsSetValue

  SetProcessShutdownParameters

  GetProcessVersion

  GetThreadTimes

  GetProcessHandleCount

  SetProcessPriorityBoost

  GetThreadIOPendingFlag

  SetThreadIdealProcessor

  GetLogicalProcessorInformation

  GetProcessWorkingSetSize

  AssignProcessToJobObject

  TerminateJobObject

  GetNumaHighestNodeNumber

  SetProcessAffinityMask

  ConvertFiberToThread

  ConvertThreadToFiber

  SetThreadAffinityMask

  SetTapePosition

  GetTapePosition

  GetTapeParameters

  SetTapeParameters

  lstrcpynW

  BackupRead

  BackupSeek

  CheckNameLegalDOS8Dot3W

  CopyFileW

  CopyFileExW

  MoveFileW

  FindNextVolumeMountPointW

  GetNumaNodeProcessorMask

  GetNumaAvailableMemoryNode

  GetOEMCP

  GetLocaleInfoW

  IsValidLanguageGroup

  GetGeoInfoW

  EnumSystemGeoID

  GetUserGeoID

  GetSystemDefaultUILanguage

  GetUserDefaultLangID

  GetSystemDefaultLangID

  GetUserDefaultLCID

  AttachConsole

  GetConsoleCP

  GetConsoleOutputCP

  GetConsoleMode

  ReadConsoleInputW

  ReadConsoleW

  WriteConsoleW

  SetStdHandle

  GenerateConsoleCtrlEvent

  FlushConsoleInputBuffer

  GetConsoleCursorInfo

  SetConsoleCursorInfo

  SetConsoleScreenBufferSize

  GetLargestConsoleWindowSize

  SetConsoleTextAttribute

  WriteConsoleOutputCharacterW

  WriteConsoleOutputAttribute

  ReadConsoleOutputCharacterW

  ReadConsoleOutputAttribute

  GetCurrentConsoleFont

  GetConsoleSelectionInfo

  CloseHandle

  CreateFileW

  FlushFileBuffers

  HeapReAlloc

  HeapSize

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  GetStringTypeW

  GetFileType

  FreeEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetACP

  IsValidCodePage

  FindClose

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  TerminateProcess

  ExitProcess

  GetCurrentProcess

  GetModuleFileNameW

  GetStdHandle

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  TlsFree

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  RtlCaptureContext

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  SetConsoleCtrlHandler

  GetModuleHandleA

  winspool.drv

  WritePrinter

  ReadPrinter

  ScheduleJob

  FindFirstPrinterChangeNotification

  FindNextPrinterChangeNotification

  FindClosePrinterChangeNotification

  AbortPrinter

  ole32

  IsAccelerator

  GetRunningObjectTable

  GetClassFile

  MonikerRelativePathTo

  MkParseDisplayName

  BindMoniker

  CoTreatAsClass

  CoDosDateTimeToFileTime

  CoFileTimeToDosDateTime

  CoIsOle1Class

  CoAllowSetForegroundWindow

  CoGetInstanceFromIStorage

  CoGetInstanceFromFile

  CoRevokeInitializeSpy

  CoRevokeMallocSpy

  CLSIDFromProgIDEx

  CoTaskMemFree

  CoTaskMemRealloc

  CoTaskMemAlloc

  CoInvalidateRemoteMachineBindings

  CoGetTreatAsClass

  StringFromGUID2

  IIDFromString

  OleRegGetMiscStatus

  CLSIDFromString

  StringFromCLSID

  CoDisableCallCancellation

  CoTestCancel

  OleGetIconOfFile

  CoSetCancelObject

  CoGetCancelObject

  CoSwitchCallContext

  CoQueryAuthenticationServices

  CoRevertToSelf

  CoImpersonateClient

  CoQueryClientBlanket

  CoCopyProxy

  CoGetInterfaceAndReleaseStream

  CoMarshalInterThreadInterfaceInStream

  CoIsHandlerConnected

  CoGetStdMarshalEx

  CoGetStandardMarshal

  CoLockObjectExternal

  CoUnmarshalHresult

  CoMarshalHresult

  CoUnmarshalInterface

  CoMarshalInterface

  CoGetPSClsid

  CoSuspendClassObjects

  CoResumeClassObjects

  CoRevokeClassObject

  CoGetClassObject

  CoGetObjectContext

  CoGetContextToken

  CoGetCurrentLogicalThreadId

  CoGetMalloc

  OleGetIconOfClass

  OleDoAutoConvert

  CoCancelCall

  OleRegGetUserType

  OleGetAutoConvert

  OleSetAutoConvert

  StringFromIID

  CoGetInterceptor

  CoQueryProxyBlanket

  version

  VerFindFileW

  VerInstallFileW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  comctl32

  ord413

  dxgi

  CreateDXGIFactory

  Sections

  .text

  Size: 2.5MB - Virtual size: 2.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 45KB - Virtual size: 45KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 26KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8eadfc2a0f3dce9b786340417545bc64a10dbd32e8677bbcf61929df787d4055.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  HFyi.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 782KB - Virtual size: 782KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8eb8822fcff05d89036329669bd654ca07ac68acbe7266d62223e2b5ad9eb67b.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  b0:8d:3a:8f:80:6d:4c:a0:fe:31:1f:9d:cc:78:c1:36:e5:63:27:3c:88:bd:24:c8:65:40:80:a0:10:16:7e:95

  Signer

  Actual PE Digest

  b0:8d:3a:8f:80:6d:4c:a0:fe:31:1f:9d:cc:78:c1:36:e5:63:27:3c:88:bd:24:c8:65:40:80:a0:10:16:7e:95

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\huvo4\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/8ed14dadb7987466d677dd625530ffe02d4e1163efd4629024e6509fb99a178e.exe

  .exe windows:4 windows x64 arch:x64

  696cdf92210f378d905533f7cfbbf25a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  GetTokenInformation

  OpenProcessToken

  SystemFunction036

  bcrypt

  BCryptGenRandom

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  InitializeCriticalSection

  LeaveCriticalSection

  RaiseException

  RtlUnwindEx

  VirtualQuery

  __C_specific_handler

  AddVectoredExceptionHandler

  CancelIo

  CloseHandle

  CompareStringOrdinal

  CreateEventW

  CreateFileMappingA

  CreateFileW

  CreateNamedPipeW

  CreateProcessW

  CreateThread

  CreateToolhelp32Snapshot

  CreateWaitableTimerExW

  DeleteProcThreadAttributeList

  DuplicateHandle

  ExitProcess

  FormatMessageW

  FreeEnvironmentStringsW

  GetConsoleMode

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileInformationByHandleEx

  GetFullPathNameW

  GetLastError

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleW

  GetOverlappedResult

  GetProcAddress

  GetProcessHeap

  GetStdHandle

  GetSystemDirectoryW

  GetSystemInfo

  GetWindowsDirectoryW

  GlobalMemoryStatusEx

  HeapAlloc

  HeapFree

  HeapReAlloc

  InitOnceBeginInitialize

  InitOnceComplete

  InitializeProcThreadAttributeList

  LoadLibraryA

  LoadLibraryExA

  MapViewOfFile

  Module32FirstW

  Module32NextW

  MultiByteToWideChar

  Process32First

  Process32Next

  QueryPerformanceCounter

  QueryPerformanceFrequency

  ReadFile

  ReadFileEx

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetFileInformationByHandle

  SetLastError

  SetThreadStackGuarantee

  SetUnhandledExceptionFilter

  SetWaitableTimer

  Sleep

  SleepEx

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnmapViewOfFile

  UpdateProcThreadAttribute

  VirtualAlloc

  VirtualProtect

  WaitForMultipleObjects

  WaitForSingleObject

  WriteConsoleW

  WriteFileEx

  lstrlenW

  msvcrt

  __getmainargs

  __initenv

  __iob_func

  __set_app_type

  __setusermatherr

  _amsg_exit

  _cexit

  _commode

  _fmode

  _fpreset

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcmp

  memcpy

  memmove

  memset

  signal

  strlen

  strncmp

  vfprintf

  ntdll

  NtReadFile

  NtWriteFile

  RtlNtStatusToDosError

  ole32

  CoTaskMemFree

  oleaut32

  SysFreeString

  SysStringLen

  shell32

  SHGetKnownFolderPath

  api-ms-win-core-synch-l1-2-0

  WaitOnAddress

  WakeByAddressAll

  WakeByAddressSingle

  bcryptprimitives

  ProcessPrng

  Sections

  .text

  Size: 839KB - Virtual size: 838KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 384B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1.8MB - Virtual size: 1.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 25KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 576B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/90d3dbe2c8ae46b970a865f597d091688e7c04c7886a1ec287e4b7a0f5e2fcf1.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  .text

  Size: 566KB - Virtual size: 566KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 15KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 29KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 56B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9100672d5ec3631ff800ae7017f74b085b651a6027dcbe77bbfab67ef0e63c48.exe

  .exe windows:6 windows x86 arch:x86

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Code Sign

  56:b6:29:cd:34:bc:78:f6

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  31-05-2017 18:14

  Not After

  30-05-2042 18:14

  Subject

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  6d:b3:f3:a5:b1:ac:aa:d4:23:cf:9c:97:df:bd:61:4f

  Certificate

  Issuer

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  05-09-2024 14:32

  Not After

  05-09-2025 14:32

  Subject

  SERIALNUMBER=09221780,CN=Macpaw Labs LTD,O=Macpaw Labs LTD,L=London,C=GB,1.3.6.1.4.1.311.60.2.1.3=#13024742,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  42:4b:6a:53:ce:c7:66:14:1c:2a:63:b1:a5:1c:41:04

  Certificate

  Issuer

  CN=SSL.com EV Root Certification Authority RSA R2,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  26-03-2019 17:44

  Not After

  22-03-2034 17:44

  Subject

  CN=SSL.com EV Code Signing Intermediate CA RSA R3,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  5a:5a:ac:e8:1a:35:6e:b4:62:86:8d:57:7d:e0:3d:c7

  Certificate

  Issuer

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Not Before

  19-02-2024 16:18

  Not After

  16-02-2034 16:18

  Subject

  CN=SSL.com Timestamping Unit 2024 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

  Certificate

  Issuer

  CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

  Not Before

  13-11-2019 18:50

  Not After

  12-11-2034 18:50

  Subject

  CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  ab:5f:27:67:4e:f8:22:27:60:36:2b:81:bf:2a:79:cf:d1:94:28:7d:9e:fc:e0:3a:b3:16:16:b9:cb:71:74:b2

  Signer

  Actual PE Digest

  ab:5f:27:67:4e:f8:22:27:60:36:2b:81:bf:2a:79:cf:d1:94:28:7d:9e:fc:e0:3a:b3:16:16:b9:cb:71:74:b2

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 5.6MB - Virtual size: 5.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11.9MB - Virtual size: 11.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 345KB - Virtual size: 658KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 500KB - Virtual size: 499KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 208KB - Virtual size: 207KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/911d2038b8b7ee747a74504f71ea52f5e528bb1967b367c4c8a595bb1b6435db.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 298KB - Virtual size: 298KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/913c7e24f2b7a0acc0fa90a726ba9a531671c77f4f3b15dd54be4ef5b86c7a96.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  TRoq

  Size: 321KB - Virtual size: 321KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .text

  Size: 78KB - Virtual size: 78KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/915bc4d4e2670ce3cdb8833379578b2e6ade1446e5935d21d12ff25d9b496165.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 327KB - Virtual size: 326KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/91d247506a8b08669201d3309ab9d9977cd711452ccde0c20647c2ec77a42855.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 350KB - Virtual size: 350KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/91f03b0ae9dcae932e3043b7cb19cf52541504e9a4510501d9cb2f1ddd6d10f4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  77:0d:75:90:1b:c5:75:bb:36:76:8c:f9:d1:35:a9:54:bb:c6:06:67:d2:df:81:76:3b:56:86:11:36:42:d2:77

  Signer

  Actual PE Digest

  77:0d:75:90:1b:c5:75:bb:36:76:8c:f9:d1:35:a9:54:bb:c6:06:67:d2:df:81:76:3b:56:86:11:36:42:d2:77

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\m63pmix8\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/92c5a24d6412d5e91c001b33ab65cd1094e55264db42ac1a5680a0b2907a638c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 103KB - Virtual size: 103KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 68KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/94f81b8ac843eb0d8ac3fd3b836f17bcaadadc88184e373794d99ad2a4acfa71.exe

  .exe windows:5 windows x86 arch:x86

  dd68e663380c71f66b512f005f1be7ec

  
  

  Code Sign

  13:3e:63:bd:3c:21:25:cf:1f:5b:c0:4c:54:5b:4b:b6:0c:14:d8:e0

  Certificate

  Issuer

  CN=Kiter Notidanid Reward\ ,O=Konturpljning,L=Ovington,ST=England,C=GB

  Not Before

  20-10-2023 08:53

  Not After

  19-10-2026 08:53

  Subject

  CN=Kiter Notidanid Reward\ ,O=Konturpljning,L=Ovington,ST=England,C=GB

  13:3e:63:bd:3c:21:25:cf:1f:5b:c0:4c:54:5b:4b:b6:0c:14:d8:e0

  Certificate

  Issuer

  CN=Kiter Notidanid Reward\ ,O=Konturpljning,L=Ovington,ST=England,C=GB

  Not Before

  20-10-2023 08:53

  Not After

  19-10-2026 08:53

  Subject

  CN=Kiter Notidanid Reward\ ,O=Konturpljning,L=Ovington,ST=England,C=GB

  56:90:d5:66:10:1a:bf:e8:62:9b:ff:7b:3d:91:bf:65:51:6d:28:e7:32:6c:ba:33:04:23:c0:74:25:88:1b:1a

  Signer

  Actual PE Digest

  56:90:d5:66:10:1a:bf:e8:62:9b:ff:7b:3d:91:bf:65:51:6d:28:e7:32:6c:ba:33:04:23:c0:74:25:88:1b:1a

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  27:76:74:6a:9f:d2:68:60:be:c6:cc:d5:c9:03:3a:f7:a3:9b:de:6f

  Signer

  Actual PE Digest

  27:76:74:6a:9f:d2:68:60:be:c6:cc:d5:c9:03:3a:f7:a3:9b:de:6f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  RegCloseKey

  RegDeleteKeyA

  RegDeleteValueA

  RegEnumKeyA

  RegEnumValueA

  RegQueryValueExA

  RegSetValueExA

  OpenProcessToken

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  RegCreateKeyExA

  RegOpenKeyExA

  shell32

  SHBrowseForFolderA

  SHFileOperationA

  SHGetPathFromIDListA

  SHGetFileInfoA

  ShellExecuteExA

  ole32

  OleUninitialize

  IIDFromString

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  comctl32

  ord17

  ImageList_Create

  ImageList_Destroy

  ImageList_AddMasked

  user32

  DispatchMessageA

  SystemParametersInfoA

  LoadCursorA

  SetClassLongA

  GetSysColor

  ScreenToClient

  SetCursor

  GetWindowRect

  TrackPopupMenu

  AppendMenuA

  EnableMenuItem

  CreatePopupMenu

  GetSystemMenu

  GetSystemMetrics

  IsWindowEnabled

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  OpenClipboard

  CheckDlgButton

  EndDialog

  DialogBoxParamA

  IsWindowVisible

  SetWindowPos

  CreateWindowExA

  GetClassInfoA

  RegisterClassA

  PeekMessageA

  GetMessagePos

  CharNextA

  ExitWindowsEx

  SetWindowTextA

  SetTimer

  CreateDialogParamA

  DestroyWindow

  LoadImageA

  FindWindowExA

  SetWindowLongA

  InvalidateRect

  ReleaseDC

  GetDC

  SetForegroundWindow

  EnableWindow

  GetDlgItem

  ShowWindow

  IsWindow

  PostQuitMessage

  SendMessageTimeoutA

  SendMessageA

  wsprintfA

  FillRect

  GetClientRect

  EndPaint

  BeginPaint

  DrawTextA

  DefWindowProcA

  SetDlgItemTextA

  GetDlgItemTextA

  MessageBoxIndirectA

  CallWindowProcA

  CharPrevA

  GetWindowLongA

  gdi32

  GetDeviceCaps

  SetBkColor

  CreateBrushIndirect

  SetTextColor

  SetBkMode

  SelectObject

  DeleteObject

  CreateFontIndirectA

  kernel32

  GetTempFileNameA

  GetLastError

  WaitForSingleObject

  RemoveDirectoryA

  ReadFile

  CreateFileA

  CreateDirectoryA

  lstrcpynA

  GlobalLock

  GlobalUnlock

  CreateThread

  GetDiskFreeSpaceA

  CopyFileA

  lstrlenA

  GetVersionExA

  GetWindowsDirectoryA

  ExitProcess

  GetCurrentProcess

  GetExitCodeProcess

  GetTempPathA

  SetEnvironmentVariableA

  GetCommandLineA

  GetModuleFileNameA

  GetTickCount

  GetFileSize

  MultiByteToWideChar

  MoveFileA

  WritePrivateProfileStringA

  GetPrivateProfileStringA

  lstrcmpiA

  lstrcmpA

  MulDiv

  GetShortPathNameA

  GlobalFree

  GlobalAlloc

  LoadLibraryExA

  GetModuleHandleA

  FreeLibrary

  Sleep

  CloseHandle

  SetFileTime

  SetFilePointer

  SetFileAttributesA

  GetFullPathNameA

  GetFileAttributesA

  FindNextFileA

  FindFirstFileA

  FindClose

  DeleteFileA

  CompareFileTime

  SearchPathA

  SetCurrentDirectoryA

  ExpandEnvironmentStringsA

  WriteFile

  CreateProcessA

  WideCharToMultiByte

  GetSystemDirectoryA

  GetProcAddress

  lstrcpyA

  lstrcatA

  MoveFileExA

  SetErrorMode

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 136KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 257KB - Virtual size: 257KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/95421497e3e6ca2165ab17bb6407cc64f90408a90e1c4c519f6564ca5506c727.exe

  .exe windows:5 windows x86 arch:x86

  1d1ec441fe0c255b7bd79f009a10a8a3

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetComputerNameA

  SearchPathW

  SetPriorityClass

  GetNumaProcessorNode

  GetConsoleAliasExesLengthA

  InterlockedIncrement

  OpenJobObjectA

  QueryDosDeviceA

  GetComputerNameW

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetTickCount

  GetConsoleAliasesLengthA

  GetUserDefaultLangID

  GetEnvironmentStrings

  LoadLibraryW

  GetConsoleMode

  Sleep

  CopyFileW

  WriteConsoleOutputA

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetModuleFileNameW

  GetBinaryTypeW

  GetStartupInfoW

  WritePrivateProfileStringW

  DisconnectNamedPipe

  GetCommandLineW

  GetConsoleAliasesW

  FillConsoleOutputCharacterW

  GetLastError

  GetProcAddress

  SetStdHandle

  EnterCriticalSection

  SearchPathA

  BuildCommDCBW

  InterlockedExchangeAdd

  OpenWaitableTimerW

  LocalAlloc

  FoldStringW

  GetModuleFileNameA

  GetDefaultCommConfigA

  SetConsoleTitleW

  GetModuleHandleA

  GetShortPathNameW

  SetCalendarInfoA

  FindAtomW

  GlobalReAlloc

  SetFileAttributesW

  CopyFileExA

  GetVolumeInformationW

  CreateFileW

  SetFilePointer

  CloseHandle

  CreateDirectoryA

  DebugActiveProcess

  HeapAlloc

  EncodePointer

  DecodePointer

  MultiByteToWideChar

  HeapSetInformation

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  ExitProcess

  WriteFile

  GetStdHandle

  HeapCreate

  HeapSize

  GetCPInfo

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  HeapReAlloc

  RtlUnwind

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeW

  HeapFree

  IsProcessorFeaturePresent

  GetConsoleCP

  FlushFileBuffers

  WriteConsoleW

  user32

  SetFocus

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 130KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 35.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 135KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/95704aebba0511e4853ac25736a52048cb4f87b74df5ae42886602f9ca0f1808.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 243KB - Virtual size: 242KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/95e922bc96ec909a9eb80ae3716af0038ee3de24fc22b569c527764bf3be27a1.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 90KB - Virtual size: 89KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9624383d6ceb24015deaeac4576a474da6dc0c676d66e15dd11ec65429335bf8.exe

  .exe windows:4 windows x86 arch:x86

  d4b94e8ee3f620a89d114b9da4b31873

  
  

  Code Sign

  12:ee:b5:85:c9:29:31:7e:ab:09:7a:b6:e0:ba:06:3e:0b:76:12:d5

  Certificate

  Issuer

  CN=Afdelingscomputerernes deaness\ ,O=Renhaarene,L=Raleigh,ST=North Carolina,C=US

  Not Before

  14-02-2024 00:14

  Not After

  13-02-2027 00:14

  Subject

  CN=Afdelingscomputerernes deaness\ ,O=Renhaarene,L=Raleigh,ST=North Carolina,C=US

  c7:03:ca:2d:4d:47:75:7e:9c:ac:94:bc:b3:05:fc:fa:de:18:8d:e6:67:1d:d7:9f:d6:58:03:49:01:50:5c:b9

  Signer

  Actual PE Digest

  c7:03:ca:2d:4d:47:75:7e:9c:ac:94:bc:b3:05:fc:fa:de:18:8d:e6:67:1d:d7:9f:d6:58:03:49:01:50:5c:b9

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetCurrentDirectoryW

  GetFileAttributesW

  GetFullPathNameW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  MoveFileW

  SetFileAttributesW

  GetCurrentProcess

  ExitProcess

  SetEnvironmentVariableW

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  GetVersion

  SetErrorMode

  lstrlenW

  lstrcpynW

  CopyFileW

  CompareFileTime

  GlobalLock

  CreateThread

  GetLastError

  CreateDirectoryW

  CreateProcessW

  RemoveDirectoryW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  WriteFile

  lstrcpyA

  lstrcpyW

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  LoadLibraryW

  GetProcAddress

  GetModuleHandleA

  ExpandEnvironmentStringsW

  GetShortPathNameW

  SearchPathW

  lstrcmpiW

  SetFileTime

  CloseHandle

  GlobalFree

  lstrcmpW

  GlobalAlloc

  WaitForSingleObject

  GlobalUnlock

  GetDiskFreeSpaceW

  GetExitCodeProcess

  FindFirstFileW

  FindNextFileW

  DeleteFileW

  SetFilePointer

  ReadFile

  FindClose

  MulDiv

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleW

  user32

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  EnableMenuItem

  SetWindowPos

  GetSysColor

  GetWindowLongW

  SetCursor

  LoadCursorW

  CheckDlgButton

  GetMessagePos

  LoadBitmapW

  CallWindowProcW

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  wsprintfW

  ScreenToClient

  GetWindowRect

  GetSystemMetrics

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharPrevW

  CharNextA

  wsprintfA

  DispatchMessageW

  PeekMessageW

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamW

  GetDC

  SetWindowTextW

  PostQuitMessage

  ShowWindow

  GetDlgItem

  IsWindow

  LoadImageW

  SetWindowLongW

  TrackPopupMenu

  AppendMenuW

  CreatePopupMenu

  EndPaint

  SetTimer

  FindWindowExW

  SendMessageTimeoutW

  SetForegroundWindow

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectW

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  advapi32

  RegDeleteKeyW

  SetFileSecurityW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegOpenKeyExW

  RegEnumValueW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumKeyW

  comctl32

  ImageList_Create

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  Sections

  .text

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 120KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 136KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/964ba857d57898c3436983efbe717633dc9ce4a83481654c8764513daa57ab7a.exe

  .exe windows:10 windows x86 arch:x86

  9e41f63b8143bebfb96200b6d2b13400

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  imecfmui.pdb

  Imports

  advapi32

  EventWrite

  EventRegister

  EventUnregister

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegCloseKey

  RegOpenCurrentUser

  OpenProcessToken

  GetTokenInformation

  IsValidSid

  ConvertSidToStringSidW

  GetSidSubAuthority

  GetSidSubAuthorityCount

  RegOpenKeyExW

  kernel32

  DeleteFileW

  CloseHandle

  GetProcAddress

  CreateFileW

  GetTickCount

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleHandleA

  TerminateProcess

  GetCurrentProcess

  GetTempPathW

  UnhandledExceptionFilter

  GetStartupInfoW

  Sleep

  GetModuleFileNameA

  ExpandEnvironmentStringsW

  FreeLibrary

  GetLastError

  LocalFree

  GetVersionExW

  FindResourceExW

  LoadResource

  FindFirstFileW

  FindNextFileW

  FindClose

  LoadLibraryExW

  GetModuleHandleExW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  CompareStringW

  LockResource

  WriteFile

  gdi32

  GetDeviceCaps

  CreateFontIndirectW

  GetStockObject

  SelectObject

  GetTextExtentPoint32W

  GetObjectW

  user32

  DestroyWindow

  GetWindowLongW

  SetWindowLongW

  SendDlgItemMessageW

  GetDlgItem

  EnableWindow

  MessageBoxW

  SetDlgItemTextW

  PostMessageW

  GetDlgItemTextW

  SendMessageW

  LoadImageW

  GetWindowThreadProcessId

  GetSystemMetrics

  GetDC

  ReleaseDC

  GetKeyState

  InvalidateRect

  EndDialog

  GetCursor

  SetCursor

  LoadCursorW

  MapDialogRect

  GetClassInfoExW

  RegisterClassExW

  UnregisterClassW

  CreateWindowExW

  DefWindowProcW

  GetMessageW

  IsDialogMessageW

  TranslateMessage

  DispatchMessageW

  PostQuitMessage

  GetCursorPos

  SetForegroundWindow

  TrackPopupMenuEx

  GetSubMenu

  SetWindowTextW

  RegisterWindowMessageW

  SetProcessDPIAware

  UpdateWindow

  AllowSetForegroundWindow

  LoadMenuIndirectW

  DialogBoxIndirectParamW

  CreateDialogIndirectParamW

  DrawEdge

  DrawStateW

  GetWindowTextW

  SetWindowPos

  MapWindowPoints

  GetWindowRect

  GetClientRect

  EnumWindows

  GetClassNameW

  GetLastActivePopup

  DestroyIcon

  ShowWindow

  DestroyMenu

  msvcrt

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  _unlock

  _lock

  _wcmdln

  _initterm

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  _callnewh

  malloc

  ?what@exception@@UBEPBDXZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  memcpy

  __CxxFrameHandler3

  _CxxThrowException

  wcschr

  _wcstoi64

  _wtoi

  wcsncpy_s

  _vsnwprintf_s

  _purecall

  wcsncat_s

  ??_V@YAXPAX@Z

  wcsnlen

  memmove

  ??3@YAXPAX@Z

  ??1exception@@UAE@XZ

  memset

  ole32

  CoInitialize

  CoCreateInstance

  shell32

  ShellExecuteW

  SHGetFolderPathW

  Shell_NotifyIconW

  oleaut32

  SysAllocString

  VariantClear

  SysFreeString

  wer

  WerReportCloseHandle

  WerReportAddFile

  WerReportSubmit

  WerReportSetParameter

  WerReportCreate

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9721ea84aa82b10c5f21acc6212fb32f70750557cb6c5d9b3052ff12f74e4bce.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 1.0MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 370KB - Virtual size: 372KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 521KB - Virtual size: 524KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/97e03008b43e66a2bea0f7deef9bfb99e2211272778b9054e3e041b229cf4735.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9846da7bda0c0387c202919066f45595e8b9cc53b9f6ac34ffb6ee9ad2f2070e.exe

  .exe windows:10 windows x86 arch:x86

  f80bc97436232f135d9706a88c8c960e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  nslookup.pdb

  Imports

  msvcrt

  exit

  perror

  fclose

  fflush

  sscanf_s

  sprintf_s

  putchar

  gmtime

  strcat_s

  __set_app_type

  system

  strchr

  strcpy_s

  putc

  __setusermatherr

  __getmainargs

  _vsnprintf

  fputc

  _exit

  _cexit

  _amsg_exit

  __p__commode

  fopen

  strncpy_s

  _strnicmp

  fgets

  strncmp

  isspace

  __p__fmode

  memcpy

  malloc

  fread

  _XcptFilter

  free

  printf

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  _initterm

  fputs

  fwrite

  fprintf

  getc

  _write

  realloc

  ferror

  getenv

  __iob_func

  memset

  api-ms-win-core-heap-l1-1-0

  HeapAlloc

  HeapSetInformation

  GetProcessHeap

  HeapFree

  ws2_32

  getprotobynumber

  getservbyport

  WSAGetLastError

  ntohs

  select

  htonl

  gethostname

  getaddrinfo

  WSAStartup

  inet_ntoa

  freeaddrinfo

  send

  closesocket

  socket

  connect

  recv

  htons

  crypt32

  CryptBinaryToStringA

  api-ms-win-core-errorhandling-l1-1-0

  GetLastError

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  SetLastError

  dnsapi

  DnsQueryConfigAllocEx

  DnsFreeConfigStructure

  api-ms-win-core-localization-l1-2-0

  SetThreadUILanguage

  FormatMessageA

  api-ms-win-core-registry-l1-1-0

  RegCloseKey

  api-ms-win-core-processenvironment-l1-1-0

  ExpandEnvironmentStringsA

  mswsock

  s_perror

  api-ms-win-core-heap-l2-1-0

  LocalFree

  api-ms-win-core-synch-l1-2-0

  Sleep

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentThreadId

  GetCurrentProcess

  TerminateProcess

  GetCurrentProcessId

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleHandleW

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetTickCount

  GetSystemTimeAsFileTime

  ntdll

  NtQueryValueKey

  RtlInitString

  RtlUnicodeStringToAnsiString

  RtlFreeUnicodeString

  NtOpenKey

  RtlAllocateHeap

  RtlAnsiStringToUnicodeString

  RtlIpv6StringToAddressExA

  RtlIpv4StringToAddressA

  RtlIpv6AddressToStringA

  RtlFreeHeap

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  api-ms-win-core-apiquery-l1-1-0

  ApiSetQueryApiSetPresence

  Sections

  .text

  Size: 47KB - Virtual size: 46KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9860c9a9f21f2d5b91a1b280628a313894e86b14b4d29bc5f150dda7240a3ede.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 114KB - Virtual size: 113KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 52KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9872e627ec7fde1dd2a2aa89d288257ad2220ac5932434d1ebc24925c7eec278.exe

  .exe windows:6 windows x86 arch:x86

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 3.1MB - Virtual size: 3.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3.3MB - Virtual size: 3.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 268KB - Virtual size: 558KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 165KB - Virtual size: 164KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/991d1e29a1575cacedd43b0cc6254e4e8b905302238b354758933343bfac70da.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/99e2fcc17330e0e1d8e31c814d659c4a00110a6da389102e22a25eedae3933b2.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 699KB - Virtual size: 698KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9a6f5e16552d185a6bf7d82cafe02a49a982066ab8035c175bcbd7d0ae0c550f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  HhFp.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 717KB - Virtual size: 717KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9b2e59478ea4738cc23cdba5d1b9111c636410661a7a4592c35144de94b8c8ad.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 19.2MB - Virtual size: 19.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1020B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9b4013e7e8decdbe58db125765084aaaff774701c363ffbbd4f8dd24eda4fc3c.exe

  .exe windows:4 windows x86 arch:x86

  481f47bbb2c9c21e108d65f52b04c448

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  msvcrt

  _iob

  _except_handler3

  __set_app_type

  __p__fmode

  __p__commode

  _adjust_fdiv

  __setusermatherr

  _initterm

  __getmainargs

  __p___initenv

  _XcptFilter

  _exit

  _onexit

  __dllonexit

  strrchr

  wcsncmp

  _close

  wcslen

  wcscpy

  strerror

  modf

  strspn

  realloc

  __p__environ

  __p__wenviron

  _errno

  free

  strncmp

  strstr

  strncpy

  _ftol

  qsort

  fopen

  perror

  fclose

  fflush

  calloc

  malloc

  signal

  printf

  _isctype

  atoi

  exit

  __mb_cur_max

  _pctype

  strchr

  fprintf

  _controlfp

  _strdup

  _strnicmp

  kernel32

  PeekNamedPipe

  ReadFile

  WriteFile

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  GetExitCodeProcess

  TerminateProcess

  LeaveCriticalSection

  SetEvent

  ReleaseMutex

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  CreateMutexA

  GetFileType

  SetLastError

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GlobalFree

  GetCommandLineW

  TlsAlloc

  TlsFree

  DuplicateHandle

  GetCurrentProcess

  SetHandleInformation

  CloseHandle

  GetSystemTimeAsFileTime

  FileTimeToSystemTime

  GetTimeZoneInformation

  FileTimeToLocalFileTime

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  Sleep

  FormatMessageA

  GetLastError

  WaitForSingleObject

  CreateEventA

  SetStdHandle

  SetFilePointer

  CreateFileA

  CreateFileW

  GetOverlappedResult

  DeviceIoControl

  GetFileInformationByHandle

  LocalFree

  advapi32

  FreeSid

  AllocateAndInitializeSid

  wsock32

  getsockopt

  connect

  htons

  gethostbyname

  ntohl

  inet_ntoa

  setsockopt

  socket

  closesocket

  select

  ioctlsocket

  __WSAFDIsSet

  WSAStartup

  WSACleanup

  WSAGetLastError

  ws2_32

  WSARecv

  WSASend

  Sections

  .text

  Size: 44KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 16KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9b94e4c0a4edf5bf35c3c05e6a26d17590671c780b82467e2939588b58a33b41.exe

  .exe windows:6 windows x86 arch:x86

  9fd5b8944ce9c3acaedc650793d4996e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  CopyFileW

  ExitProcess

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLogicalDrives

  GetSystemDirectoryW

  GlobalLock

  GlobalUnlock

  user32

  CloseClipboard

  GetClipboardData

  GetDC

  GetSystemMetrics

  GetWindowInfo

  GetWindowLongW

  OpenClipboard

  ReleaseDC

  ole32

  CoCreateInstance

  CoInitializeEx

  CoInitializeSecurity

  CoSetProxyBlanket

  CoUninitialize

  gdi32

  BitBlt

  CreateCompatibleBitmap

  CreateCompatibleDC

  DeleteDC

  DeleteObject

  GetCurrentObject

  GetDIBits

  GetObjectW

  SelectObject

  StretchBlt

  oleaut32

  SysAllocString

  SysFreeString

  SysStringLen

  VariantClear

  VariantInit

  Sections

  .text

  Size: 256KB - Virtual size: 256KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 22KB - Virtual size: 24KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 16KB - Virtual size: 16KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  etoiv

  Size: 100KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/9bef149490674703ed211bd591252d0c1557251e2e0844f4d5885d84ec0207ff.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 440KB - Virtual size: 439KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9bf18fed06c26ef88efd8e78f93dc19918dcd328b25957ccb8ef056cacf1fc3a.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 44KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9c1173238ad24a2c0f1b36e424a3e9f94c41ab757c8897e4b57b9212fb8d4fd4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  d8:4f:56:bc:8c:33:d1:ef:2d:74:c9:9e:64:3b:9f:b5:46:4c:9a:70:9f:3e:26:d8:f6:ef:25:b8:a1:c9:77:26

  Signer

  Actual PE Digest

  d8:4f:56:bc:8c:33:d1:ef:2d:74:c9:9e:64:3b:9f:b5:46:4c:9a:70:9f:3e:26:d8:f6:ef:25:b8:a1:c9:77:26

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\g81rj1qzg3\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9cd19cf01e1d8c64caa0dffcd07dfb3304fc7257a1c468c0f3d4df1ad696319f.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 512B - Virtual size: 124B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 1KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1024B - Virtual size: 770B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 4B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 456B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3.1MB - Virtual size: 3.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9ce48d1d72246d1d59fa327530c41e08132d07a176e102f2ff4ae5dfb21158ca.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9df8349c91ff8bdee71cf3e257a0d2f6bab02dffcb92d16de350b9bc2cdef4f7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  57:a4:b5:aa:b1:02:cb:8b:4d:26:58:95:2b:7d:8a:a9

  Certificate

  Issuer

  CN=𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢🅑🅤🅘🅛🅓🅘🅝🅖 🅐 🅣🅡🅤🅛🅨 🅘🅝🅒🅛🅤🅢🅘🅥🅔 🅦🅞🅡🅚🅟🅛🅐🅒🅔🅑🅤🅘🅛🅓🅘🅝🅖 🅐 🅣🅡🅤🅛🅨 🅘🅝🅒🅛🅤🅢🅘🅥🅔 B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊🅦🅞🅡🅚🅟🅛🅐🅒🅔𝔭𝔩𝔞𝔠𝔢

  Not Before

  27-08-2024 01:22

  Not After

  28-08-2034 01:22

  Subject

  CN=𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢𝔅𝔲𝔦𝔩𝔡𝔦𝔫𝔤 𝔞 𝔱𝔯𝔲𝔩𝔶 𝔦𝔫𝔠𝔩𝔲𝔰𝔦𝔳𝔢 𝔴𝔬𝔯𝔨𝔭𝔩𝔞𝔠𝔢🅑🅤🅘🅛🅓🅘🅝🅖 🅐 🅣🅡🅤🅛🅨 🅘🅝🅒🅛🅤🅢🅘🅥🅔 🅦🅞🅡🅚🅟🅛🅐🅒🅔🅑🅤🅘🅛🅓🅘🅝🅖 🅐 🅣🅡🅤🅛🅨 🅘🅝🅒🅛🅤🅢🅘🅥🅔 B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊B̵͓̜̭̝͈̍̎̽̿u̶͖͈̠̯̠̅̂̊i҉͚̘̱̮͐̋l҈̮̥̌̍d̵̠̟͓̄̏͒̈̀i̵̖͉͖̤̽̋͊ň̶̮̯͍͉̪̇̔g̴̩͚͈͇̒̾̃̆ a҉̳̭̞͌̈̍ t̷͙̞̠͐͋r̶̬̪̊̀̌ͅu҈̖͎̝͕̰̍̽͋̔l̶͕̰͐̓̂y̶̠͉̤͂̓̇̐̃ i̵̤̬̅̎͋n҉̳̭̯̪̭͒̉c̷̣̣̯̊̀̀̀̀l̴͚̖̤̬͚̔͐u̴͈͍̽̿̏͛s̴̘̮͋̀̈́̾ĭ̸͍̟̅̚v̶̫͖͉͉̉̊̽e̷̱̾̀̓ͅ w̴̩̖͂́̀o̵̟̮̰̊̂̃r̴̲̳̅͑͊̚̚k̸̘̮͚̀͋͗̄p̵͎̤̲͙̓̀̽͌l̵̯̦̈́͋͂̓͊a҉̥͈͇̗̋̑̽̈́c̶͎̠̲̠̀̊͆̚e̴͖̖̖͉̤̿͊🅦🅞🅡🅚🅟🅛🅐🅒🅔𝔭𝔩𝔞𝔠𝔢

  3a:52:6a:2c:84:ce:55:e6:1d:65:fc:cc:12:d8:e9:89

  Certificate

  Issuer

  CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-01-2024 00:00

  Not After

  14-04-2035 23:59

  Subject

  CN=Sectigo Public Time Stamping Signer R35,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

  Certificate

  Issuer

  CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  22-03-2021 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  92:a0:44:33:71:9d:2b:9e:d2:0a:67:98:58:38:5c:4f:82:99:8f:4b:a6:8b:2f:4f:7e:cf:8d:27:e3:61:27:ce

  Signer

  Actual PE Digest

  92:a0:44:33:71:9d:2b:9e:d2:0a:67:98:58:38:5c:4f:82:99:8f:4b:a6:8b:2f:4f:7e:cf:8d:27:e3:61:27:ce

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  BotClient.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 6.1MB - Virtual size: 6.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .sdata

  Size: 512B - Virtual size: 170B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 214KB - Virtual size: 213KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9e744e77d0f51d7a0f981a6a224aba5f9ee5a86698ad098f88c38bef955f21d8.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\lgccwwjej\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/9e7fb9a16c6d763c1fed9f665103b7ae273e8d86f7e59e832b2dfd000b3e072c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 58KB - Virtual size: 58KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a0a9417b529beeb5889f15445f335e71b54815d8333048da716299fffac32d9f.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 329KB - Virtual size: 328KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a1c124aa85ef07d4c39706dcd012d208576a4b08ec24106fd28d4c5847f9afc9.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 671KB - Virtual size: 671KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.4MB - Virtual size: 2.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 356KB - Virtual size: 515KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 119KB - Virtual size: 119KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 183KB - Virtual size: 182KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a33f295649eea0542da21ed408566d07f7c3729c058ff07580326d0a9956aa75.exe

  .exe windows:5 windows x86 arch:x86

  662b6c83e785a39e56177737f36bd6d2

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  user32

  CreateWindowExW

  MessageBoxW

  MessageBoxA

  SystemParametersInfoW

  DestroyIcon

  SetWindowLongW

  GetWindowLongW

  GetClientRect

  InvalidateRect

  ReleaseDC

  GetDC

  DrawTextW

  GetDialogBaseUnits

  EndDialog

  DialogBoxIndirectParamW

  MoveWindow

  SendMessageW

  comctl32

  ord380

  kernel32

  IsValidCodePage

  GetStringTypeW

  GetFileAttributesExW

  HeapReAlloc

  FlushFileBuffers

  GetCurrentDirectoryW

  GetACP

  GetOEMCP

  GetModuleHandleW

  MulDiv

  GetLastError

  SetDllDirectoryW

  GetModuleFileNameW

  GetProcAddress

  GetCommandLineW

  GetCPInfo

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  CreateDirectoryW

  GetTempPathW

  WaitForSingleObject

  Sleep

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LoadLibraryExW

  FindClose

  FindFirstFileExW

  CloseHandle

  GetCurrentProcess

  LocalFree

  FormatMessageW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  WriteConsoleW

  SetEndOfFile

  GetEnvironmentVariableW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  DecodePointer

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RaiseException

  GetCommandLineA

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetFullPathNameW

  RemoveDirectoryW

  FindNextFileW

  SetStdHandle

  SetConsoleCtrlHandler

  DeleteFileW

  ReadFile

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  CompareStringW

  LCMapStringW

  advapi32

  OpenProcessToken

  GetTokenInformation

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidW

  gdi32

  SelectObject

  DeleteObject

  CreateFontIndirectW

  Sections

  .text

  Size: 148KB - Virtual size: 147KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 55KB - Virtual size: 54KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 187KB - Virtual size: 186KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a3c5b99f9435e0c297203819b58e8f0b87dcfdf42271b71e429f86a7efd36a14.exe

  .exe windows:5 windows x86 arch:x86

  7f2222d75bcebeb591b7d884c5b9299b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetCurrentThread

  FindNextFileW

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  WaitForSingleObject

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  CloseHandle

  GetLastError

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  CreateThread

  DuplicateHandle

  EnterCriticalSection

  GetCurrentProcess

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  DeleteFileW

  SetEnvironmentVariableA

  user32

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  CopyImage

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  UnregisterHotKey

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  DeleteMenu

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 557KB - Virtual size: 557KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 179KB - Virtual size: 179KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 237KB - Virtual size: 237KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a4bd0f0ce06c2cbf97eaea9273d486b13d74e7734476063ddfc165f5131dc2f4.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 229KB - Virtual size: 228KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a5273ce78432a8f34e120ecd96da8681ece96ce8b54cc6eec68c0088c483b8ec.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  djdH.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 692KB - Virtual size: 692KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a6209b1ad489cd5712ce2d3cb08a9710dfb35a91107363c99eb77f9073ee6e88.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 338KB - Virtual size: 338KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a65417bb26c953b74d02dae93127b44db0327f6170f151e2122ef671beb2e717.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 452KB - Virtual size: 452KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a6d9dfa485815059b536ad37b38717e89688e28b59209bc41599372836175bf0.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a764b13001e6096c2ac36917bef4405ba8d22b6d06a5741f21977bf46c8afca4.exe

  .exe windows:4 windows x86 arch:x86

  f4639a0b3116c2cfc71144b88a929cfd

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  advapi32

  RegEnumValueW

  RegEnumKeyW

  RegQueryValueExW

  RegSetValueExW

  RegCloseKey

  RegDeleteValueW

  RegDeleteKeyW

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  OpenProcessToken

  RegOpenKeyExW

  RegCreateKeyExW

  shell32

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  SHFileOperationW

  ShellExecuteExW

  ole32

  CoCreateInstance

  OleUninitialize

  OleInitialize

  IIDFromString

  CoTaskMemFree

  comctl32

  ImageList_Destroy

  ord17

  ImageList_AddMasked

  ImageList_Create

  user32

  MessageBoxIndirectW

  GetDlgItemTextW

  SetDlgItemTextW

  CreatePopupMenu

  AppendMenuW

  TrackPopupMenu

  OpenClipboard

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  IsWindowVisible

  CallWindowProcW

  GetMessagePos

  CheckDlgButton

  LoadCursorW

  SetCursor

  GetSysColor

  SetWindowPos

  GetWindowLongW

  IsWindowEnabled

  SetClassLongW

  GetSystemMenu

  EnableMenuItem

  GetWindowRect

  ScreenToClient

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CharPrevW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  FindWindowExW

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  CharNextA

  wsprintfA

  DispatchMessageW

  CreateWindowExW

  PeekMessageW

  GetSystemMetrics

  gdi32

  GetDeviceCaps

  SetBkColor

  SelectObject

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  kernel32

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  RemoveDirectoryW

  CreateProcessW

  CreateDirectoryW

  GetLastError

  CreateThread

  GlobalLock

  GlobalUnlock

  GetDiskFreeSpaceW

  WideCharToMultiByte

  lstrcpynW

  lstrlenW

  SetErrorMode

  GetVersionExW

  GetCommandLineW

  GetTempPathW

  GetWindowsDirectoryW

  WriteFile

  CopyFileW

  ExitProcess

  GetCurrentProcess

  GetModuleFileNameW

  GetFileSize

  GetTickCount

  Sleep

  SetFileAttributesW

  GetFileAttributesW

  SetCurrentDirectoryW

  MoveFileW

  GetFullPathNameW

  GetShortPathNameW

  SearchPathW

  CompareFileTime

  SetFileTime

  CloseHandle

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalFree

  GlobalAlloc

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  lstrlenA

  MultiByteToWideChar

  ReadFile

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  MulDiv

  lstrcpyA

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  GetProcAddress

  GetModuleHandleA

  GetExitCodeProcess

  WaitForSingleObject

  SetEnvironmentVariableW

  Sections

  .text

  Size: 26KB - Virtual size: 26KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 170KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 144KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 161KB - Virtual size: 160KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a87b700c19104816959afda09a7673d758a21261d417c14d20a208280ee3385f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 602KB - Virtual size: 601KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a8c51b3be04e65138c49c8729de6d0bf8be8345e91eb66285219a867b5b6ceb5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 63KB - Virtual size: 62KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/a936577a5f446cc1502ee2947b3aa40d7d1df8e99b43f4b4f759966568f411f2.exe

  .exe windows:6 windows x86 arch:x86

  9cbefe68f395e67356e2a5d8d1b285c0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  PostQueuedCompletionStatus

  LoadLibraryA

  LoadLibraryW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetEnvironmentStringsW

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 783KB - Virtual size: 783KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1017KB - Virtual size: 1016KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 89KB - Virtual size: 262KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1024B - Virtual size: 988B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 67KB - Virtual size: 66KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/aa5fda8f2d38bc9f1f856b13235ba827f26d580e284675c89381197f283e1e77.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  b0:26:17:f7:8f:7f:af:d1:63:af:2f:1b:ac:13:dc:b7:95:3e:70:7d:30:7c:30:7e:02:97:4e:01:8c:8a:d6:4c

  Signer

  Actual PE Digest

  b0:26:17:f7:8f:7f:af:d1:63:af:2f:1b:ac:13:dc:b7:95:3e:70:7d:30:7c:30:7e:02:97:4e:01:8c:8a:d6:4c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\088cdy8x\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/aa66c3988f3631925873757ae73ac5630508a43e2eebe6c0502a4d3194de8e41.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\thesoft.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4.2MB - Virtual size: 4.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 99KB - Virtual size: 99KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ab6d864f42680ad444f9a445d3e403cfd1a6355985db933611ec4cb7607b76bf.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0c:c7:4d:47:41:14:39:28:0a:19:03:aa:d5:a5:68:ee:c6:55:6c:79:c7:d6:85:94:2c:62:b5:b9:f4:bb:49:da

  Signer

  Actual PE Digest

  0c:c7:4d:47:41:14:39:28:0a:19:03:aa:d5:a5:68:ee:c6:55:6c:79:c7:d6:85:94:2c:62:b5:b9:f4:bb:49:da

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\je8jrzx77gd\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ab7d521c4c56ad3b3770b2b0a649c2b3ffa81fe94ee06332a4452df07d255ab2.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  Lz?o7

  Size: 365KB - Virtual size: 365KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .text

  Size: 78KB - Virtual size: 78KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/abca40b38e430b2eca2c726dfbda0179abc347028f401bb3ddc143c293e218b5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  d2:bf:c1:b8:93:aa:b7:9e:37:39:d1:5e:b1:4a:88:0b:8d:48:91:53:27:b5:b3:7b:c6:f3:53:4b:4d:d2:c6:42

  Signer

  Actual PE Digest

  d2:bf:c1:b8:93:aa:b7:9e:37:39:d1:5e:b1:4a:88:0b:8d:48:91:53:27:b5:b3:7b:c6:f3:53:4b:4d:d2:c6:42

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\sjyfj\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/abfde88021abe4b85e7e1fec20b8a28e81fdac7512591c2dbdb590b54297f350.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  4c:7c:15:d6:bd:51:cf:fd:1c:7f:46:5a:62:36:4d:7a:ea:8e:a8:79:ac:c8:c0:76:23:c3:6a:c6:6e:39:9d:28

  Signer

  Actual PE Digest

  4c:7c:15:d6:bd:51:cf:fd:1c:7f:46:5a:62:36:4d:7a:ea:8e:a8:79:ac:c8:c0:76:23:c3:6a:c6:6e:39:9d:28

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\q2nmtnel0d\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ac1215cc2139f065412387a57b24c04c91fb160fb33f6c153e2aede45ceece70.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 237KB - Virtual size: 237KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ac3999e4290648c6f63aee0e20e04be509b7c0aa74fb60f5e6dbcd083e3b7e4c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  b3:29:9d:fe:14:a3:6e:34:02:e9:5d:75:0c:a6:b9:a4:2d:c6:1e:d5:81:d7:2d:89:55:fb:b2:77:e4:29:88:ca

  Signer

  Actual PE Digest

  b3:29:9d:fe:14:a3:6e:34:02:e9:5d:75:0c:a6:b9:a4:2d:c6:1e:d5:81:d7:2d:89:55:fb:b2:77:e4:29:88:ca

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\frbb8w\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/acae26cfe00f442507c384c69eb5a85326754c214795becd65ad4e798e881a83.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\otr.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 126KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/acd2567942374b6eb005d5c54108b8c76473ecf49ccdbd701d1ec18a75b514e0.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/acee75e211131a2a19d21e3a7b6d228cab0c52166fd57916699392f8ee5c72ff.exe

  .exe windows:1 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_BYTES_REVERSED_LO

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_BYTES_REVERSED_HI

  Sections

  CODE

  Size: 37KB - Virtual size: 36KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  DATA

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  BSS

  Size: - Virtual size: 3KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: - Virtual size: 8B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 24B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/adf208ac660095b79a3830a6d4d6a80d419f6b5374bff6641cccf7e82d4464fa.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ae5f4ca290fade383b6236a1c025027c4fc1247242a13e12f12e7f6be67f63a3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 577KB - Virtual size: 576KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 18KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ae7bc6b6f6ecb206a7b957e4bb86e0d11845c5b2d9f7a00a482bef63b567ce4c.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 233KB - Virtual size: 232KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 904KB - Virtual size: 904KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b070f0417d037130f23cb7ffdf8dd86e7f354d56af525bf2de15bf1991670c82.exe

  .exe windows:4 windows x64 arch:x64

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Sections

  UPX0

  Size: - Virtual size: 152KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 198KB - Virtual size: 200KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX2

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/b10d3a615a6fb0971d10d6e853977f6c4b80a2085732e8273b363c2efa21aa9f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  88:8f:0a:c4:2e:b0:cc:a3:d0:c0:d6:c5:ed:fb:a4:23:3e:05:37:6e:33:ec:15:22:24:9d:80:35:78:31:ac:6b

  Signer

  Actual PE Digest

  88:8f:0a:c4:2e:b0:cc:a3:d0:c0:d6:c5:ed:fb:a4:23:3e:05:37:6e:33:ec:15:22:24:9d:80:35:78:31:ac:6b

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\3t0wqd\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 270KB - Virtual size: 269KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b14840ed30290073cbce2dc18ab0073920881cbb647ac5eeda36e5bd8b3efa6c.exe

  .exe windows:5 windows x86 arch:x86

  ae6007afc702f11895b68e585cfb495e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetComputerNameA

  SearchPathW

  SetPriorityClass

  CopyFileExW

  GetNumaProcessorNode

  GetConsoleAliasExesLengthA

  InterlockedIncrement

  OpenJobObjectA

  QueryDosDeviceA

  GetComputerNameW

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetTickCount

  GetConsoleAliasesA

  GetConsoleAliasesLengthA

  GetUserDefaultLangID

  GetEnvironmentStrings

  LoadLibraryW

  GetConsoleMode

  Sleep

  CopyFileW

  WriteConsoleOutputA

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetModuleFileNameW

  GetBinaryTypeW

  GetStartupInfoW

  GetCommandLineW

  WritePrivateProfileStringW

  DisconnectNamedPipe

  CreateDirectoryA

  InterlockedExchange

  FillConsoleOutputCharacterW

  GetLastError

  GetProcAddress

  SetStdHandle

  EnterCriticalSection

  SearchPathA

  BuildCommDCBW

  OpenWaitableTimerW

  LocalAlloc

  FindAtomA

  FoldStringW

  GetDefaultCommConfigA

  SetConsoleTitleW

  GetModuleHandleA

  GetShortPathNameW

  SetCalendarInfoA

  GlobalReAlloc

  SetFileAttributesW

  GetVolumeInformationW

  CreateFileW

  SetFilePointer

  CloseHandle

  DebugActiveProcess

  HeapAlloc

  EncodePointer

  DecodePointer

  MultiByteToWideChar

  HeapSetInformation

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  ExitProcess

  WriteFile

  GetStdHandle

  HeapCreate

  HeapSize

  GetCPInfo

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  HeapReAlloc

  RtlUnwind

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeW

  HeapFree

  IsProcessorFeaturePresent

  GetConsoleCP

  FlushFileBuffers

  WriteConsoleW

  user32

  SetFocus

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 35.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 117KB - Virtual size: 117KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b14dba44c08182c9c21b34e90409943400645c7d88a6b1388bddc64464f26a73.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 738KB - Virtual size: 737KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b161c8168cd7f47bb72ee6ac365fcf0d51950142a9d290a40d8effe1d7ed1fd3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  9b:25:11:70:3a:29:dc:88:f0:ef:42:da:67:1a:2f:9b:a2:2f:43:ff:54:be:f4:e4:ca:da:9f:15:f2:52:1e:06

  Signer

  Actual PE Digest

  9b:25:11:70:3a:29:dc:88:f0:ef:42:da:67:1a:2f:9b:a2:2f:43:ff:54:be:f4:e4:ca:da:9f:15:f2:52:1e:06

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  15:d4:cd:be:44:6b:86:36:65:0d:b6:dc:da:17:1c:de:22:2c:cc:89

  Signer

  Actual PE Digest

  15:d4:cd:be:44:6b:86:36:65:0d:b6:dc:da:17:1c:de:22:2c:cc:89

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 734KB - Virtual size: 733KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b2859a6b6b14a8c4e4ced589eba7728ebb492c177a270630418a56b9b37644d9.exe

  .exe windows:4 windows x86 arch:x86

  6011984d7c1f1b97a34d7517a498bff8

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  advapi32

  RegCloseKey

  RegEnumKeyExA

  RegOpenKeyExA

  RegQueryValueExA

  kernel32

  CloseHandle

  CreateMutexA

  CreateProcessA

  ExitProcess

  FindResourceExA

  FormatMessageA

  GetCommandLineA

  GetCurrentDirectoryA

  GetCurrentProcess

  GetEnvironmentVariableA

  GetExitCodeProcess

  GetLastError

  GetModuleFileNameA

  GetModuleHandleA

  GetProcAddress

  GetStartupInfoA

  GlobalMemoryStatusEx

  LoadResource

  LocalFree

  LockResource

  SetEnvironmentVariableA

  SetLastError

  SetUnhandledExceptionFilter

  WaitForSingleObject

  msvcrt

  __getmainargs

  __p__environ

  __p__fmode

  __set_app_type

  _cexit

  _chdir

  _close

  _findclose

  _findfirst

  _findnext

  _iob

  _itoa

  _onexit

  _open

  _read

  _setmode

  _stat

  atexit

  atoi

  fclose

  fopen

  fprintf

  fwrite

  memset

  printf

  puts

  signal

  strcat

  strchr

  strcmp

  strcpy

  strlen

  strncat

  strncpy

  strpbrk

  strrchr

  strstr

  strtok

  shell32

  ShellExecuteA

  user32

  CreateWindowExA

  DispatchMessageA

  EnumWindows

  FindWindowExA

  GetMessageA

  GetSystemMetrics

  GetWindowLongA

  GetWindowRect

  GetWindowTextA

  GetWindowThreadProcessId

  KillTimer

  LoadImageA

  MessageBoxA

  PostQuitMessage

  SendMessageA

  SetForegroundWindow

  SetTimer

  SetWindowPos

  ShowWindow

  TranslateMessage

  UpdateWindow

  Sections

  .text

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 35KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 67KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/b36cc7dc6786179369b8465d62dd8d0e105c54b8fba640ba4a8de6ebd6fc479d.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 160KB - Virtual size: 160KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b3b54f3e52120da700ff1e78740711619b5c2c7a6ef39ed3b50dcaedd2e93077.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b3c5c896606eb408bd97f255b916cda8cf8aa4291c3f68c5108c9ff0f5b7c0b7.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 370KB - Virtual size: 370KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b422f4ef542446bcac80afc015c26e82fd783caa52c32d35ee44cda0614cffe9.exe

  .exe windows:6 windows x86 arch:x86

  40ab50289f7ef5fae60801f88d4541fc

  
  

  Code Sign

  76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  18-03-2020 00:00

  Not After

  18-03-2045 00:00

  Subject

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  81:4e:42:3e:c4:8e:b1:e0:d2:fd:e2:e3:00:1d:34:80

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  19-06-2024 03:25

  Not After

  28-07-2038 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  02:52:bd:23:f4:62:ef:e2:12:a0:00:df

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  03-06-2024 05:04

  Not After

  04-06-2025 05:04

  Subject

  SERIALNUMBER=1001152550,CN=INNOFLOW VINA COMPANY LIMITED,OU=IT Department,O=INNOFLOW VINA COMPANY LIMITED,STREET=Lo A2\, cum cong nghiep Do Luong\, Xa Do Luong\, Huyen Dong Hung,L=Thai Binh,ST=Thai Binh,C=VN,1.3.6.1.4.1.311.60.2.1.2=#1309546861692042696e68,1.3.6.1.4.1.311.60.2.1.3=#1302564e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  b9:b8:bb:02:5b:72:4a:90:d6:de:34:6d:08:ad:cb:29:99:e7:0b:a4

  Signer

  Actual PE Digest

  b9:b8:bb:02:5b:72:4a:90:d6:de:34:6d:08:ad:cb:29:99:e7:0b:a4

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetACP

  GetExitCodeProcess

  CloseHandle

  LocalFree

  SizeofResource

  VirtualProtect

  QueryPerformanceFrequency

  VirtualFree

  GetFullPathNameW

  GetProcessHeap

  ExitProcess

  HeapAlloc

  GetCPInfoExW

  RtlUnwind

  GetCPInfo

  GetStdHandle

  GetModuleHandleW

  FreeLibrary

  HeapDestroy

  ReadFile

  CreateProcessW

  GetLastError

  GetModuleFileNameW

  SetLastError

  FindResourceW

  CreateThread

  CompareStringW

  LoadLibraryA

  ResetEvent

  GetVolumeInformationW

  GetVersion

  GetDriveTypeW

  RaiseException

  FormatMessageW

  SwitchToThread

  GetExitCodeThread

  GetCurrentThread

  LoadLibraryExW

  LockResource

  GetCurrentThreadId

  UnhandledExceptionFilter

  VirtualQuery

  VirtualQueryEx

  Sleep

  EnterCriticalSection

  SetFilePointer

  LoadResource

  SuspendThread

  GetTickCount

  GetFileSize

  GetStartupInfoW

  GetFileAttributesW

  InitializeCriticalSection

  GetSystemWindowsDirectoryW

  GetThreadPriority

  SetThreadPriority

  GetCurrentProcess

  VirtualAlloc

  GetCommandLineW

  GetSystemInfo

  LeaveCriticalSection

  GetProcAddress

  ResumeThread

  GetVersionExW

  VerifyVersionInfoW

  HeapCreate

  GetWindowsDirectoryW

  LCMapStringW

  VerSetConditionMask

  GetDiskFreeSpaceW

  FindFirstFileW

  GetUserDefaultUILanguage

  lstrlenW

  QueryPerformanceCounter

  SetEndOfFile

  HeapFree

  WideCharToMultiByte

  FindClose

  MultiByteToWideChar

  LoadLibraryW

  SetEvent

  CreateFileW

  GetLocaleInfoW

  GetSystemDirectoryW

  DeleteFileW

  GetLocalTime

  GetEnvironmentVariableW

  WaitForSingleObject

  WriteFile

  ExitThread

  DeleteCriticalSection

  TlsGetValue

  GetDateFormatW

  SetErrorMode

  IsValidLocale

  TlsSetValue

  CreateDirectoryW

  GetSystemDefaultUILanguage

  EnumCalendarInfoW

  LocalAlloc

  GetUserDefaultLangID

  RemoveDirectoryW

  CreateEventW

  SetThreadLocale

  GetThreadLocale

  comctl32

  InitCommonControls

  user32

  CreateWindowExW

  TranslateMessage

  CharLowerBuffW

  CallWindowProcW

  CharUpperW

  PeekMessageW

  GetSystemMetrics

  SetWindowLongW

  MessageBoxW

  DestroyWindow

  CharUpperBuffW

  CharNextW

  MsgWaitForMultipleObjects

  LoadStringW

  ExitWindowsEx

  DispatchMessageW

  oleaut32

  SysAllocStringLen

  SafeArrayPtrOfIndex

  VariantCopy

  SafeArrayGetLBound

  SafeArrayGetUBound

  VariantInit

  VariantClear

  SysFreeString

  SysReAllocStringLen

  VariantChangeType

  SafeArrayCreate

  advapi32

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  OpenThreadToken

  AdjustTokenPrivileges

  LookupPrivilegeValueW

  RegOpenKeyExW

  OpenProcessToken

  FreeSid

  AllocateAndInitializeSid

  EqualSid

  RegQueryValueExW

  GetTokenInformation

  ConvertSidToStringSidW

  RegCloseKey

  Exports

  Exports

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 662KB - Virtual size: 661KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .itext

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 28KB

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 420B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 113B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .tls

  Size: - Virtual size: 24B

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 93B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b46420c24a371b5b05317ec59c65e7c7d6fdbfb772460f8f812810d7871da039.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 455KB - Virtual size: 454KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b4930dde2fc721a3d6648831dd4fe2ebd5085e0218864eb48e68e54a69d7cd41.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  qKKl.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 719KB - Virtual size: 718KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 216KB - Virtual size: 216KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b50609c9ef1be3f7adc193c2910d01ef4f10612acef701b3aec857c07fb14434.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b5f632b84f561d8cb108a24a19230d558c578b134845f97132c228fa76197ae5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  Gyzx.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 697KB - Virtual size: 696KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b6719029029e5c7a96005dbb17e6eeea26a1af0d1b0e090a4041d24cba3923f7.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 386KB - Virtual size: 385KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b736c6b7105621cabf5402e769b37818e51fb96a2308413c959a0a642cd603f2.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b7f92bbf59df7cfb571012b7aefa91bdc9f25b9cbced01e91dec5b0fc1380f7e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 661KB - Virtual size: 661KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b8d90a6e3d811e7bee3d8827bfb19f5cb5c03696c15f911db475b4497c386274.exe

  .exe windows:6 windows x64 arch:x64

  e824ca0c72805a08163cb2784b9a816c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  xor_loader.pdb

  Imports

  api-ms-win-core-synch-l1-2-0

  WaitOnAddress

  WakeByAddressAll

  WakeByAddressSingle

  kernel32

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  InitializeSListHead

  VirtualAlloc

  GetLastError

  CloseHandle

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  GetCurrentThread

  WaitForSingleObject

  QueryPerformanceCounter

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetLastError

  GetCurrentDirectoryW

  GetEnvironmentVariableW

  GetCommandLineW

  GetCurrentProcess

  GetStdHandle

  GetCurrentProcessId

  HeapFree

  HeapReAlloc

  lstrlenW

  ReleaseMutex

  GetProcessHeap

  HeapAlloc

  GetConsoleMode

  GetModuleHandleW

  GetModuleFileNameW

  MultiByteToWideChar

  WriteConsoleW

  WideCharToMultiByte

  IsProcessorFeaturePresent

  GetModuleHandleA

  GetProcAddress

  WaitForSingleObjectEx

  LoadLibraryA

  CreateMutexA

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  ntdll

  RtlNtStatusToDosError

  NtWriteFile

  vcruntime140

  __current_exception

  __current_exception_context

  __C_specific_handler

  _CxxThrowException

  memcmp

  memcpy

  __CxxFrameHandler3

  memmove

  memset

  api-ms-win-crt-runtime-l1-1-0

  _initterm_e

  exit

  _exit

  _initterm

  _get_initial_narrow_environment

  __p___argv

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  _configure_narrow_argv

  __p___argc

  _initialize_onexit_table

  _initialize_narrow_environment

  _register_onexit_function

  _crt_atexit

  terminate

  _set_app_type

  _seh_filter_exe

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-stdio-l1-1-0

  _set_fmode

  __p__commode

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  api-ms-win-crt-heap-l1-1-0

  free

  _set_new_mode

  Sections

  .text

  Size: 100KB - Virtual size: 100KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 33KB - Virtual size: 32KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 744B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 760B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b94bcdf5d6b9f1eb6abe97090993e8c4f66b514dd9c51193f16673e842253d86.exe

  .exe windows:5 windows x86 arch:x86

  bdaa4f11fa75ae7944b223ba584c1f57

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  user32

  CreateWindowExW

  MessageBoxW

  MessageBoxA

  SystemParametersInfoW

  DestroyIcon

  SetWindowLongW

  GetWindowLongW

  GetClientRect

  InvalidateRect

  ReleaseDC

  GetDC

  DrawTextW

  GetDialogBaseUnits

  EndDialog

  DialogBoxIndirectParamW

  MoveWindow

  SendMessageW

  comctl32

  ord380

  kernel32

  GetACP

  IsValidCodePage

  GetStringTypeW

  GetFileAttributesExW

  FlushFileBuffers

  GetCurrentDirectoryW

  GetOEMCP

  GetCPInfo

  GetModuleHandleW

  MulDiv

  GetLastError

  SetDllDirectoryW

  GetModuleFileNameW

  GetProcAddress

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  CreateDirectoryW

  GetTempPathW

  WaitForSingleObject

  Sleep

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LoadLibraryExW

  CloseHandle

  GetCurrentProcess

  LocalFree

  FormatMessageW

  MultiByteToWideChar

  WideCharToMultiByte

  FreeEnvironmentStringsW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  GetCommandLineW

  RtlUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  DecodePointer

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  RaiseException

  GetCommandLineA

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetFullPathNameW

  RemoveDirectoryW

  FindClose

  FindFirstFileExW

  FindNextFileW

  SetStdHandle

  SetConsoleCtrlHandler

  DeleteFileW

  ReadFile

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  CompareStringW

  LCMapStringW

  advapi32

  OpenProcessToken

  GetTokenInformation

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidW

  gdi32

  SelectObject

  DeleteObject

  CreateFontIndirectW

  Sections

  .text

  Size: 133KB - Virtual size: 132KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 52KB - Virtual size: 51KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 62KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 173KB - Virtual size: 173KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b9b382c0b867656b081b52daf285a0759833bf1d0f0ac30b39f48c3d2789eb26.exe

  .exe windows:5 windows x86 arch:x86

  1389569a3a39186f3eb453b501cfe688

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  FindNextFileA

  ExpandEnvironmentStringsA

  GetLongPathNameW

  CopyFileW

  GetLocaleInfoA

  CreateToolhelp32Snapshot

  Process32NextW

  Process32FirstW

  VirtualProtect

  SetLastError

  VirtualFree

  VirtualAlloc

  GetNativeSystemInfo

  HeapAlloc

  GetProcessHeap

  FreeLibrary

  IsBadReadPtr

  GetTempPathW

  OpenProcess

  OpenMutexA

  lstrcatW

  GetCurrentProcessId

  GetTempFileNameW

  UnmapViewOfFile

  DuplicateHandle

  CreateFileMappingW

  MapViewOfFile

  GetSystemDirectoryA

  GlobalAlloc

  GlobalLock

  GetTickCount

  GlobalUnlock

  WriteProcessMemory

  ResumeThread

  GetThreadContext

  ReadProcessMemory

  CreateProcessW

  SetThreadContext

  LocalAlloc

  GlobalFree

  MulDiv

  SizeofResource

  QueryDosDeviceW

  FindFirstVolumeW

  GetConsoleScreenBufferInfo

  SetConsoleTextAttribute

  lstrlenW

  GetStdHandle

  SetFilePointer

  FindResourceA

  LockResource

  LoadResource

  LocalFree

  FindVolumeClose

  GetVolumePathNamesForVolumeNameW

  lstrcpyW

  FindFirstFileA

  FormatMessageA

  FindNextVolumeW

  AllocConsole

  lstrcmpW

  GetModuleFileNameA

  lstrcpynA

  QueryPerformanceFrequency

  QueryPerformanceCounter

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  DeleteCriticalSection

  HeapSize

  WriteConsoleW

  SetStdHandle

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetCommandLineA

  GetOEMCP

  IsValidCodePage

  FindFirstFileExA

  ReadConsoleW

  GetConsoleMode

  GetConsoleCP

  FlushFileBuffers

  GetFileType

  GetTimeZoneInformation

  EnumSystemLocalesW

  GetUserDefaultLCID

  IsValidLocale

  GetTimeFormatW

  GetDateFormatW

  HeapReAlloc

  GetACP

  GetModuleHandleExW

  MoveFileExW

  RtlUnwind

  RaiseException

  LoadLibraryExW

  GetCPInfo

  GetStringTypeW

  GetLocaleInfoW

  LCMapStringW

  CompareStringW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetFileSize

  TerminateThread

  GetLastError

  CreateDirectoryW

  GetModuleHandleA

  RemoveDirectoryW

  MoveFileW

  SetFilePointerEx

  GetLogicalDriveStringsA

  DeleteFileW

  DeleteFileA

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  lstrlenA

  GetDriveTypeA

  FindNextFileW

  GetFileSizeEx

  FindFirstFileW

  GetModuleHandleW

  ExitProcess

  CreateMutexA

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  CreateProcessA

  PeekNamedPipe

  CreatePipe

  TerminateProcess

  ReadFile

  HeapFree

  HeapCreate

  CreateEventA

  GetLocalTime

  CreateThread

  SetEvent

  CreateEventW

  WaitForSingleObject

  Sleep

  GetModuleFileNameW

  CloseHandle

  ExitThread

  CreateFileW

  WriteFile

  SetConsoleOutputCP

  InitializeCriticalSectionAndSpinCount

  MultiByteToWideChar

  DecodePointer

  EncodePointer

  WideCharToMultiByte

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  WaitForSingleObjectEx

  ResetEvent

  SetEndOfFile

  user32

  GetMessageA

  GetWindowTextW

  wsprintfW

  GetClipboardData

  UnhookWindowsHookEx

  GetForegroundWindow

  ToUnicodeEx

  GetKeyboardLayout

  SetWindowsHookExA

  CloseClipboard

  OpenClipboard

  GetKeyboardState

  CallNextHookEx

  GetKeyboardLayoutNameA

  GetKeyState

  GetWindowTextLengthW

  DispatchMessageA

  SetForegroundWindow

  SetClipboardData

  EnumWindows

  ExitWindowsEx

  EmptyClipboard

  ShowWindow

  SetWindowTextW

  MessageBoxW

  IsWindowVisible

  CloseWindow

  SendInput

  EnumDisplaySettingsW

  mouse_event

  CreatePopupMenu

  TranslateMessage

  TrackPopupMenu

  DefWindowProcA

  CreateWindowExA

  AppendMenuA

  GetSystemMetrics

  RegisterClassExA

  GetCursorPos

  SystemParametersInfoW

  GetWindowThreadProcessId

  MapVirtualKeyA

  DrawIcon

  GetIconInfo

  gdi32

  BitBlt

  CreateCompatibleBitmap

  SelectObject

  CreateCompatibleDC

  StretchBlt

  GetDIBits

  DeleteObject

  CreateDCA

  GetObjectA

  DeleteDC

  advapi32

  CryptAcquireContextA

  CryptGenRandom

  CryptReleaseContext

  GetUserNameW

  RegEnumKeyExA

  QueryServiceStatus

  CloseServiceHandle

  OpenSCManagerW

  OpenSCManagerA

  ControlService

  StartServiceW

  QueryServiceConfigW

  ChangeServiceConfigW

  OpenServiceW

  EnumServicesStatusW

  AdjustTokenPrivileges

  LookupPrivilegeValueA

  OpenProcessToken

  RegCreateKeyA

  RegCloseKey

  RegQueryInfoKeyW

  RegQueryValueExA

  RegCreateKeyExW

  RegEnumKeyExW

  RegSetValueExW

  RegSetValueExA

  RegOpenKeyExA

  RegOpenKeyExW

  RegCreateKeyW

  RegDeleteValueW

  RegEnumValueW

  RegQueryValueExW

  RegDeleteKeyA

  shell32

  ShellExecuteExA

  Shell_NotifyIconA

  ExtractIconA

  ShellExecuteW

  ole32

  CoInitializeEx

  CoUninitialize

  CoGetObject

  shlwapi

  PathFileExistsW

  PathFileExistsA

  StrToIntA

  winmm

  waveInOpen

  waveInStart

  waveInAddBuffer

  PlaySoundW

  mciSendStringA

  mciSendStringW

  waveInClose

  waveInStop

  waveInPrepareHeader

  waveInUnprepareHeader

  ws2_32

  gethostbyname

  send

  WSAStartup

  closesocket

  inet_ntoa

  htons

  htonl

  getservbyname

  ntohs

  getservbyport

  gethostbyaddr

  inet_addr

  WSASetLastError

  WSAGetLastError

  recv

  connect

  socket

  urlmon

  URLOpenBlockingStreamW

  URLDownloadToFileW

  gdiplus

  GdipSaveImageToStream

  GdipGetImageEncodersSize

  GdipFree

  GdipDisposeImage

  GdipAlloc

  GdipCloneImage

  GdipGetImageEncoders

  GdiplusStartup

  GdipLoadImageFromStream

  wininet

  InternetOpenUrlW

  InternetOpenW

  InternetCloseHandle

  InternetReadFile

  Sections

  .text

  Size: 348KB - Virtual size: 348KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 94KB - Virtual size: 94KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 23KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .gfids

  Size: 1024B - Virtual size: 560B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 15KB - Virtual size: 14KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  04:02:92:c7:4b:05:45:70:be:18:e8:11:ca:6b:0d:bd:70:0d:36:d1:21:e4:81:db:13:33:21:06:21:8d:1c:08

  Signer

  Actual PE Digest

  04:02:92:c7:4b:05:45:70:be:18:e8:11:ca:6b:0d:bd:70:0d:36:d1:21:e4:81:db:13:33:21:06:21:8d:1c:08

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  92:52:d4:cb:80:61:da:08:8b:4b:ed:41:1b:a3:a3:7f:b9:30:3d:55

  Signer

  Actual PE Digest

  92:52:d4:cb:80:61:da:08:8b:4b:ed:41:1b:a3:a3:7f:b9:30:3d:55

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  TyhF.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 695KB - Virtual size: 694KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ba0c008b44599da07ba9545833d4184d9b17b980fd38963fcd25e1d6d312f99b.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/bb128ec75526887e8ebc2c1e4c0daf7b7ec1d41f039c0fb88e927b90fce6df9e.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 92KB - Virtual size: 91KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/bc4eb36562e864cf871ac0bc4683dfa93e9862625fd95a68cb9d7549d368ceba.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 868KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 370KB - Virtual size: 372KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 325KB - Virtual size: 328KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/bcff246f0739ed98f8aa615d256e7e00bc1cb24c8cabaea609b25c3f050c7805.exe

  .exe windows:6 windows x86 arch:x86

  07ec306d8c265e055632800f0622f63c

  
  

  Code Sign

  77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

  Certificate

  Issuer

  CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

  Not Before

  28-07-2020 00:00

  Not After

  28-07-2030 00:00

  Subject

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3b:17:b7:3a:15:a4:8a:30:dd:2e:dc:71

  Certificate

  Issuer

  CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

  Not Before

  06-08-2024 09:26

  Not After

  07-08-2025 08:42

  Subject

  SERIALNUMBER=91440101MA9URAWW0Q,CN=Brave Pragmatic Network Technology Co.\, Ltd.,O=Brave Pragmatic Network Technology Co.\, Ltd.,L=Guangzhou,ST=Guangdong,C=CN,1.3.6.1.4.1.311.60.2.1.1=#13094775616e677a686f75,1.3.6.1.4.1.311.60.2.1.2=#13094775616e67646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01:9b:ea:de:c8:4d:6b:8f:f7:6c:3a:9f:2e:01:24:16

  Certificate

  Issuer

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Not Before

  07-11-2023 17:13

  Not After

  09-12-2034 17:13

  Subject

  CN=Globalsign TSA for CodeSign1 - R6 - 202311,O=GlobalSign nv-sa,C=BE

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  20-06-2018 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

  Certificate

  Issuer

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Not Before

  10-12-2014 00:00

  Not After

  10-12-2034 00:00

  Subject

  CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  96:18:0c:da:50:d7:94:14:c1:b5:06:47:50:f7:a0:e9:42:ae:82:80:2e:1f:0a:64:d6:de:aa:f3:73:13:c0:9f

  Signer

  Actual PE Digest

  96:18:0c:da:50:d7:94:14:c1:b5:06:47:50:f7:a0:e9:42:ae:82:80:2e:1f:0a:64:d6:de:aa:f3:73:13:c0:9f

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  winmm

  PlaySoundA

  kernel32

  GetProcessHeap

  GetTimeFormatA

  GetDateFormatA

  SizeofResource

  FindResourceA

  GetLocaleInfoA

  Sleep

  LockResource

  CloseHandle

  CreateThread

  FindResourceExW

  LoadResource

  FindResourceW

  GetTickCount

  GlobalMemoryStatus

  FlushConsoleInputBuffer

  GetDriveTypeW

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  GetConsoleCP

  DeleteCriticalSection

  GetCurrentDirectoryW

  GetFullPathNameW

  SetConsoleMode

  ReadConsoleInputW

  WideCharToMultiByte

  GetFileSize

  CreateFileA

  WriteFile

  ReadFile

  DeleteFileA

  WriteConsoleW

  SetEndOfFile

  GetStringTypeW

  SetStdHandle

  SetEnvironmentVariableW

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  HeapDestroy

  DecodePointer

  HeapAlloc

  GetACP

  IsValidCodePage

  HeapReAlloc

  GetLastError

  HeapSize

  InitializeCriticalSectionEx

  HeapFree

  MulDiv

  FindFirstFileExW

  ReadConsoleW

  FlushFileBuffers

  SetConsoleCtrlHandler

  SetFilePointerEx

  CreateDirectoryA

  GetFileAttributesA

  SetFilePointer

  EnterCriticalSection

  LeaveCriticalSection

  GetCurrentThreadId

  GetLocalTime

  FreeLibrary

  GetProcAddress

  LoadLibraryA

  MoveFileExA

  MultiByteToWideChar

  GetCurrentDirectoryA

  LocalFileTimeToFileTime

  SetFileTime

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  GetFileInformationByHandle

  GetTickCount64

  MapViewOfFile

  UnmapViewOfFile

  FileTimeToDosDateTime

  CreateFileMappingA

  GetCommandLineW

  GetCurrentProcess

  GetCurrentProcessId

  ExitProcess

  OpenProcess

  GetModuleFileNameA

  GetModuleHandleA

  GetShortPathNameA

  CopyFileA

  CreateFileW

  ReleaseMutex

  WaitForSingleObject

  CreateMutexA

  FindClose

  FindFirstFileA

  FindFirstFileW

  FindNextFileA

  FindNextFileW

  CopyFileW

  CompareFileTime

  FindFirstFileExA

  SetLastError

  GetSystemTime

  IsDebuggerPresent

  OutputDebugStringW

  RaiseException

  GlobalAlloc

  GlobalFree

  lstrlenA

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  WakeAllConditionVariable

  SleepConditionVariableSRW

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TerminateProcess

  IsProcessorFeaturePresent

  GetStartupInfoW

  GetModuleHandleW

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  EncodePointer

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  GetModuleHandleExW

  GetModuleFileNameW

  GetStdHandle

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetFileType

  GetTimeZoneInformation

  GetConsoleOutputCP

  GetConsoleMode

  GetFileSizeEx

  user32

  GetActiveWindow

  IsWindowEnabled

  GetSystemMetrics

  SetActiveWindow

  InvalidateRgn

  GetWindowTextA

  MessageBoxA

  WindowFromPoint

  GetDesktopWindow

  EnumChildWindows

  EnumWindows

  GetClassNameA

  GetWindowThreadProcessId

  GetMonitorInfoA

  EnumDisplayMonitors

  wsprintfA

  RegisterWindowMessageA

  GetMessageA

  TranslateMessage

  DispatchMessageA

  PeekMessageA

  GetDoubleClickTime

  SetLayeredWindowAttributes

  DialogBoxParamA

  GetKeyState

  GetKeyNameTextA

  MapVirtualKeyA

  SetCapture

  ReleaseCapture

  GetForegroundWindow

  SetWindowTextA

  AdjustWindowRectEx

  MessageBeep

  SetCursor

  ChildWindowFromPoint

  SetClassLongA

  FindWindowExA

  LoadIconA

  DestroyIcon

  IsDialogMessageA

  MonitorFromRect

  MonitorFromWindow

  SetProcessDPIAware

  IsZoomed

  IsRectEmpty

  DrawFrameControl

  WindowFromDC

  GetSysColor

  CreateIconIndirect

  GetIconInfo

  SystemParametersInfoA

  GetDC

  SetParent

  GetWindowDC

  DrawFocusRect

  SetScrollInfo

  IsWindowVisible

  TrackPopupMenuEx

  InsertMenuItemA

  LookupIconIdFromDirectoryEx

  CreateIconFromResourceEx

  SetDlgItemTextW

  SendMessageA

  GetParent

  RedrawWindow

  EnableWindow

  EndPaint

  BeginPaint

  InvalidateRect

  FillRect

  SetForegroundWindow

  LoadCursorA

  ScreenToClient

  AdjustWindowRect

  RegisterClassA

  DrawIconEx

  PostQuitMessage

  PtInRect

  IsIconic

  ReleaseDC

  GetCursorPos

  LoadImageA

  GetWindowRect

  GetFocus

  DestroyWindow

  SetWindowPos

  PostMessageA

  EndDialog

  ShowWindow

  GetAsyncKeyState

  GetDlgItemTextA

  SetTimer

  SetWindowLongA

  GetDlgCtrlID

  CallWindowProcA

  MapWindowPoints

  GetWindowLongA

  DefWindowProcA

  CreateWindowExA

  SetFocus

  BringWindowToTop

  SendDlgItemMessageA

  SetDlgItemTextA

  CreateDialogParamA

  GetClientRect

  GetDlgItem

  KillTimer

  DrawTextA

  CopyRect

  FrameRect

  SetRect

  GetProcessWindowStation

  GetUserObjectInformationW

  CreatePopupMenu

  OffsetRect

  gdi32

  GetTextExtentPoint32A

  PatBlt

  SelectClipRgn

  GetDIBits

  CreateRectRgnIndirect

  BitBlt

  GetDeviceCaps

  CreateFontA

  StretchDIBits

  SetBkMode

  LineTo

  CreatePen

  Rectangle

  MoveToEx

  CreateRectRgn

  CreateSolidBrush

  CreateCompatibleBitmap

  SelectObject

  CreateCompatibleDC

  GetStockObject

  GetPixel

  DeleteDC

  SetTextColor

  CreatePalette

  SetBkColor

  DeleteObject

  SetDCBrushColor

  SetDCPenColor

  PlayEnhMetaFile

  SetMapMode

  CreateDIBSection

  GetObjectA

  CombineRgn

  SetStretchBltMode

  SetDIBits

  SetWinMetaFileBits

  SetEnhMetaFileBits

  ExtTextOutA

  GetEnhMetaFilePaletteEntries

  GetEnhMetaFileHeader

  DeleteEnhMetaFile

  SelectPalette

  RealizePalette

  CreateBitmap

  Ellipse

  Polygon

  comdlg32

  GetSaveFileNameA

  ChooseFontA

  CommDlgExtendedError

  GetOpenFileNameA

  ChooseColorA

  shell32

  SHFileOperationA

  FindExecutableA

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetPathFromIDListA

  SHGetMalloc

  SHCreateItemFromIDList

  ShellExecuteA

  Shell_NotifyIconA

  wsock32

  htons

  WSAGetLastError

  WSAStartup

  gethostbyname

  WSASetLastError

  socket

  shutdown

  closesocket

  connect

  inet_ntoa

  recv

  select

  send

  shlwapi

  ord176

  comctl32

  ImageList_Create

  ImageList_Destroy

  ImageList_ReplaceIcon

  _TrackMouseEvent

  InitCommonControlsEx

  version

  VerQueryValueA

  GetFileVersionInfoA

  msimg32

  GradientFill

  advapi32

  ReportEventA

  RegisterEventSourceA

  CryptVerifySignatureA

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptImportKey

  CryptReleaseContext

  OpenProcessToken

  GetTokenInformation

  ImpersonateLoggedOnUser

  GetUserNameA

  RegCloseKey

  RegOpenKeyExA

  RegQueryValueExA

  CryptAcquireContextA

  DeregisterEventSource

  ole32

  CoTaskMemFree

  CoInitialize

  OleInitialize

  CoCreateInstance

  OleUninitialize

  CoUninitialize

  oleaut32

  SysAllocString

  VariantClear

  SysFreeString

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 499KB - Virtual size: 498KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 962KB - Virtual size: 3.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 5.7MB - Virtual size: 5.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 66KB - Virtual size: 66KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/bf37d4e2861b9f32f706d231974955bdf502c18967c4529a03246d74b093adda.exe

  .dll windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  Exports

  Exports

  debug

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 352B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c03e75f03830d39653afd24f710c9d2d3c44e24c33b61d2cb6e6e88c9d386457.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 456KB - Virtual size: 455KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c0a51e0ac8d1b7d7ec629c4d6a026b5ed42960d7f15c17950cf09975cc43554d.exe

  .exe windows:6 windows x86 arch:x86

  1aae8bf580c846f39c71c05898e57e88

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 9.2MB - Virtual size: 9.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10.2MB - Virtual size: 10.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8.1MB - Virtual size: 8.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 534KB - Virtual size: 534KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 173KB - Virtual size: 173KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c0ab699ce37ff46eeb49f0a5d9dd1ca392580d959dd6ad8fda06418fb0c39c6f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 669KB - Virtual size: 669KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c0d09076406f4edef6935588c6c34301724f4a78b786d9a4a11d1c511687f5b2.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1.2MB - Virtual size: 1.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c0f03d69387b608ce43f01a658326b68eca298daab5aa964e9455fcb1c776dd7.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  96:1f:c3:60:7a:a1:51:03:a2:1c:df:48:0c:d8:0e:91:87:9f:9e:b6:79:2c:06:57:b1:02:62:87:93:2b:2f:f2

  Signer

  Actual PE Digest

  96:1f:c3:60:7a:a1:51:03:a2:1c:df:48:0c:d8:0e:91:87:9f:9e:b6:79:2c:06:57:b1:02:62:87:93:2b:2f:f2

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  45:36:5d:6a:d1:c5:53:b3:77:0a:f6:32:df:b6:0c:68:7e:f3:ac:8c

  Signer

  Actual PE Digest

  45:36:5d:6a:d1:c5:53:b3:77:0a:f6:32:df:b6:0c:68:7e:f3:ac:8c

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  IOPH.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 741KB - Virtual size: 741KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c1d2816e557482077a88b8e23581cd82a92dfca70fd1e7ceaec4ba3adbd7d136.exe

  .exe windows:5 windows x86 arch:x86

  2eabe9054cad5152567f0699947a2c5b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrcpy

  Sections

  Size: 79KB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  Size: 512B - Virtual size: 2.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  eyjeines

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  tarfalmq

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .taggant

  Size: 8KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/c201296887964e07884ce78a9e66132f6301f149aa23bce2cb28ec47befbe330.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 567KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 184KB - Virtual size: 184KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 448KB - Virtual size: 448KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c21ed8a57209535e93c20b23772cfcfd3b07fcebeb2de7707c66f774f13a00b8.exe

  .exe windows:5 windows x86 arch:x86

  c7862ae7f165329289aaf0e09403b299

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  IsProcessorFeaturePresent

  GetModuleHandleW

  GetCurrentProcess

  TerminateProcess

  GetLastError

  GetModuleFileNameW

  InterlockedPushEntrySList

  InterlockedFlushSList

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  RtlUnwind

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  CreateFileW

  GetDriveTypeW

  GetFileType

  CloseHandle

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ExitProcess

  GetModuleHandleExW

  GetStdHandle

  WriteFile

  GetModuleFileNameA

  MultiByteToWideChar

  WideCharToMultiByte

  GetACP

  HeapFree

  HeapAlloc

  GetModuleHandleA

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  GetCurrentThread

  SetCurrentDirectoryW

  GetCurrentDirectoryW

  GetFullPathNameW

  GetFullPathNameA

  SetStdHandle

  GetStringTypeW

  GetConsoleCP

  GetConsoleMode

  OutputDebugStringA

  OutputDebugStringW

  WaitForSingleObjectEx

  CreateThread

  FindClose

  FindFirstFileExA

  FindFirstFileExW

  FindNextFileA

  FindNextFileW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetEnvironmentVariableW

  GetProcessHeap

  SetConsoleCtrlHandler

  GetTimeZoneInformation

  SetFilePointerEx

  WriteConsoleW

  FlushFileBuffers

  HeapSize

  SetEndOfFile

  ReadFile

  ReadConsoleW

  EncodePointer

  DecodePointer

  RaiseException

  HeapReAlloc

  GetProcAddress

  advapi32

  SystemFunction036

  Sections

  .text

  Size: 456KB - Virtual size: 455KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 35KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 41KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/c332768ce173eb51822174cc17ed0f7ded5ec34a32377c4b3de6cb0854e687fb.exe

  .exe windows:6 windows x86 arch:x86

  a75bc875b96c6e9da06956205bb926df

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\WarZ2\src\RSUpdate\Release\RSUpdate.pdb

  Imports

  d3dx9_43

  D3DXCreateTextureFromFileInMemoryEx

  D3DXCreateCubeTextureFromFileInMemoryEx

  D3DXCreateFontA

  D3DXSaveSurfaceToFileA

  D3DXGetImageInfoFromFileInMemory

  D3DXCreateVolumeTextureFromFileInMemoryEx

  D3DXCreateTextureFromFileInMemory

  d3d9

  Direct3DCreate9

  kernel32

  GetExitCodeProcess

  UpdateProcThreadAttribute

  CreateProcessW

  SetEnvironmentVariableA

  OutputDebugStringW

  WriteConsoleW

  LCMapStringW

  CompareStringW

  HeapReAlloc

  SystemTimeToTzSpecificLocalTime

  GetDriveTypeW

  FindFirstFileExW

  FlushFileBuffers

  SetStdHandle

  ReadConsoleW

  SetFilePointerEx

  GetStringTypeW

  GetTimeZoneInformation

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetConsoleMode

  GetConsoleCP

  GetCPInfo

  IsValidCodePage

  GetModuleHandleW

  TlsFree

  FreeLibrary

  DeleteCriticalSection

  CreateFileW

  GetFileSize

  WriteFile

  ReadFile

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetFileTime

  FormatMessageA

  UnhandledExceptionFilter

  SetLastError

  GetStartupInfoW

  GetStdHandle

  GetComputerNameA

  GetOEMCP

  GetFileAttributesExW

  HeapSize

  AreFileApisANSI

  ExitProcess

  PeekNamedPipe

  GetFileType

  GetFileInformationByHandle

  FileTimeToLocalFileTime

  GlobalMemoryStatusEx

  LoadLibraryA

  GetProcAddress

  GetVersionExA

  MultiByteToWideChar

  GetModuleFileNameA

  CopyFileA

  WaitForSingleObject

  TerminateThread

  GetACP

  GetTickCount

  GetLocalTime

  GetSystemTime

  SystemTimeToFileTime

  FileTimeToSystemTime

  CreateThread

  GetCurrentThreadId

  CreateFileA

  GetFileAttributesA

  SetFileAttributesA

  CreateDirectoryA

  FindClose

  SetFileAttributesW

  CreateDirectoryW

  CloseHandle

  EnterCriticalSection

  LeaveCriticalSection

  GetProcessHeap

  RaiseException

  GetModuleHandleExW

  GetCommandLineA

  HeapFree

  HeapAlloc

  IsProcessorFeaturePresent

  LoadLibraryExW

  ExitThread

  GetSystemTimeAsFileTime

  DecodePointer

  EncodePointer

  VirtualAlloc

  Module32Next

  Module32First

  CreateToolhelp32Snapshot

  ResumeThread

  GetCurrentProcessId

  SetUnhandledExceptionFilter

  CreateFileMappingA

  UnmapViewOfFile

  MulDiv

  GetCurrentThread

  TryEnterCriticalSection

  lstrlenA

  GetFileAttributesW

  OpenFileMappingA

  InitializeProcThreadAttributeList

  VirtualProtect

  WTSGetActiveConsoleSessionId

  GlobalFree

  GetProcessTimes

  SetFilePointer

  DeleteFileW

  MoveFileW

  GetModuleFileNameW

  GetTempPathA

  GetTempPathW

  GetCurrentDirectoryW

  GetFullPathNameW

  LocalFree

  GetLastError

  InitializeCriticalSection

  SizeofResource

  LockResource

  LoadResource

  FindResourceA

  MoveFileA

  DeleteFileA

  SetConsoleTitleA

  AllocConsole

  Sleep

  GlobalAlloc

  GlobalUnlock

  GlobalLock

  DuplicateHandle

  GetCurrentProcess

  TerminateProcess

  GetCurrentDirectoryA

  GetFullPathNameA

  CreateEventA

  SetEvent

  OutputDebugStringA

  OpenEventA

  MapViewOfFile

  GetSystemInfo

  SetEndOfFile

  IsDebuggerPresent

  QueryPerformanceCounter

  QueryPerformanceFrequency

  InitializeCriticalSectionAndSpinCount

  WideCharToMultiByte

  GetModuleHandleA

  user32

  ShowCursor

  InvalidateRect

  EndPaint

  PostQuitMessage

  PeekMessageW

  GetMessageW

  ClientToScreen

  GetClientRect

  SetWindowPos

  BeginPaint

  UpdateWindow

  GetActiveWindow

  ChangeClipboardChain

  SetClipboardViewer

  CreateWindowExA

  SendMessageA

  SetFocus

  MessageBoxA

  LoadIconA

  LoadCursorA

  LoadStringW

  SetRect

  AdjustWindowRect

  GetWindowLongA

  SwitchToThisWindow

  GetAsyncKeyState

  CloseClipboard

  GetClipboardData

  OpenClipboard

  GetKeyState

  GetFocus

  GetCaretBlinkTime

  DispatchMessageA

  TranslateMessage

  GetMessageA

  PeekMessageA

  ShowWindow

  SetWindowTextA

  SetWindowLongA

  DefWindowProcA

  SetCapture

  GetWindowRect

  GetCursorPos

  ReleaseCapture

  ClipCursor

  RegisterClassA

  gdi32

  CreateICA

  DeleteDC

  GetDeviceCaps

  GetStockObject

  CreateCompatibleDC

  CreateFontA

  CreatePen

  DeleteObject

  GetTextExtentPoint32A

  LineTo

  SelectObject

  SetBkColor

  SetMapMode

  SetTextColor

  SetTextAlign

  CreateDIBSection

  MoveToEx

  ExtTextOutA

  advapi32

  RegCloseKey

  GetUserNameA

  CryptAcquireContextA

  CryptReleaseContext

  CryptGenRandom

  CryptExportKey

  CryptDestroyKey

  CloseServiceHandle

  OpenServiceA

  OpenSCManagerA

  RegOpenKeyExA

  RegQueryValueExA

  RegCreateKeyExA

  RegSetValueExA

  CryptAcquireContextW

  CryptGetProvParam

  CryptEnumProvidersA

  QueryServiceStatusEx

  CryptGetUserKey

  shell32

  SHGetFolderPathA

  ShellExecuteExA

  ShellExecuteA

  ole32

  CoInitializeEx

  CoUninitialize

  CoSetProxyBlanket

  CoInitialize

  CoCreateInstance

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  SysStringLen

  iphlpapi

  GetAdaptersInfo

  GetIpNetTable

  SendARP

  GetNetworkParams

  ntdll

  RtlImageNtHeader

  RtlUnwind

  dbghelp

  MakeSureDirectoryPathExists

  MiniDumpWriteDump

  wtsapi32

  WTSSendMessageA

  ws2_32

  send

  sendto

  recvfrom

  recv

  getsockopt

  setsockopt

  ioctlsocket

  WSAGetLastError

  socket

  WSAStartup

  ntohs

  inet_ntoa

  getsockname

  gethostbyname

  inet_addr

  htons

  connect

  select

  __WSAFDIsSet

  bind

  closesocket

  shutdown

  dinput8

  DirectInput8Create

  crypt32

  CertEnumCertificatesInStore

  CertCreateCertificateContext

  CertGetCertificateContextProperty

  CryptDecodeObject

  CertSetCertificateContextProperty

  CertDuplicateCertificateContext

  CertNameToStrW

  CertFreeCertificateContext

  CryptEncryptMessage

  CertCloseStore

  CertGetSubjectCertificateFromStore

  CryptMsgControl

  CryptMsgGetParam

  CryptMsgClose

  CryptMsgUpdate

  CryptMsgOpenToDecode

  CryptDecryptMessage

  CryptEncodeObject

  CertOpenStore

  Sections

  .text

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 767KB - Virtual size: 766KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1.2MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4.1MB - Virtual size: 4.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 83KB - Virtual size: 83KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c40a4c1ac2b63630b79c3201dc82aebe63282bc636a5060371a366365b8f7594.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c40c36978fc01bcbd7eca78bb7b5689b7460bbe7ef122cc2a2cde6fc415d24e0.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 268KB - Virtual size: 267KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c44148c0f3c14aea282ec116e768f5d3c58a50672d9e4b3867198a34069bf2ae.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  04:c5:30:70:3a:21:0e:c1:d6:f8:3c:b4:fe:11:18:c5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  22-09-2022 00:00

  Not After

  19-10-2023 23:59

  Subject

  SERIALNUMBER=5567037485,CN=Spotify AB,O=Spotify AB,L=Stockholm,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  01:5c:d7:82:40:23:41:da:a0:b3:09:61:08:be:59:a0:d1:d7:fc:27:15:7d:4d:6c:17:a7:95:c8:60:30:46:d9

  Signer

  Actual PE Digest

  01:5c:d7:82:40:23:41:da:a0:b3:09:61:08:be:59:a0:d1:d7:fc:27:15:7d:4d:6c:17:a7:95:c8:60:30:46:d9

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\m1e6o\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 310KB - Virtual size: 309KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c4fc1b9be30d564dfcb1e1af52a804b88779c991d379207c45b11056ed7b6023.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  86:4f:45:7c:b4:8e:96:cf:02:74:73:bc:db:d9:ae:46:66:2d:13:82:38:6a:f7:5e:22:00:38:53:36:59:59:08

  Signer

  Actual PE Digest

  86:4f:45:7c:b4:8e:96:cf:02:74:73:bc:db:d9:ae:46:66:2d:13:82:38:6a:f7:5e:22:00:38:53:36:59:59:08

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\zkzqiuedmt\obj\Re\ease\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c514c22ccbdf3b66a902f2d02b4515920656ac636ce2a4fc683961c25702c59e.exe

  .exe windows:5 windows x86 arch:x86

  08c523df338764c8f5fe9f2030103e8d

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetNumaNodeProcessorMask

  GetConsoleAliasesLengthW

  GetNumaProcessorNode

  WriteConsoleOutputW

  InterlockedDecrement

  QueryDosDeviceA

  GetUserDefaultLCID

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetCommandLineA

  GetSystemTimes

  GetPriorityClass

  GetEnvironmentStrings

  GlobalAlloc

  LoadLibraryW

  GetConsoleMode

  CopyFileW

  GetConsoleAliasExesLengthW

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetBinaryTypeA

  SetConsoleTitleA

  DisconnectNamedPipe

  GetShortPathNameA

  CreateDirectoryA

  GetComputerNameA

  GetStartupInfoA

  FillConsoleOutputCharacterW

  GetLastError

  GetProcAddress

  SetStdHandle

  EnterCriticalSection

  SearchPathA

  OpenWaitableTimerA

  LoadLibraryA

  SetCalendarInfoW

  WritePrivateProfileStringA

  FindAtomA

  FoldStringW

  GetModuleFileNameA

  GetDefaultCommConfigA

  ContinueDebugEvent

  FreeEnvironmentStringsW

  BuildCommDCBA

  GlobalReAlloc

  SetFileAttributesW

  CopyFileExA

  WriteConsoleW

  CloseHandle

  InterlockedExchange

  DebugActiveProcess

  EncodePointer

  DecodePointer

  MultiByteToWideChar

  ExitProcess

  GetCommandLineW

  HeapSetInformation

  GetStartupInfoW

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  HeapAlloc

  ReadFile

  LeaveCriticalSection

  SetHandleCount

  GetStdHandle

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  Sleep

  HeapSize

  GetCPInfo

  InterlockedIncrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  WriteFile

  GetModuleFileNameW

  GetEnvironmentStringsW

  HeapCreate

  QueryPerformanceCounter

  GetTickCount

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  SetFilePointer

  HeapFree

  RtlUnwind

  HeapReAlloc

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeW

  IsProcessorFeaturePresent

  GetConsoleCP

  FlushFileBuffers

  CreateFileW

  user32

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 97KB - Virtual size: 97KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 39.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 113KB - Virtual size: 112KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c63fd4f25b1d6ab7fc80895ffed1f495e11eb31cc50d909cb977330ca31ab579.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0b:50:cf:24:6b:26:3e:fd:85:a7:29:31:51:58:f3:ff

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-04-2024 00:00

  Not After

  10-04-2027 23:59

  Subject

  SERIALNUMBER=3582691,CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  33:2a:8e:cf:2a:fc:db:07:e1:53:7f:0d:f0:00:64:7e:6d:d3:61:77:f5:2e:bb:51:9b:09:19:d8:bd:a4:76:cf

  Signer

  Actual PE Digest

  33:2a:8e:cf:2a:fc:db:07:e1:53:7f:0d:f0:00:64:7e:6d:d3:61:77:f5:2e:bb:51:9b:09:19:d8:bd:a4:76:cf

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 67KB - Virtual size: 67KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c672d51e990bb60c512cf853beb8cda4a8913b6def201f4e35fb0d4aec2d1d9b.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 245KB - Virtual size: 244KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c7519512e0b882ab10bc5e0bcf8d0769bdd96c532443c700713c8ac570084acb.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 344KB - Virtual size: 344KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c8faaf17a8f8fb5ffbc1ba9f00e6fb755af3baaf17be5760461e80d5dccd8b62.exe

  .exe windows:10 windows x86 arch:x86

  9e41f63b8143bebfb96200b6d2b13400

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  imecfmui.pdb

  Imports

  advapi32

  EventWrite

  EventRegister

  EventUnregister

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegCloseKey

  RegOpenCurrentUser

  OpenProcessToken

  GetTokenInformation

  IsValidSid

  ConvertSidToStringSidW

  GetSidSubAuthority

  GetSidSubAuthorityCount

  RegOpenKeyExW

  kernel32

  DeleteFileW

  CloseHandle

  GetProcAddress

  CreateFileW

  GetTickCount

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  GetModuleHandleA

  TerminateProcess

  GetCurrentProcess

  GetTempPathW

  UnhandledExceptionFilter

  GetStartupInfoW

  Sleep

  GetModuleFileNameA

  ExpandEnvironmentStringsW

  FreeLibrary

  GetLastError

  LocalFree

  GetVersionExW

  FindResourceExW

  LoadResource

  FindFirstFileW

  FindNextFileW

  FindClose

  LoadLibraryExW

  GetModuleHandleExW

  SetUnhandledExceptionFilter

  GetModuleHandleW

  CompareStringW

  LockResource

  WriteFile

  gdi32

  GetDeviceCaps

  CreateFontIndirectW

  GetStockObject

  SelectObject

  GetTextExtentPoint32W

  GetObjectW

  user32

  DestroyWindow

  GetWindowLongW

  SetWindowLongW

  SendDlgItemMessageW

  GetDlgItem

  EnableWindow

  MessageBoxW

  SetDlgItemTextW

  PostMessageW

  GetDlgItemTextW

  SendMessageW

  LoadImageW

  GetWindowThreadProcessId

  GetSystemMetrics

  GetDC

  ReleaseDC

  GetKeyState

  InvalidateRect

  EndDialog

  GetCursor

  SetCursor

  LoadCursorW

  MapDialogRect

  GetClassInfoExW

  RegisterClassExW

  UnregisterClassW

  CreateWindowExW

  DefWindowProcW

  GetMessageW

  IsDialogMessageW

  TranslateMessage

  DispatchMessageW

  PostQuitMessage

  GetCursorPos

  SetForegroundWindow

  TrackPopupMenuEx

  GetSubMenu

  SetWindowTextW

  RegisterWindowMessageW

  SetProcessDPIAware

  UpdateWindow

  AllowSetForegroundWindow

  LoadMenuIndirectW

  DialogBoxIndirectParamW

  CreateDialogIndirectParamW

  DrawEdge

  DrawStateW

  GetWindowTextW

  SetWindowPos

  MapWindowPoints

  GetWindowRect

  GetClientRect

  EnumWindows

  GetClassNameW

  GetLastActivePopup

  DestroyIcon

  ShowWindow

  DestroyMenu

  msvcrt

  _except_handler4_common

  _controlfp

  ?terminate@@YAXXZ

  ??1type_info@@UAE@XZ

  _onexit

  __dllonexit

  _unlock

  _lock

  _wcmdln

  _initterm

  __setusermatherr

  __p__fmode

  _cexit

  _exit

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  _callnewh

  malloc

  ?what@exception@@UBEPBDXZ

  ??0exception@@QAE@ABV0@@Z

  ??0exception@@QAE@ABQBDH@Z

  ??0exception@@QAE@ABQBD@Z

  memcpy

  __CxxFrameHandler3

  _CxxThrowException

  wcschr

  _wcstoi64

  _wtoi

  wcsncpy_s

  _vsnwprintf_s

  _purecall

  wcsncat_s

  ??_V@YAXPAX@Z

  wcsnlen

  memmove

  ??3@YAXPAX@Z

  ??1exception@@UAE@XZ

  memset

  ole32

  CoInitialize

  CoCreateInstance

  shell32

  ShellExecuteW

  SHGetFolderPathW

  Shell_NotifyIconW

  oleaut32

  SysAllocString

  VariantClear

  SysFreeString

  wer

  WerReportCloseHandle

  WerReportAddFile

  WerReportSubmit

  WerReportSetParameter

  WerReportCreate

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 101KB - Virtual size: 101KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c98c470dc1db8a9caba66de0da76fd465685d25e830c30d40cdc422dc9d66bb2.exe

  .exe windows:6 windows x64 arch:x64

  087d53a7681c33cec7d02a6a207254b0

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  advapi32

  CryptReleaseContext

  CryptGenKey

  CryptSetKeyParam

  CheckTokenMembership

  FreeSid

  CryptDestroyHash

  CryptHashData

  CryptDeriveKey

  CryptCreateHash

  CryptExportKey

  AllocateAndInitializeSid

  CryptGenRandom

  CryptEncrypt

  CryptAcquireContextA

  CryptDestroyKey

  shell32

  ShellExecuteExA

  bcrypt

  BCryptCloseAlgorithmProvider

  BCryptGenRandom

  BCryptOpenAlgorithmProvider

  wininet

  InternetOpenA

  InternetCloseHandle

  HttpSendRequestA

  InternetConnectA

  HttpOpenRequestA

  kernel32

  GetModuleHandleW

  GetStartupInfoW

  IsDebuggerPresent

  InitializeSListHead

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  GetCurrentProcessId

  QueryPerformanceCounter

  IsProcessorFeaturePresent

  TerminateProcess

  GetCurrentProcess

  SetUnhandledExceptionFilter

  ReadFile

  GetModuleFileNameA

  FindFirstFileA

  WriteFile

  FindNextFileA

  ExpandEnvironmentStringsA

  FindClose

  CreateFileA

  DeleteFileA

  CloseHandle

  GetFileSize

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  vcruntime140

  strrchr

  __C_specific_handler

  memcpy

  __current_exception_context

  memset

  __current_exception

  api-ms-win-crt-runtime-l1-1-0

  exit

  _crt_atexit

  _register_onexit_function

  _set_app_type

  _configure_narrow_argv

  _initialize_narrow_environment

  _get_narrow_winmain_command_line

  _initterm

  _initterm_e

  _exit

  _cexit

  _c_exit

  _register_thread_local_exe_atexit_callback

  _initialize_onexit_table

  _seh_filter_exe

  terminate

  api-ms-win-crt-stdio-l1-1-0

  __stdio_common_vsprintf

  __stdio_common_vfprintf

  fclose

  fopen

  _set_fmode

  __p__commode

  api-ms-win-crt-string-l1-1-0

  _stricmp

  strncmp

  api-ms-win-crt-heap-l1-1-0

  malloc

  free

  _set_new_mode

  api-ms-win-crt-environment-l1-1-0

  getenv

  api-ms-win-crt-math-l1-1-0

  __setusermatherr

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 8KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 1024B - Virtual size: 600B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 240B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c98d20df81567c0b314ba81bb8deb937eb385eccc352fa61258c58800d53a3d6.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\Users\press\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772EXE\obj\Debug\cry.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.5MB - Virtual size: 1.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 126KB - Virtual size: 125KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/c98f17dd444209ad0a6d71221b67cd632bc6409686f750bb5118a7e42eca91e0.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  86:6d:c2:74:1b:39:b3:3a:5e:86:d0:8f:8f:00:f6:2c:5f:31:3a:ae:c3:60:45:37:7c:4f:c7:ab:81:59:27:c7

  Signer

  Actual PE Digest

  86:6d:c2:74:1b:39:b3:3a:5e:86:d0:8f:8f:00:f6:2c:5f:31:3a:ae:c3:60:45:37:7c:4f:c7:ab:81:59:27:c7

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\r20ran4eeqmg8t\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cafdcfc0ee408a001adca96acdfc8192ca25f26dba266e4c4d6c35cd6bc0df67.exe

  .exe windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 318KB - Virtual size: 318KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cb299d64a1dd6aba4df3ffad101b457631e1bed26d3c2641e24dbcbf997e8198.exe

  .exe windows:4 windows x86 arch:x86

  d4b94e8ee3f620a89d114b9da4b31873

  
  

  Code Sign

  68:01:9f:73:35:b6:76:85:f3:f9:5f:67:8f:56:af:0c:b0:2e:9f:71

  Certificate

  Issuer

  CN=Fysiologers Slvringen Wicca\ ,O=Sulfonamidet,L=Moorhead,ST=Mississippi,C=US

  Not Before

  24-03-2024 07:18

  Not After

  24-03-2027 07:18

  Subject

  CN=Fysiologers Slvringen Wicca\ ,O=Sulfonamidet,L=Moorhead,ST=Mississippi,C=US

  38:b8:60:cf:f3:eb:6e:19:01:ae:a7:ae:74:e4:f0:88:77:05:c5:c7:01:2e:1f:d4:0e:77:d0:a8:ca:4b:50:fe

  Signer

  Actual PE Digest

  38:b8:60:cf:f3:eb:6e:19:01:ae:a7:ae:74:e4:f0:88:77:05:c5:c7:01:2e:1f:d4:0e:77:d0:a8:ca:4b:50:fe

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetCurrentDirectoryW

  GetFileAttributesW

  GetFullPathNameW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  MoveFileW

  SetFileAttributesW

  GetCurrentProcess

  ExitProcess

  SetEnvironmentVariableW

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  GetVersion

  SetErrorMode

  lstrlenW

  lstrcpynW

  CopyFileW

  CompareFileTime

  GlobalLock

  CreateThread

  GetLastError

  CreateDirectoryW

  CreateProcessW

  RemoveDirectoryW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  WriteFile

  lstrcpyA

  lstrcpyW

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  LoadLibraryW

  GetProcAddress

  GetModuleHandleA

  ExpandEnvironmentStringsW

  GetShortPathNameW

  SearchPathW

  lstrcmpiW

  SetFileTime

  CloseHandle

  GlobalFree

  lstrcmpW

  GlobalAlloc

  WaitForSingleObject

  GlobalUnlock

  GetDiskFreeSpaceW

  GetExitCodeProcess

  FindFirstFileW

  FindNextFileW

  DeleteFileW

  SetFilePointer

  ReadFile

  FindClose

  MulDiv

  MultiByteToWideChar

  lstrlenA

  WideCharToMultiByte

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleW

  user32

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  EnableMenuItem

  SetWindowPos

  GetSysColor

  GetWindowLongW

  SetCursor

  LoadCursorW

  CheckDlgButton

  GetMessagePos

  LoadBitmapW

  CallWindowProcW

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  wsprintfW

  ScreenToClient

  GetWindowRect

  GetSystemMetrics

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharPrevW

  CharNextA

  wsprintfA

  DispatchMessageW

  PeekMessageW

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  CreateDialogParamW

  GetDC

  SetWindowTextW

  PostQuitMessage

  ShowWindow

  GetDlgItem

  IsWindow

  LoadImageW

  SetWindowLongW

  TrackPopupMenu

  AppendMenuW

  CreatePopupMenu

  EndPaint

  SetTimer

  FindWindowExW

  SendMessageTimeoutW

  SetForegroundWindow

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectW

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  advapi32

  RegDeleteKeyW

  SetFileSecurityW

  OpenProcessToken

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegOpenKeyExW

  RegEnumValueW

  RegDeleteValueW

  RegCloseKey

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumKeyW

  comctl32

  ImageList_Create

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  Sections

  .text

  Size: 24KB - Virtual size: 23KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 128KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 120KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 136KB - Virtual size: 135KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cb9c62c96c1409b6151ec4cdcda1b0750a13dd61352ca9ed91382a978cc8bba0.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 650KB - Virtual size: 649KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 12KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cc7ca4eb1a90642066ef9697165ceb0a12cb5b8498a198cbed5524cab5974e74.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 731KB - Virtual size: 730KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cd809723bc2b248ad6e546c36922e4a3f8b3d8bfdcf7d1448f1307ce7de27118.exe

  .exe windows:6 windows x64 arch:x64

  72c4e339b7af8ab1ed2eb3821c98713a

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

  Not Before

  29-09-2021 00:00

  Not After

  28-09-2024 23:59

  Subject

  SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

  Certificate

  Issuer

  CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  12-01-2016 00:00

  Not After

  11-01-2031 23:59

  Subject

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

  Certificate

  Issuer

  CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Not Before

  23-12-2017 00:00

  Not After

  22-03-2029 23:59

  Subject

  CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  e5:98:08:40:9a:31:b1:de:ef:c0:6a:01:c4:4a:83:89:16:e3:41:d4:f6:36:66:a9:d4:8f:ab:d1:f5:54:8d:18

  Signer

  Actual PE Digest

  e5:98:08:40:9a:31:b1:de:ef:c0:6a:01:c4:4a:83:89:16:e3:41:d4:f6:36:66:a9:d4:8f:ab:d1:f5:54:8d:18

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  user32

  CreateWindowExW

  ShutdownBlockReasonCreate

  MsgWaitForMultipleObjects

  ShowWindow

  DestroyWindow

  RegisterClassW

  DefWindowProcW

  PeekMessageW

  DispatchMessageW

  TranslateMessage

  PostMessageW

  GetMessageW

  MessageBoxW

  MessageBoxA

  SystemParametersInfoW

  DestroyIcon

  SetWindowLongPtrW

  GetWindowLongPtrW

  GetClientRect

  InvalidateRect

  ReleaseDC

  GetDC

  DrawTextW

  GetDialogBaseUnits

  EndDialog

  DialogBoxIndirectParamW

  MoveWindow

  SendMessageW

  comctl32

  ord380

  kernel32

  GetACP

  IsValidCodePage

  GetStringTypeW

  GetFileAttributesExW

  SetEnvironmentVariableW

  FlushFileBuffers

  GetCurrentDirectoryW

  LCMapStringW

  CompareStringW

  FlsFree

  GetOEMCP

  GetCPInfo

  GetModuleHandleW

  MulDiv

  FormatMessageW

  GetLastError

  GetModuleFileNameW

  LoadLibraryExW

  SetDllDirectoryW

  CreateSymbolicLinkW

  GetProcAddress

  GetEnvironmentStringsW

  GetCommandLineW

  GetEnvironmentVariableW

  ExpandEnvironmentStringsW

  DeleteFileW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetDriveTypeW

  RemoveDirectoryW

  GetTempPathW

  CloseHandle

  QueryPerformanceCounter

  QueryPerformanceFrequency

  WaitForSingleObject

  Sleep

  GetCurrentProcess

  TerminateProcess

  GetExitCodeProcess

  CreateProcessW

  GetStartupInfoW

  FreeLibrary

  LocalFree

  SetConsoleCtrlHandler

  K32EnumProcessModules

  K32GetModuleFileNameExW

  CreateFileW

  FindFirstFileExW

  GetFinalPathNameByHandleW

  MultiByteToWideChar

  WideCharToMultiByte

  FlsSetValue

  FreeEnvironmentStringsW

  GetProcessHeap

  GetTimeZoneInformation

  HeapSize

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  CreateDirectoryW

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  RtlUnwindEx

  SetLastError

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  RaiseException

  RtlPcToFileHeader

  GetCommandLineA

  GetFileInformationByHandle

  GetFileType

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  ReadFile

  GetFullPathNameW

  SetStdHandle

  GetStdHandle

  WriteFile

  ExitProcess

  GetModuleHandleExW

  HeapFree

  GetConsoleMode

  ReadConsoleW

  SetFilePointerEx

  GetConsoleOutputCP

  GetFileSizeEx

  HeapAlloc

  FlsAlloc

  FlsGetValue

  advapi32

  OpenProcessToken

  GetTokenInformation

  ConvertStringSecurityDescriptorToSecurityDescriptorW

  ConvertSidToStringSidW

  gdi32

  SelectObject

  DeleteObject

  CreateFontIndirectW

  Sections

  .text

  Size: 168KB - Virtual size: 167KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 75KB - Virtual size: 74KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cdef916e83e2af8a4cf899526eb3032826feb8aad1824f8b9a1b7c52f3f84280.exe

  .exe windows:4 windows x86 arch:x86

  fc2ca0dd2bd0f0a143659652556a192d

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  msvcrt

  _iob

  advapi32

  FreeSid

  wsock32

  getsockopt

  ws2_32

  WSARecv

  Sections

  .MPRESS1

  Size: 39KB - Virtual size: 84KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .MPRESS2

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/ce083654b6506740c3a45c15e4fb24dcd05cd39e6509bdeeeedd330750a9511a.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 231KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cf266152ca5293aee22d1e6175811f8c909f9a8e283161a6fd130d4186c800f3.exe

  .exe windows:6 windows x86 arch:x86

  c1a56dd2884ebae2645c18b421ad3aee

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetThreadPriority

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateWaitableTimerA

  CreateThread

  CreateIoCompletionPort

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 9.9MB - Virtual size: 9.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10.5MB - Virtual size: 10.5MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 405KB - Virtual size: 614KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 549KB - Virtual size: 549KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/cff42a20c90a525f62cf6c71c7362a9b94765f00f25c29faa20f2a0d67090ba8.exe

  .exe windows:4 windows x86 arch:x86

  b34f154ec913d2d2c435cbd644e91687

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetEnvironmentVariableW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  GetVersion

  SetErrorMode

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  ExitProcess

  GetShortPathNameW

  CreateThread

  GetLastError

  CreateDirectoryW

  CreateProcessW

  RemoveDirectoryW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  WriteFile

  lstrcpyA

  MoveFileExW

  lstrcatW

  GetSystemDirectoryW

  GetProcAddress

  GetModuleHandleA

  GetExitCodeProcess

  WaitForSingleObject

  lstrcmpiW

  MoveFileW

  GetFullPathNameW

  SetFileTime

  SearchPathW

  CompareFileTime

  lstrcmpW

  CloseHandle

  ExpandEnvironmentStringsW

  GlobalFree

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  FindFirstFileW

  FindNextFileW

  DeleteFileW

  SetFilePointer

  ReadFile

  FindClose

  lstrlenA

  MulDiv

  MultiByteToWideChar

  WideCharToMultiByte

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  FreeLibrary

  LoadLibraryExW

  GetModuleHandleW

  user32

  GetSystemMenu

  SetClassLongW

  EnableMenuItem

  IsWindowEnabled

  SetWindowPos

  GetSysColor

  GetWindowLongW

  SetCursor

  LoadCursorW

  CheckDlgButton

  GetMessagePos

  LoadBitmapW

  CallWindowProcW

  IsWindowVisible

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  ScreenToClient

  GetWindowRect

  GetDlgItem

  GetSystemMetrics

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharPrevW

  CharNextA

  wsprintfA

  DispatchMessageW

  PeekMessageW

  ReleaseDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndDialog

  RegisterClassW

  SystemParametersInfoW

  CreateWindowExW

  GetClassInfoW

  DialogBoxParamW

  CharNextW

  ExitWindowsEx

  DestroyWindow

  GetDC

  SetTimer

  SetWindowTextW

  LoadImageW

  SetForegroundWindow

  ShowWindow

  IsWindow

  SetWindowLongW

  FindWindowExW

  TrackPopupMenu

  AppendMenuW

  CreatePopupMenu

  EndPaint

  CreateDialogParamW

  SendMessageTimeoutW

  wsprintfW

  PostQuitMessage

  gdi32

  SelectObject

  SetBkMode

  CreateFontIndirectW

  SetTextColor

  DeleteObject

  GetDeviceCaps

  CreateBrushIndirect

  SetBkColor

  shell32

  SHGetSpecialFolderLocation

  ShellExecuteExW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHGetFileInfoW

  SHFileOperationW

  advapi32

  AdjustTokenPrivileges

  RegCreateKeyExW

  RegOpenKeyExW

  SetFileSecurityW

  OpenProcessToken

  LookupPrivilegeValueW

  RegEnumValueW

  RegDeleteKeyW

  RegDeleteValueW

  RegCloseKey

  RegSetValueExW

  RegQueryValueExW

  RegEnumKeyW

  comctl32

  ImageList_Create

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ole32

  OleUninitialize

  OleInitialize

  CoTaskMemFree

  CoCreateInstance

  Sections

  .text

  Size: 25KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 1KB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 204KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d01820a86e663083337bae2976557b2f43d5e582b91c7f3a44d41421589bd801.exe

  .exe windows:4 windows x64 arch:x64

  3f071605b6b25d4e24602be1c4df49b5

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:61:7a:7c:42:23:07:5b:71:ed:d2:b5:83:20:ee:b7

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-04-2024 00:00

  Not After

  03-05-2027 23:59

  Subject

  SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:61:7a:7c:42:23:07:5b:71:ed:d2:b5:83:20:ee:b7

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  08-04-2024 00:00

  Not After

  03-05-2027 23:59

  Subject

  SERIALNUMBER=5128862,CN=Discord Inc.,OU=Select or enter,O=Discord Inc.,L=San Francisco,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  bb:33:e1:78:83:fe:8e:5e:78:ed:a8:07:5f:19:56:d0:5d:38:58:d7:bc:4d:7d:e8:de:13:2c:c0:64:bb:9b:c4

  Signer

  Actual PE Digest

  bb:33:e1:78:83:fe:8e:5e:78:ed:a8:07:5f:19:56:d0:5d:38:58:d7:bc:4d:7d:e8:de:13:2c:c0:64:bb:9b:c4

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  73:30:ec:cc:92:b8:21:32:20:bd:ce:1d:42:44:aa:12:65:cb:45:60

  Signer

  Actual PE Digest

  73:30:ec:cc:92:b8:21:32:20:bd:ce:1d:42:44:aa:12:65:cb:45:60

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DEBUG_STRIPPED

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetLastError

  GetModuleHandleA

  GetProcAddress

  GetStartupInfoA

  GetSystemTimeAsFileTime

  GetTickCount

  InitializeCriticalSection

  LeaveCriticalSection

  QueryPerformanceCounter

  RtlAddFunctionTable

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  SetUnhandledExceptionFilter

  Sleep

  TerminateProcess

  TlsGetValue

  UnhandledExceptionFilter

  VirtualProtect

  VirtualQuery

  msvcrt

  __C_specific_handler

  __getmainargs

  __initenv

  __iob_func

  __lconv_init

  __set_app_type

  __setusermatherr

  _acmdln

  _amsg_exit

  _cexit

  _fmode

  _initterm

  _onexit

  abort

  calloc

  exit

  fprintf

  free

  fwrite

  malloc

  memcmp

  memcpy

  rand

  signal

  strlen

  strncmp

  vfprintf

  wcslen

  rpcrt4

  UuidFromStringA

  Sections

  .text

  Size: 13KB - Virtual size: 13KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 151KB - Virtual size: 151KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 736KB - Virtual size: 736KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .pdata

  Size: 1024B - Virtual size: 828B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 1024B - Virtual size: 672B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 11KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 104B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 16B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/d023e36b94854155912beea0b7120983c0584c476404d3cef87f5dfcd4899439.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 235KB - Virtual size: 235KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d0b6908336ed7ec21717798aa2c451170bddc97c33e263ee356fec4bf3eee1bd.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 236KB - Virtual size: 236KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d0f2b9c05f739d86e1b664ff41c9e2bf2333b6c5d17253ee90f77c5f2d61052c.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 481KB - Virtual size: 480KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d28abef1785c790448448e450d61c686d8778602f789830e41a92694b4439c19.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 346KB - Virtual size: 346KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 596KB - Virtual size: 600KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/d3462fb39783612b68a1188e82055324223f51b1d11d65fee3e5181f8d05acda.exe

  .exe windows:5 windows x86 arch:x86

  21634e8b08d82f0c85fdef261dcc3085

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  recv

  send

  setsockopt

  ntohs

  recvfrom

  select

  WSAStartup

  htons

  accept

  listen

  bind

  closesocket

  connect

  WSACleanup

  ioctlsocket

  sendto

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  socket

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_Create

  InitCommonControlsEx

  ImageList_ReplaceIcon

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetConnectW

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  UnloadUserProfile

  DestroyEnvironmentBlock

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  CloseHandle

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  DeleteCriticalSection

  CreateThread

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  GetLastError

  GetModuleFileNameW

  GetFullPathNameW

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  RaiseException

  InitializeCriticalSectionAndSpinCount

  InterlockedDecrement

  InterlockedIncrement

  DuplicateHandle

  GetCurrentProcess

  EnterCriticalSection

  GetCurrentThread

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  HeapSize

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  SetFilePointer

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  HeapReAlloc

  WriteConsoleW

  SetEndOfFile

  FindNextFileW

  SetEnvironmentVariableA

  user32

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  DrawMenuBar

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  MonitorFromRect

  LoadImageW

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  AdjustWindowRectEx

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  UnregisterHotKey

  SystemParametersInfoW

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  GetCursorPos

  PeekMessageW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  FindWindowW

  CharLowerBuffW

  GetWindowTextW

  gdi32

  SetPixel

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  GetDeviceCaps

  CloseFigure

  LineTo

  AngleArc

  CreateCompatibleBitmap

  CreateCompatibleDC

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  SelectObject

  StretchBlt

  GetDIBits

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  EndPath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAclInformation

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  InitiateSystemShutdownExW

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  SetSecurityDescriptorDacl

  AddAce

  GetAce

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHGetFolderPathW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  UnRegisterTypeLi

  SafeArrayCreateVector

  SysAllocString

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  OleLoadPicture

  QueryPathOfRegTypeLi

  VariantCopy

  VariantClear

  CreateDispTypeInfo

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SafeArrayAllocDescriptorEx

  VariantInit

  Sections

  .text

  Size: 560KB - Virtual size: 559KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 178KB - Virtual size: 177KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 24KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 865KB - Virtual size: 865KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d365065eb8f74487a0107fc60ffd8e2601331eb6c711d506551f605948561f00.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\6xq3sdhr4lblz7\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 306KB - Virtual size: 306KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d3bc73068c5c6a27f65ed15c6947a22afbe2acf555d43f87eae3e989c266c8c6.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 231KB - Virtual size: 230KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 905KB - Virtual size: 905KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d401c3671807726e777b0a0814c4e4f55cf41684746813cad3a7ebbd1d3d7d71.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  0b:60:9e:3a:2a:b3:6f:15:24:4c:51:df:db:e1:a0:9e:b6:77:b9:5d:fd:b7:3f:67:90:b9:2e:2b:2a:38:3d:cd

  Signer

  Actual PE Digest

  0b:60:9e:3a:2a:b3:6f:15:24:4c:51:df:db:e1:a0:9e:b6:77:b9:5d:fd:b7:3f:67:90:b9:2e:2b:2a:38:3d:cd

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\zojhji0ok2xt\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d45384c86bcee5d875a2fbe48be240636478bf3c8d730526816d2e30d04a5c61.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 836KB - Virtual size: 835KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d50faa86234469eb85697aee14b7b16b55caca5c0d1229fc0c5904410ddbf1db.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  jfrO.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 637KB - Virtual size: 637KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d70176af4397fd3ce6b70a18a3b48ab445a7fa165cf0f758c5d02faa6387ea53.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  b7:11:4c:b6:5c:cb:f8:a7:f0:11:36:c6:74:e6:c4:cb:a5:8e:e1:7e:ce:84:b0:53:26:cc:3d:9d:8a:ca:13:f8

  Signer

  Actual PE Digest

  b7:11:4c:b6:5c:cb:f8:a7:f0:11:36:c6:74:e6:c4:cb:a5:8e:e1:7e:ce:84:b0:53:26:cc:3d:9d:8a:ca:13:f8

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\77o1r2puz90g\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d74fd991dba840e0349e4fa489dab2fae37746a1f8d66943bab0efe80bc58c6f.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 114KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d7bd55656b87ba9a07672b8c83585647ed1891df4cd33c3846f36465d4b1b708.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 344KB - Virtual size: 343KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d84778c4ba83c52a6dc1aa034cd2638e89703e7cda002789ef03d63516ea37b4.exe

  .exe windows:5 windows x86 arch:x86

  ae6007afc702f11895b68e585cfb495e

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  GetComputerNameA

  SearchPathW

  SetPriorityClass

  CopyFileExW

  GetNumaProcessorNode

  GetConsoleAliasExesLengthA

  InterlockedIncrement

  OpenJobObjectA

  QueryDosDeviceA

  GetComputerNameW

  CallNamedPipeW

  FreeEnvironmentStringsA

  GetModuleHandleW

  GetTickCount

  GetConsoleAliasesA

  GetConsoleAliasesLengthA

  GetUserDefaultLangID

  GetEnvironmentStrings

  LoadLibraryW

  GetConsoleMode

  Sleep

  CopyFileW

  WriteConsoleOutputA

  HeapDestroy

  GetFileAttributesA

  GlobalFlags

  GetModuleFileNameW

  GetBinaryTypeW

  GetStartupInfoW

  GetCommandLineW

  WritePrivateProfileStringW

  DisconnectNamedPipe

  CreateDirectoryA

  InterlockedExchange

  FillConsoleOutputCharacterW

  GetLastError

  GetProcAddress

  SetStdHandle

  EnterCriticalSection

  SearchPathA

  BuildCommDCBW

  OpenWaitableTimerW

  LocalAlloc

  FindAtomA

  FoldStringW

  GetDefaultCommConfigA

  SetConsoleTitleW

  GetModuleHandleA

  GetShortPathNameW

  SetCalendarInfoA

  GlobalReAlloc

  SetFileAttributesW

  GetVolumeInformationW

  CreateFileW

  SetFilePointer

  CloseHandle

  DebugActiveProcess

  HeapAlloc

  EncodePointer

  DecodePointer

  MultiByteToWideChar

  HeapSetInformation

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  ExitProcess

  WriteFile

  GetStdHandle

  HeapCreate

  HeapSize

  GetCPInfo

  InterlockedDecrement

  GetACP

  GetOEMCP

  IsValidCodePage

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  SetLastError

  GetCurrentThreadId

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  SetHandleCount

  InitializeCriticalSectionAndSpinCount

  GetFileType

  DeleteCriticalSection

  QueryPerformanceCounter

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  LeaveCriticalSection

  HeapReAlloc

  RtlUnwind

  WideCharToMultiByte

  LCMapStringW

  GetStringTypeW

  HeapFree

  IsProcessorFeaturePresent

  GetConsoleCP

  FlushFileBuffers

  WriteConsoleW

  user32

  SetFocus

  GetUserObjectInformationA

  advapi32

  RegCreateKeyA

  Sections

  .text

  Size: 129KB - Virtual size: 129KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 35.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 117KB - Virtual size: 117KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d86d9fd481529dc46e8718fc48b1cd58ffeaf5b8011205311d6126a442007207.exe

  .exe windows:5 windows x86 arch:x86

  eb97e4fc5518ac300a92a11673825e0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  WSACleanup

  socket

  inet_ntoa

  setsockopt

  ntohs

  recvfrom

  ioctlsocket

  htons

  WSAStartup

  __WSAFDIsSet

  select

  accept

  listen

  bind

  closesocket

  WSAGetLastError

  recv

  sendto

  send

  inet_addr

  gethostbyname

  gethostname

  connect

  version

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerQueryValueW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetUseConnectionW

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  wininet

  InternetQueryDataAvailable

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetConnectW

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpCreateFile

  IcmpCloseHandle

  IcmpSendEcho

  userenv

  DestroyEnvironmentBlock

  UnloadUserProfile

  CreateEnvironmentBlock

  LoadUserProfileW

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  SetCurrentDirectoryW

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  FindNextFileW

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  EnumResourceNamesW

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  GetLocalTime

  CompareStringW

  GetCurrentProcess

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  IsDebuggerPresent

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  GetCurrentThread

  CloseHandle

  GetFullPathNameW

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  GetSystemTimeAsFileTime

  ResumeThread

  GetCommandLineW

  IsProcessorFeaturePresent

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStartupInfoW

  GetStringTypeW

  SetStdHandle

  GetFileType

  GetConsoleCP

  GetConsoleMode

  RtlUnwind

  ReadConsoleW

  GetTimeZoneInformation

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  WriteConsoleW

  FindClose

  SetEnvironmentVariableA

  user32

  AdjustWindowRectEx

  CopyImage

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  SetRect

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  MonitorFromRect

  keybd_event

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  TranslateMessage

  PeekMessageW

  UnregisterHotKey

  CheckMenuRadioItem

  CharLowerBuffW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  SystemParametersInfoW

  LoadImageW

  GetClassNameW

  gdi32

  StrokePath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  GetDeviceCaps

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  DeleteDC

  GetPixel

  CreateDCW

  GetStockObject

  GetTextFaceW

  CreateFontW

  SetTextColor

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  StrokeAndFillPath

  comdlg32

  GetOpenFileNameW

  GetSaveFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  RegCreateKeyExW

  FreeSid

  GetTokenInformation

  GetSecurityDescriptorDacl

  GetAclInformation

  AddAce

  SetSecurityDescriptorDacl

  GetUserNameW

  InitiateSystemShutdownExW

  shell32

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoSetProxyBlanket

  CoCreateInstanceEx

  CoInitializeSecurity

  oleaut32

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  SafeArrayDestroyDescriptor

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  RegisterTypeLi

  CreateStdDispatch

  DispCallFunc

  VariantChangeType

  SysStringLen

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  VariantCopy

  VariantClear

  OleLoadPicture

  QueryPathOfRegTypeLi

  RegisterTypeLibForUser

  UnRegisterTypeLibForUser

  UnRegisterTypeLi

  CreateDispTypeInfo

  SysAllocString

  VariantInit

  Sections

  .text

  Size: 568KB - Virtual size: 567KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 191KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 20KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 337KB - Virtual size: 337KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d887165cad0ebe6643bf506c6833dec26641d984cc96ac0c17c1ab35324446c0.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 38KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 242KB - Virtual size: 242KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 907KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d93fbc1550c46af5b5828fa362e36f7ffe36421ac1bb336533e29559f28cfe74.exe

  .exe windows:6 windows x86 arch:x86

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 6.3MB - Virtual size: 6.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 13.0MB - Virtual size: 13.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 475KB - Virtual size: 773KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 563KB - Virtual size: 563KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d9bf8d5be73ce064b6df664d48b1e1bb5e5d4592050e9046f6ebf74602628f69.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/d9cea34db0d1dc016dd4007d8cd11416f095c41b0639f13af1eb6ad675651df2.exe

  .exe windows:6 windows x64 arch:x64

  6897e09add1836442c84d70f65d04a85

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  GetConsoleScreenBufferInfo

  SetConsoleCursorInfo

  GetConsoleCursorInfo

  SetConsoleOutputCP

  SetConsoleCtrlHandler

  GetConsoleOutputCP

  GetUserDefaultLCID

  GetSystemDefaultLCID

  GetCurrencyFormatW

  SetLocaleInfoW

  GetCPInfoExW

  IsValidCodePage

  CompareStringW

  GetTimeFormatW

  GetDateFormatW

  GetNumaProcessorNode

  SetVolumeMountPointW

  FindFirstVolumeMountPointW

  CopyFileExW

  CopyFileW

  BackupSeek

  BackupRead

  lstrcatW

  lstrcmpW

  GetTapeParameters

  GetTapeStatus

  PrepareTape

  GetTapePosition

  SetTapePosition

  ConvertFiberToThread

  GetProcessIoCounters

  GetCurrentProcess

  SetProcessAffinityMask

  GetNumaHighestNodeNumber

  QueryInformationJobObject

  AssignProcessToJobObject

  GetLogicalProcessorInformation

  GetProcessPriorityBoost

  SetPriorityClass

  TlsSetValue

  TlsGetValue

  GetThreadPriorityBoost

  GetCurrentThreadId

  WriteConsoleW

  CloseHandle

  CreateFileW

  GetConsoleMode

  FlushFileBuffers

  HeapReAlloc

  HeapSize

  GetProcessHeap

  LCMapStringW

  FlsFree

  FlsSetValue

  FlsGetValue

  FlsAlloc

  SetFileApisToANSI

  AreFileApisANSI

  UnlockFileEx

  SetFilePointerEx

  SetEndOfFile

  QueryDosDeviceW

  LockFileEx

  GetLongPathNameW

  GetFileSizeEx

  GetModuleHandleA

  GetExitCodeProcess

  GetStringTypeW

  GetFileType

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  WideCharToMultiByte

  MultiByteToWideChar

  GetCommandLineW

  GetCommandLineA

  GetCPInfo

  GetOEMCP

  GetACP

  FindNextFileW

  FindFirstFileExW

  HeapFree

  HeapAlloc

  GetModuleHandleExW

  TerminateProcess

  ExitProcess

  GetModuleFileNameW

  WriteFile

  GetStdHandle

  RtlPcToFileHeader

  RaiseException

  EncodePointer

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  TlsFree

  TlsAlloc

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  LeaveCriticalSection

  EnterCriticalSection

  SetLastError

  GetLastError

  RtlUnwindEx

  GetModuleHandleW

  IsProcessorFeaturePresent

  GetStartupInfoW

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  IsDebuggerPresent

  GetFileInformationByHandle

  GetFileAttributesExW

  FindClose

  DefineDosDeviceW

  GetCurrentDirectoryW

  SetStdHandle

  GetCurrentProcessId

  RtlVirtualUnwind

  RtlLookupFunctionEntry

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlCaptureContext

  gdi32

  SetWindowOrgEx

  GetKerningPairsW

  SetBrushOrgEx

  GetWinMetaFileBits

  PolylineTo

  Polygon

  LPtoDP

  PolyTextOutW

  StrokeAndFillPath

  SetArcDirection

  AbortPath

  SetWinMetaFileBits

  GetEnhMetaFileBits

  GdiTransparentBlt

  SetTextColor

  SetSystemPaletteUse

  SetMetaFileBitsEx

  SetMapMode

  SetDIBitsToDevice

  SetBkMode

  SetDCPenColor

  SaveDC

  PtVisible

  PtInRegion

  OffsetClipRgn

  MaskBlt

  GetWindowExtEx

  GetViewportOrgEx

  RemoveFontResourceExW

  GetGlyphIndicesW

  GetTextExtentExPointW

  GetTextAlign

  GetSystemPaletteUse

  GetSystemPaletteEntries

  GetMetaFileBitsEx

  GetCurrentPositionEx

  GetCharWidth32W

  GetCharWidthW

  EnumFontFamiliesW

  DrawEscape

  CreateBrushIndirect

  CancelDC

  BitBlt

  Arc

  AnimatePalette

  winspool.drv

  ConnectToPrinterDlg

  EnumPrintersW

  ResetPrinterW

  SetJobW

  GetJobW

  EnumJobsW

  SetPrinterW

  FlushPrinter

  GetPrinterDataW

  EnumPrinterDataW

  SetPrinterDataW

  SetPrinterDataExW

  GetFormW

  ConfigurePortW

  SetPortW

  comdlg32

  PrintDlgExW

  PrintDlgW

  ChooseFontW

  ReplaceTextW

  FindTextW

  ChooseColorW

  GetFileTitleW

  GetSaveFileNameW

  GetOpenFileNameW

  CommDlgExtendedError

  ole32

  StringFromIID

  CLSIDFromString

  CoEnableCallCancellation

  CoTestCancel

  CoCancelCall

  CoQueryAuthenticationServices

  CoQueryClientBlanket

  CoSetProxyBlanket

  IIDFromString

  CoGetInterfaceAndReleaseStream

  CoMarshalInterThreadInterfaceInStream

  CoGetStdMarshalEx

  CoLockObjectExternal

  CoDisconnectObject

  CoMarshalHresult

  CoUnmarshalInterface

  CoMarshalInterface

  CoGetMarshalSizeMax

  CoGetPSClsid

  CoResumeClassObjects

  CoGetObjectContext

  CoGetContextToken

  CoGetCurrentLogicalThreadId

  CoGetCurrentProcess

  CoUninitialize

  ProgIDFromCLSID

  CLSIDFromProgID

  CoInvalidateRemoteMachineBindings

  CLSIDFromProgIDEx

  CoGetInstanceFromIStorage

  CoAllowSetForegroundWindow

  CoIsOle1Class

  CoFileTimeToDosDateTime

  CoInstall

  BindMoniker

  MkParseDisplayName

  MonikerRelativePathTo

  GetClassFile

  OleGetIconOfClass

  OleSetAutoConvert

  CoGetInterceptor

  CoGetCallContext

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  VerInstallFileW

  VerFindFileW

  comctl32

  ord412

  ord410

  ord14

  ord15

  ord13

  PropertySheetW

  dxgi

  CreateDXGIFactory

  Sections

  .text

  Size: 2.2MB - Virtual size: 2.2MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 45KB - Virtual size: 44KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 5KB - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/da7b9cbb790c88972e25daee98481da6707144c1d517987a52e1a76f93f3a7ee.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 222KB - Virtual size: 221KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 907KB - Virtual size: 906KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/daf4e8849a3b6011bff41cc2c7decee8c769a4ebf2be3d7316930f40448ddb25.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  90:10:68:e4:4b:e6:e4:b2:cd:4f:3a:73:e9:54:cf:a1:b5:8d:e7:7e:ea:e4:2d:a6:04:d3:c8:4e:e8:01:99:12

  Signer

  Actual PE Digest

  90:10:68:e4:4b:e6:e4:b2:cd:4f:3a:73:e9:54:cf:a1:b5:8d:e7:7e:ea:e4:2d:a6:04:d3:c8:4e:e8:01:99:12

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\oyfd7xouddasbv\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/db7308540dbe1895e72ec124ae574fca2b219afbf13924d1e52b06c1b535b9d6.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  LhSO.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 616KB - Virtual size: 616KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/dbf462d222344d6c78ed9548922560993b9d8bd2a9860b381476310319945d80.exe

  .exe windows:4 windows x86 arch:x86

  92a00f4d0a4448266e9c638fdb1341b9

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  DeleteCriticalSection

  EnterCriticalSection

  FreeLibrary

  GetLastError

  GetModuleHandleA

  GetModuleHandleW

  GetProcAddress

  GetStartupInfoA

  GetTempPathA

  InitializeCriticalSection

  IsDBCSLeadByteEx

  LeaveCriticalSection

  LoadLibraryA

  MultiByteToWideChar

  SetUnhandledExceptionFilter

  Sleep

  TlsGetValue

  VirtualProtect

  VirtualQuery

  WideCharToMultiByte

  lstrlenA

  msvcrt

  __getmainargs

  __initenv

  __lconv_init

  __mb_cur_max

  __p__acmdln

  __p__commode

  __p__fmode

  __set_app_type

  __setusermatherr

  _amsg_exit

  _assert

  _cexit

  _errno

  _chsize

  _filelengthi64

  _fileno

  _initterm

  _iob

  _lock

  _onexit

  _unlock

  abort

  atoi

  calloc

  exit

  fclose

  fflush

  fgetpos

  fopen

  fputc

  fread

  free

  freopen

  fsetpos

  fwrite

  getc

  islower

  isspace

  isupper

  isxdigit

  localeconv

  malloc

  memcmp

  memcpy

  memmove

  memset

  mktime

  localtime

  difftime

  _mkdir

  perror

  puts

  realloc

  remove

  setlocale

  signal

  strchr

  strcmp

  strcpy

  strerror

  strlen

  strncmp

  strncpy

  strtol

  strtoul

  tolower

  ungetc

  vfprintf

  time

  wcslen

  wcstombs

  _stat

  _utime

  _fileno

  _chmod

  shell32

  ShellExecuteA

  Exports

  Exports

  main

  Sections

  .text

  Size: 4.5MB - Virtual size: 4.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 39KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 234KB - Virtual size: 233KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .bss

  Size: - Virtual size: 6.4MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 66B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .idata

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .CRT

  Size: 512B - Virtual size: 52B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 8B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 904KB - Virtual size: 903KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /14

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /29

  Size: 106KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /41

  Size: 19KB - Virtual size: 19KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /55

  Size: 57KB - Virtual size: 56KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /67

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /80

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /91

  Size: 99KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /102

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/dc9010200032b754957faab28433a846b9aa1d7d52b20d1a12638d9f9f326790.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 473KB - Virtual size: 472KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/dcc51ea4252198d176b3249339675d2ea54759d1fb9aab487bc69f56f7ba2ac1.exe

  .exe windows:5 windows x86 arch:x86

  35d157e117474910ae4f485ec184a282

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  ws2_32

  gethostname

  recvfrom

  setsockopt

  closesocket

  htons

  shutdown

  WSAStartup

  connect

  WSAWaitForMultipleEvents

  listen

  WSASocketA

  WSACreateEvent

  WSAGetOverlappedResult

  WSAEventSelect

  WSAEnumNetworkEvents

  WSAGetLastError

  WSASend

  WSARecv

  WSACloseEvent

  accept

  getpeername

  getsockname

  inet_addr

  gethostbyname

  inet_ntoa

  socket

  bind

  sendto

  ioctlsocket

  recv

  send

  shlwapi

  StrStrIA

  StrCmpNW

  StrStrW

  PathFileExistsW

  StrChrA

  PathFindFileNameW

  StrCmpNIA

  PathMatchSpecW

  urlmon

  URLDownloadToFileW

  wininet

  HttpSendRequestA

  InternetReadFile

  HttpOpenRequestA

  DeleteUrlCacheEntry

  InternetCloseHandle

  InternetConnectA

  InternetOpenA

  InternetCrackUrlA

  HttpAddRequestHeadersA

  HttpQueryInfoA

  InternetOpenUrlA

  InternetOpenUrlW

  InternetOpenW

  ntdll

  strlen

  iswdigit

  iswalpha

  memcpy

  memset

  NtQueryVirtualMemory

  RtlUnwind

  _chkstk

  _aulldiv

  wcslen

  wcscmp

  _allshl

  _aullshr

  strstr

  strcmp

  memmove

  memcmp

  RtlTimeToSecondsSince1980

  NtQuerySystemTime

  mbstowcs

  msvcrt

  _vscprintf

  srand

  rand

  kernel32

  GetQueuedCompletionStatus

  PostQueuedCompletionStatus

  GetSystemInfo

  lstrcmpW

  SetEvent

  CreateProcessW

  GetLocaleInfoA

  DeleteCriticalSection

  GetCurrentThread

  GetThreadPriority

  SetThreadPriority

  GetCurrentProcess

  DuplicateHandle

  IsBadReadPtr

  InterlockedExchangeAdd

  InterlockedIncrement

  WaitForSingleObject

  InterlockedDecrement

  InterlockedExchange

  HeapFree

  HeapValidate

  HeapReAlloc

  GetProcessHeaps

  HeapCreate

  HeapSetInformation

  GetCurrentProcessId

  HeapAlloc

  CreateMutexA

  GetLastError

  ExitProcess

  ExpandEnvironmentStringsW

  CreateEventA

  CreateThread

  GetModuleFileNameW

  GetVolumeInformationW

  GetDiskFreeSpaceExW

  SetFileAttributesW

  DeleteFileW

  CopyFileW

  lstrcmpiW

  CreateDirectoryW

  FindFirstFileW

  CreateIoCompletionPort

  MoveFileExW

  FindNextFileW

  FindClose

  RemoveDirectoryW

  GetLogicalDrives

  GetDriveTypeW

  QueryDosDeviceW

  lstrcpyW

  WriteFile

  FlushFileBuffers

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSection

  CreateFileW

  CreateFileMappingW

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  lstrlenA

  lstrlenW

  lstrcpynW

  MultiByteToWideChar

  ExitThread

  GetTickCount

  Sleep

  GetModuleHandleW

  CloseHandle

  UnmapViewOfFile

  GetFileSize

  MapViewOfFile

  user32

  RegisterClassExW

  CreateWindowExW

  GetMessageA

  TranslateMessage

  wsprintfW

  DefWindowProcA

  ChangeClipboardChain

  RegisterRawInputDevices

  GetClipboardData

  DispatchMessageA

  EmptyClipboard

  SetClipboardData

  CloseClipboard

  IsClipboardFormatAvailable

  SendMessageA

  SetWindowLongW

  SetClipboardViewer

  GetWindowLongW

  wsprintfA

  wvsprintfA

  OpenClipboard

  advapi32

  CryptReleaseContext

  RegQueryValueExW

  RegOpenKeyExW

  RegOpenKeyExA

  RegCreateKeyExW

  CryptAcquireContextW

  CryptGenRandom

  RegCloseKey

  RegSetValueExW

  RegSetValueExA

  shell32

  ShellExecuteW

  ole32

  CoInitializeEx

  CoUninitialize

  CoInitialize

  CoCreateInstance

  oleaut32

  SysFreeString

  SysAllocString

  Sections

  .text

  Size: 59KB - Virtual size: 58KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/dd1080df3306422c7afbba710c59b6267b6d64b6a43071dc707ba48043f9f236.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  4c:aa:f9:ca:db:63:6f:e0:1f:f7:4e:d8:5b:03:86:9d

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  19-01-2010 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

  Certificate

  Issuer

  CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  09-05-2013 00:00

  Not After

  08-05-2028 23:59

  Subject

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7c:11:18:cb:ba:dc:95:da:37:52:c4:6e:47:a2:74:38

  Certificate

  Issuer

  CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  13-11-2018 00:00

  Not After

  08-11-2021 23:59

  Subject

  CN=Simon Tatham,O=Simon Tatham,L=Cambridge,ST=Cambridgeshire,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

  Certificate

  Issuer

  CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

  Not Before

  31-12-2015 00:00

  Not After

  09-07-2019 18:40

  Subject

  CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  73:95:72:85:a5:9c:91:dc:71:37:94:38:ee:d3:e0:c2:a3:c0:e8:76:5b:c7:90:8e:a3:59:75:44:61:a0:6f:4d

  Signer

  Actual PE Digest

  73:95:72:85:a5:9c:91:dc:71:37:94:38:ee:d3:e0:c2:a3:c0:e8:76:5b:c7:90:8e:a3:59:75:44:61:a0:6f:4d

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  43:4c:6c:ef:90:6b:a8:da:4a:55:89:72:01:5c:a1:c6:80:37:f5:c0

  Signer

  Actual PE Digest

  43:4c:6c:ef:90:6b:a8:da:4a:55:89:72:01:5c:a1:c6:80:37:f5:c0

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  lwsL.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 682KB - Virtual size: 681KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/dd52a6b3e9d1f368ed000d5a506331ce5b3f194512f9d075b494510ae1583a1f.exe

  .exe windows:10 windows x86 arch:x86

  9b443497c39099250d3c5c51cbfd6eda

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0f:03:c6:54:72:37:b6:e9:0b:9c:dc:8f:99:1c:36:b3

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  23-05-2022 00:00

  Not After

  12-04-2025 23:59

  Subject

  SERIALNUMBER=147288,CN=Stellar Information Technology Private Limited,O=Stellar Information Technology Private Limited,L=Gurugram,ST=Haryana,C=IN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302494e

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  b0:e8:b2:1d:26:7a:68:35:83:2c:01:e3:b5:76:01:97:70:61:69:2e:e8:8c:28:10:34:5a:76:b1:20:ff:93:16

  Signer

  Actual PE Digest

  b0:e8:b2:1d:26:7a:68:35:83:2c:01:e3:b5:76:01:97:70:61:69:2e:e8:8c:28:10:34:5a:76:b1:20:ff:93:16

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  notepad.pdb

  Imports

  gdi32

  SetMapMode

  SetViewportExtEx

  SetWindowExtEx

  LPtoDP

  SetBkMode

  GetTextMetricsW

  TextOutW

  AbortDoc

  EndDoc

  SetAbortProc

  StartDocW

  StartPage

  CreateDCW

  EnumFontsW

  GetTextFaceW

  GetDeviceCaps

  DeleteDC

  DeleteObject

  SetBkColor

  CreateSolidBrush

  GetTextExtentPoint32W

  SelectObject

  CreateCompatibleDC

  EndPage

  CreateFontIndirectW

  user32

  PostQuitMessage

  BeginPaint

  EndPaint

  FillRect

  DrawTextW

  DrawFocusRect

  DefWindowProcW

  TrackMouseEvent

  InvalidateRect

  DestroyIcon

  SetThreadDpiAwarenessContext

  DialogBoxParamW

  LoadIconW

  GetFocus

  MessageBoxW

  ShowWindow

  SetCursor

  SetActiveWindow

  EnableMenuItem

  IsIconic

  SetFocus

  MessageBeep

  GetForegroundWindow

  GetDlgCtrlID

  SetWindowPos

  RedrawWindow

  GetKeyboardLayout

  CharNextW

  SetWinEventHook

  GetMessageW

  TranslateAcceleratorW

  IsDialogMessageW

  TranslateMessage

  DispatchMessageW

  UnhookWinEvent

  SetWindowTextW

  GetMenu

  GetSubMenu

  OpenClipboard

  IsClipboardFormatAvailable

  CloseClipboard

  CheckMenuItem

  SetDlgItemTextW

  GetDlgItemTextW

  EndDialog

  SendDlgItemMessageW

  SetScrollPos

  UpdateWindow

  GetWindowPlacement

  SetWindowPlacement

  CharUpperW

  GetSystemMenu

  LoadAcceleratorsW

  SetWindowLongW

  MonitorFromWindow

  RegisterWindowMessageW

  LoadCursorW

  LoadImageW

  RegisterClassExW

  GetWindowLongW

  PeekMessageW

  GetWindowTextW

  EnableWindow

  CreateDialogParamW

  DrawTextExW

  IsWindow

  CreateDialogIndirectParamW

  GetPropW

  SetPropW

  GetDlgItem

  RemovePropW

  CheckDlgButton

  CheckRadioButton

  IsDlgButtonChecked

  NotifyWinEvent

  CreateWindowExW

  GetWindowTextLengthW

  GetClientRect

  DestroyWindow

  GetDpiForWindow

  SystemParametersInfoForDpi

  SendMessageW

  MoveWindow

  GetDC

  LoadStringW

  PostMessageW

  ReleaseDC

  api-ms-win-crt-string-l1-1-0

  wcsnlen

  memset

  api-ms-win-crt-runtime-l1-1-0

  _initterm_e

  _c_exit

  _register_thread_local_exe_atexit_callback

  _initterm

  api-ms-win-crt-private-l1-1-0

  _o__get_wide_winmain_command_line

  _o__initialize_onexit_table

  _o__initialize_wide_environment

  _o__invalid_parameter_noinfo

  _o__purecall

  _o__register_onexit_function

  _o__seh_filter_exe

  _o__set_app_type

  _o__set_fmode

  _o__set_new_mode

  _o__wcsicmp

  _o__wtol

  _o_exit

  _o_free

  _o_iswdigit

  _o_malloc

  _o_terminate

  __CxxFrameHandler3

  _except_handler4_common

  __current_exception

  __current_exception_context

  _CxxThrowException

  _o__errno

  _o__cexit

  _o___std_exception_destroy

  _o___std_exception_copy

  _o__callnewh

  _o__beginthreadex

  _o___p__commode

  _o__crt_atexit

  _o__controlfp_s

  _o__configure_wide_argv

  _o__configthreadlocale

  wcsrchr

  wcschr

  memcmp

  _o__exit

  memcpy

  _o___stdio_common_vswprintf

  memmove

  api-ms-win-core-libraryloader-l1-2-0

  LockResource

  GetModuleHandleExW

  FindResourceExW

  LoadResource

  GetModuleHandleA

  GetModuleFileNameA

  FreeLibrary

  GetProcAddress

  GetModuleHandleW

  GetModuleFileNameW

  api-ms-win-core-synch-l1-1-0

  LeaveCriticalSection

  InitializeCriticalSectionEx

  CreateSemaphoreExW

  ReleaseSemaphore

  ReleaseSRWLockExclusive

  ReleaseMutex

  SetEvent

  CreateEventExW

  AcquireSRWLockExclusive

  WaitForSingleObject

  EnterCriticalSection

  DeleteCriticalSection

  AcquireSRWLockShared

  CreateMutexExW

  WaitForSingleObjectEx

  ReleaseSRWLockShared

  OpenSemaphoreW

  api-ms-win-core-heap-l1-1-0

  GetProcessHeap

  HeapAlloc

  HeapSetInformation

  HeapFree

  api-ms-win-core-errorhandling-l1-1-0

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  RaiseException

  GetLastError

  SetLastError

  api-ms-win-core-threadpool-l1-2-0

  SetThreadpoolTimer

  WaitForThreadpoolTimerCallbacks

  CreateThreadpoolTimer

  CloseThreadpoolTimer

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentProcess

  OpenProcessToken

  CreateProcessW

  TerminateProcess

  GetCurrentThreadId

  GetStartupInfoW

  GetCurrentProcessId

  api-ms-win-core-localization-l1-2-0

  FormatMessageW

  FindNLSString

  GetLocaleInfoW

  GetACP

  api-ms-win-core-debug-l1-1-0

  IsDebuggerPresent

  OutputDebugStringW

  DebugBreak

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-com-l1-1-0

  CoTaskMemFree

  CoCreateInstance

  CoInitializeEx

  PropVariantClear

  CoUninitialize

  CoWaitForMultipleHandles

  CoCreateGuid

  CoTaskMemAlloc

  CoCreateFreeThreadedMarshaler

  api-ms-win-core-registry-l1-1-1

  RegSetKeyValueW

  api-ms-win-core-largeinteger-l1-1-0

  MulDiv

  api-ms-win-core-shlwapi-legacy-l1-1-0

  PathIsFileSpecW

  PathFileExistsW

  PathFindExtensionW

  api-ms-win-core-winrt-string-l1-1-0

  WindowsDeleteString

  WindowsCreateString

  WindowsCreateStringReference

  WindowsGetStringRawBuffer

  api-ms-win-core-registry-l1-1-0

  RegSetValueExW

  RegGetValueW

  RegDeleteKeyExW

  RegQueryValueExW

  RegEnumValueW

  RegCloseKey

  RegOpenKeyExW

  RegCreateKeyExW

  RegQueryInfoKeyW

  api-ms-win-core-winrt-l1-1-0

  RoGetActivationFactory

  api-ms-win-core-heap-l2-1-0

  LocalUnlock

  LocalFree

  LocalLock

  GlobalAlloc

  GlobalFree

  LocalAlloc

  LocalReAlloc

  api-ms-win-core-file-l1-1-0

  DeleteFileW

  GetFileAttributesW

  SetEndOfFile

  GetFileAttributesExW

  GetFileInformationByHandle

  FindClose

  FindFirstFileW

  CreateFileW

  ReadFile

  GetDiskFreeSpaceExW

  GetFullPathNameW

  CreateDirectoryW

  WriteFile

  api-ms-win-shcore-obsolete-l1-1-0

  SHStrDupW

  api-ms-win-security-base-l1-1-0

  GetTokenInformation

  api-ms-win-core-processenvironment-l1-1-0

  GetCurrentDirectoryW

  GetCommandLineW

  SetCurrentDirectoryW

  api-ms-win-core-string-l1-1-0

  MultiByteToWideChar

  FoldStringW

  CompareStringOrdinal

  WideCharToMultiByte

  api-ms-win-core-psapi-l1-1-0

  K32GetModuleFileNameExW

  api-ms-win-core-localization-obsolete-l1-2-0

  GetUserDefaultUILanguage

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemTimeAsFileTime

  GetLocalTime

  api-ms-win-core-datetime-l1-1-0

  GetDateFormatW

  GetTimeFormatW

  api-ms-win-shcore-path-l1-1-0

  ord170

  api-ms-win-core-memory-l1-1-0

  MapViewOfFile

  CreateFileMappingW

  UnmapViewOfFile

  api-ms-win-core-registry-l2-1-0

  RegCreateKeyW

  api-ms-win-core-heap-obsolete-l1-1-0

  LocalSize

  GlobalLock

  GlobalUnlock

  api-ms-win-shcore-scaling-l1-1-1

  GetDpiForMonitor

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  api-ms-win-core-windowserrorreporting-l1-1-3

  RegisterApplicationRestart

  api-ms-win-eventing-provider-l1-1-0

  EventSetInformation

  EventWriteTransfer

  EventUnregister

  EventRegister

  api-ms-win-base-util-l1-1-0

  IsTextUnicode

  api-ms-win-core-libraryloader-l1-2-1

  FindResourceW

  api-ms-win-core-processthreads-l1-1-1

  IsProcessorFeaturePresent

  GetProcessMitigationPolicy

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-interlocked-l1-1-0

  InitializeSListHead

  api-ms-win-core-winrt-error-l1-1-0

  SetRestrictedErrorInfo

  api-ms-win-core-winrt-error-l1-1-1

  RoGetMatchingRestrictedErrorInfo

  comctl32

  ImageList_Create

  ImageList_SetBkColor

  ord381

  ImageList_ReplaceIcon

  ord410

  ImageList_Draw

  ImageList_GetIconSize

  ord413

  ImageList_Destroy

  ord345

  CreateStatusWindowW

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  api-ms-win-core-delayload-l1-1-0

  DelayLoadFailureHook

  Sections

  .text

  Size: 158KB - Virtual size: 158KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .data

  Size: 2KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 11KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 124B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 120KB - Virtual size: 120KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/ddaa982f06dc35e0759d9077505beb31537f86de88232b91de45130496a61ffe.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  2c:ea:0d:56:cf:d1:0e:80:e8:53:31:2a:d3:bc:83:30:d4:20:c9:57:08:ea:3f:10:09:dd:8a:35:14:12:34:6c

  Signer

  Actual PE Digest

  2c:ea:0d:56:cf:d1:0e:80:e8:53:31:2a:d3:bc:83:30:d4:20:c9:57:08:ea:3f:10:09:dd:8a:35:14:12:34:6c

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\peta0n\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 271KB - Virtual size: 270KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/df465e0e7a01e93a8ed0f4a96fcba84506e0789f329fac2419d17f65bd1749c8.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/df62d67da06557f5d5b5b631ae5c14322ef5e01cb428ecbcfdb26c21539dbbbe.exe

  .exe windows:5 windows x86 arch:x86

  12e12319f1029ec4f8fcbed7e82df162

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

  Imports

  kernel32

  GetLastError

  SetLastError

  FormatMessageW

  GetCurrentProcess

  DeviceIoControl

  SetFileTime

  CloseHandle

  CreateDirectoryW

  RemoveDirectoryW

  CreateFileW

  DeleteFileW

  CreateHardLinkW

  GetShortPathNameW

  GetLongPathNameW

  MoveFileW

  GetFileType

  GetStdHandle

  WriteFile

  ReadFile

  FlushFileBuffers

  SetEndOfFile

  SetFilePointer

  SetFileAttributesW

  GetFileAttributesW

  FindClose

  FindFirstFileW

  FindNextFileW

  InterlockedDecrement

  GetVersionExW

  GetCurrentDirectoryW

  GetFullPathNameW

  FoldStringW

  GetModuleFileNameW

  GetModuleHandleW

  FindResourceW

  FreeLibrary

  GetProcAddress

  GetCurrentProcessId

  ExitProcess

  SetThreadExecutionState

  Sleep

  LoadLibraryW

  GetSystemDirectoryW

  CompareStringW

  AllocConsole

  FreeConsole

  AttachConsole

  WriteConsoleW

  GetProcessAffinityMask

  CreateThread

  SetThreadPriority

  InitializeCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  SetEvent

  ResetEvent

  ReleaseSemaphore

  WaitForSingleObject

  CreateEventW

  CreateSemaphoreW

  GetSystemTime

  SystemTimeToTzSpecificLocalTime

  TzSpecificLocalTimeToSystemTime

  SystemTimeToFileTime

  FileTimeToLocalFileTime

  LocalFileTimeToFileTime

  FileTimeToSystemTime

  GetCPInfo

  IsDBCSLeadByte

  MultiByteToWideChar

  WideCharToMultiByte

  GlobalAlloc

  LockResource

  GlobalLock

  GlobalUnlock

  GlobalFree

  LoadResource

  SizeofResource

  SetCurrentDirectoryW

  GetExitCodeProcess

  GetLocalTime

  GetTickCount

  MapViewOfFile

  UnmapViewOfFile

  CreateFileMappingW

  OpenFileMappingW

  GetCommandLineW

  SetEnvironmentVariableW

  ExpandEnvironmentStringsW

  GetTempPathW

  MoveFileExW

  GetLocaleInfoW

  GetTimeFormatW

  GetDateFormatW

  GetNumberFormatW

  DecodePointer

  SetFilePointerEx

  GetConsoleMode

  GetConsoleCP

  HeapSize

  SetStdHandle

  GetProcessHeap

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineA

  GetOEMCP

  RaiseException

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  LoadLibraryExA

  IsProcessorFeaturePresent

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetStartupInfoW

  QueryPerformanceCounter

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  TerminateProcess

  LocalFree

  RtlUnwind

  EncodePointer

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  LoadLibraryExW

  QueryPerformanceFrequency

  GetModuleHandleExW

  GetModuleFileNameA

  GetACP

  HeapFree

  HeapAlloc

  HeapReAlloc

  GetStringTypeW

  LCMapStringW

  FindFirstFileExA

  FindNextFileA

  IsValidCodePage

  oleaut32

  SysAllocString

  SysFreeString

  VariantClear

  gdiplus

  GdipAlloc

  GdipDisposeImage

  GdipCloneImage

  GdipCreateBitmapFromStream

  GdipCreateBitmapFromStreamICM

  GdipCreateHBITMAPFromBitmap

  GdiplusStartup

  GdiplusShutdown

  GdipFree

  Sections

  .text

  Size: 199KB - Virtual size: 198KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 44KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 145KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didat

  Size: 512B - Virtual size: 400B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 56KB - Virtual size: 55KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/df98c668e014fb5837ca0e8607ba207d98b39a52b344792ae11bf8f86610ad66.exe

  .exe windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 236B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 72B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 512B - Virtual size: 60B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/dfdc2fed5aaa08a7b0f14ae911ec5da176a96e1a5353a7c312d00e1f44f78800.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 59KB - Virtual size: 58KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 33KB - Virtual size: 33KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e0ca6e61457cff8e274b6684df90a8e0f12179af9c40b5145c0853da51d3ce70.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  PDB Paths

  D:\xampp\htdocs\default\HttpEmulator\obj\Debug\net6.0\LtpFaker.pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e13ee1f8dd928b0ee9cd7a6047e31cd903f8964fe7d3f72921c0c5933c2a5389.exe

  .exe windows:6 windows x86 arch:x86

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 3.6MB - Virtual size: 3.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 437KB - Virtual size: 748KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 184KB - Virtual size: 183KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 25KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e1a2593930db8e75976eccf2a435ff70e62efc51561692afb62f4561adab2353.exe

  .exe windows:10 windows x86 arch:x86

  9703ae33b2923ce0dd0212619f962e0b

  
  

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  AudioDG.pdb

  Imports

  msvcrt

  _ftol2

  memcmp

  _CxxThrowException

  _unlock

  _lock

  wcstoul

  ?terminate@@YAXXZ

  _except_handler4_common

  __dllonexit

  _wcmdln

  _onexit

  _initterm

  ??1type_info@@UAE@XZ

  __p__fmode

  _cexit

  _exit

  wcsncpy_s

  exit

  __set_app_type

  __wgetmainargs

  _amsg_exit

  __p__commode

  _XcptFilter

  memset

  __CxxFrameHandler3

  _callnewh

  _vsnwprintf

  memcpy_s

  _wcsicmp

  memmove_s

  _resetstkoflw

  malloc

  _purecall

  _errno

  free

  realloc

  __setusermatherr

  _controlfp

  memcpy

  api-ms-win-core-processenvironment-l1-2-0

  GetCommandLineW

  api-ms-win-core-com-l1-1-1

  CoTaskMemFree

  CoImpersonateClient

  CoRevertToSelf

  CLSIDFromString

  StringFromCLSID

  CoUninitialize

  CoTaskMemRealloc

  CoTaskMemAlloc

  PropVariantClear

  CoInitializeSecurity

  CoCreateInstance

  CoInitializeEx

  CoRevokeClassObject

  CoResumeClassObjects

  CoRegisterClassObject

  rpcrt4

  RpcServerRegisterIf3

  I_RpcBindingInqTransportType

  RpcServerUseProtseqEpW

  NdrServerCall2

  RpcRevertToSelf

  I_RpcBindingInqLocalClientPID

  RpcImpersonateClient

  RpcServerUnregisterIfEx

  api-ms-win-core-synch-l1-2-0

  LeaveCriticalSection

  ResetEvent

  DeleteCriticalSection

  EnterCriticalSection

  InitOnceBeginInitialize

  WaitForSingleObject

  Sleep

  InitializeCriticalSection

  WaitForMultipleObjectsEx

  WaitForSingleObjectEx

  CreateEventW

  SetEvent

  InitOnceExecuteOnce

  api-ms-win-core-libraryloader-l1-2-0

  GetProcAddress

  GetModuleFileNameW

  FreeLibrary

  GetModuleHandleA

  LockResource

  SizeofResource

  LoadResource

  FindResourceExW

  LoadLibraryExW

  GetModuleHandleW

  api-ms-win-core-processthreads-l1-1-2

  GetCurrentThreadId

  CreateThread

  GetCurrentProcessId

  GetThreadId

  GetCurrentProcess

  OpenProcess

  GetProcessId

  GetStartupInfoW

  TerminateProcess

  api-ms-win-core-errorhandling-l1-1-1

  UnhandledExceptionFilter

  RaiseException

  SetUnhandledExceptionFilter

  SetLastError

  GetLastError

  api-ms-win-core-handle-l1-1-0

  GetHandleInformation

  DuplicateHandle

  CloseHandle

  api-ms-win-security-base-l1-2-0

  MakeAbsoluteSD

  api-ms-win-core-registry-l1-1-0

  RegQueryValueExW

  RegCloseKey

  RegQueryInfoKeyW

  RegCreateKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegGetValueW

  api-ms-win-core-heap-l2-1-0

  LocalAlloc

  LocalFree

  api-ms-win-core-heap-l1-2-0

  HeapFree

  HeapSize

  HeapReAlloc

  HeapDestroy

  HeapAlloc

  HeapSetInformation

  GetProcessHeap

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceFrequency

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-2-1

  GetLogicalProcessorInformationEx

  GetSystemTimeAsFileTime

  GetTickCount

  api-ms-win-core-memory-l1-1-2

  GetProcessWorkingSetSizeEx

  SetProcessWorkingSetSizeEx

  UnmapViewOfFile

  MapViewOfFile

  VirtualLock

  CreateFileMappingW

  VirtualUnlock

  api-ms-win-core-string-l2-1-0

  CharNextW

  api-ms-win-core-string-l1-1-0

  MultiByteToWideChar

  api-ms-win-core-debug-l1-1-1

  OutputDebugStringA

  ntdll

  NtQueryInformationProcess

  EtwLogTraceEvent

  NtSetInformationProcess

  NtSetInformationThread

  RtlPublishWnfStateData

  NtQuerySystemInformation

  NtSetSystemInformation

  EtwEventWrite

  EtwEventWriteTransfer

  EtwGetTraceLoggerHandle

  NtDeleteWnfStateName

  EtwUnregisterTraceGuids

  NtCreateWnfStateName

  EtwEventUnregister

  EtwRegisterTraceGuidsW

  EtwTraceMessage

  EtwEventRegister

  RtlExtendMemoryBlockLookaside

  RtlFreeMemoryBlockLookaside

  RtlCreateMemoryBlockLookaside

  RtlLockMemoryZone

  RtlAllocateMemoryZone

  RtlNtStatusToDosError

  RtlCreateMemoryZone

  RtlAllocateMemoryBlockLookaside

  RtlUnlockMemoryZone

  RtlDestroyMemoryBlockLookaside

  RtlDestroyMemoryZone

  RtlSetLastWin32ErrorAndNtStatusFromNtStatus

  AlpcGetMessageAttribute

  NtAlpcCreatePort

  NtAlpcOpenSenderProcess

  RtlRandomEx

  NtClose

  NtAlpcSendWaitReceivePort

  NtAlpcAcceptConnectPort

  NtAlpcConnectPort

  RtlInitUnicodeStringEx

  AlpcInitializeMessageAttribute

  ShipAssertMsgW

  EtwEventSetInformation

  EtwGetTraceEnableFlags

  EtwGetTraceEnableLevel

  ShipAssert

  WinSqmIncrementDWORD

  api-ms-win-core-windowserrorreporting-l1-1-0

  WerRegisterMemoryBlock

  api-ms-win-core-string-obsolete-l1-1-0

  lstrcmpiW

  api-ms-win-core-threadpool-legacy-l1-1-0

  CreateTimerQueueTimer

  DeleteTimerQueueTimer

  mmdevapi

  ord8

  ord2

  ord9

  api-ms-win-eventing-classicprovider-l1-1-0

  TraceMessage

  TraceEvent

  api-ms-win-eventing-provider-l1-1-0

  EventWrite

  api-ms-win-core-delayload-l1-1-1

  ResolveDelayLoadedAPI

  DelayLoadFailureHook

  Sections

  .text

  Size: 246KB - Virtual size: 245KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_CODE

  Size: 1024B - Virtual size: 784B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  RT_BSS

  Size: - Virtual size: 40B

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 1024B - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 7KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_DATA

  Size: 512B - Virtual size: 176B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  RT_CONST

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e1cad6961c9fcbbcb8a974c5d6cc58a248d2d69880d1ca8355ef8a92c3bc8afc.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\z71yket8l\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 312KB - Virtual size: 311KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e1f6fcf313a740a6df4d2ee3903d1fcf9e761b6355cf9444845666c332c33e4c.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 452KB - Virtual size: 452KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e2a03fd46d56cb79ec4c0cbef9e6fe2bd3067418f81f77355c908cfeae03ee76.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e2bb00ad68d4333ea37315e45a8e2f29ed109c409d1d2b209d7e9d55681ad936.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e3b5a04c8bc029a519b7edb6f32ef05b48e83f8ba5d78957aaff4900c1abbbad.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\f0xhtczm0kby\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 311KB - Virtual size: 310KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e45ef7fdd1a92c5ed40b3365a895623a112ee16444cf0ebe70619cf09d8628ca.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  2f:5d:35:30:3d:29:ea:5d:ff:bb:88:a0:a3:c6:81:af:42:33:02:3e:51:f2:a7:5a:9a:8a:16:05:03:6d:36:cd

  Signer

  Actual PE Digest

  2f:5d:35:30:3d:29:ea:5d:ff:bb:88:a0:a3:c6:81:af:42:33:02:3e:51:f2:a7:5a:9a:8a:16:05:03:6d:36:cd

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\aeno49\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e4e5e5bd85ece6b75370225324960ac9b368042462715c76588ea68445935718.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e597fb772319a806f79e33ebe4faaeca8497afbbc3081c9379ea6e9b3c1756b7.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 38KB - Virtual size: 37KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e5e142eea2e5369d6ddef616cd7acf6816ae9e194a77c00214be8575b983dc2f.exe

  .exe windows:5 windows x86 arch:x86

  be41bf7b8cc010b614bd36bbca606973

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 3.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 352KB - Virtual size: 351KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 13KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e606e3e72dfaabb3b398d7f7b2b221675038da19080c69c41bd3005066d94f50.exe

  .exe windows:5 windows x86 arch:x86

  bf95d1fc1d10de18b32654b123ad5e1f

  
  

  Code Sign

  40:4c:4c:82:ec:36:cb:93:79:60:06:88:51:7f:3d:c7

  Certificate

  Issuer

  CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

  Not Before

  24-10-2023 17:03

  Not After

  24-10-2024 17:02

  Subject

  SERIALNUMBER=6703101,CN=Signal Messenger\, LLC,O=Signal Messenger\, LLC,L=Mountain View,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b

  Certificate

  Issuer

  CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

  Not Before

  07-05-2021 19:19

  Not After

  29-12-2040 23:59

  Subject

  CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f

  Certificate

  Issuer

  CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  07-05-2021 15:43

  Not After

  07-11-2030 16:13

  Subject

  CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  4a:53:8c:28

  Certificate

  Issuer

  CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  07-07-2009 17:25

  Not After

  07-12-2030 17:55

  Subject

  CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  73:4f:4f:16:58:82:16:b0:a9:04:f5:7b:27:75:24:7b:62:18:29:5a:0b:cd:ce:e8:69:9f:46:f7:6b:7e:66:47

  Signer

  Actual PE Digest

  73:4f:4f:16:58:82:16:b0:a9:04:f5:7b:27:75:24:7b:62:18:29:5a:0b:cd:ce:e8:69:9f:46:f7:6b:7e:66:47

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  lstrcpynA

  CloseHandle

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  CreateFileW

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  MulDiv

  lstrlenA

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrlenW

  user32

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  FindWindowExW

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  IsWindow

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 26KB - Virtual size: 25KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 452KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 516KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 296KB - Virtual size: 296KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e717677c2827928972ab2674573e9fa3b1b5e31b6cfa42e52be5bb31a41b16fd.exe

  .exe windows:6 windows x64 arch:x64

  4f2f006e2ecf7172ad368f8289dc96c1

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  WriteFile

  WriteConsoleW

  WerSetFlags

  WerGetFlags

  WaitForMultipleObjects

  WaitForSingleObject

  VirtualQuery

  VirtualFree

  VirtualAlloc

  TlsAlloc

  SwitchToThread

  SuspendThread

  SetWaitableTimer

  SetUnhandledExceptionFilter

  SetProcessPriorityBoost

  SetEvent

  SetErrorMode

  SetConsoleCtrlHandler

  ResumeThread

  RaiseFailFastException

  PostQueuedCompletionStatus

  LoadLibraryW

  LoadLibraryExW

  SetThreadContext

  GetThreadContext

  GetSystemInfo

  GetSystemDirectoryA

  GetStdHandle

  GetQueuedCompletionStatusEx

  GetProcessAffinityMask

  GetProcAddress

  GetErrorMode

  GetEnvironmentStringsW

  GetCurrentThreadId

  GetConsoleMode

  FreeEnvironmentStringsW

  ExitProcess

  DuplicateHandle

  CreateWaitableTimerExW

  CreateThread

  CreateIoCompletionPort

  CreateFileA

  CreateEventA

  CloseHandle

  AddVectoredExceptionHandler

  Sections

  .text

  Size: 2.0MB - Virtual size: 2.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 85KB - Virtual size: 478KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 43KB - Virtual size: 43KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .xdata

  Size: 512B - Virtual size: 168B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  /4

  Size: 512B - Virtual size: 297B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /19

  Size: 346KB - Virtual size: 346KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /32

  Size: 72KB - Virtual size: 71KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /46

  Size: 512B - Virtual size: 94B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /65

  Size: 603KB - Virtual size: 603KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /78

  Size: 472KB - Virtual size: 471KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  /90

  Size: 128KB - Virtual size: 127KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .idata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 30KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  .symtab

  Size: 259KB - Virtual size: 258KB

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e7cb46c59bd25d286e55ea5d61aef64e5ed103ed375250485071cd56ccb884a3.exe

  .exe windows:6 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\BUILD\work\e0dd96435fde7cb0\BUILDS\Release\x86\avDump.pdb

  Exports

  Exports

  asw_process_storage_allocate_connector

  asw_process_storage_deallocate_connector

  on_avast_dll_unload

  onexit_register_connector_avast_2

  Sections

  .text

  Size: 647KB - Virtual size: 646KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 266KB - Virtual size: 266KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 20KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didat

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 319KB - Virtual size: 318KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 36KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• Samples - 10-09-2024/e7f4f322dbff2e341e43c948904408861ac03ebaf31228024b1fb8ed8b8f4bd5.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 21KB - Virtual size: 20KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e80e120da34729c9fb7e7d4a684a7260f1346696ee8b3b514b6e512ebfa1bea4.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  09:97:c5:6c:aa:59:05:53:94:d9:a9:cd:b8:be:eb:56

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-01-2023 00:00

  Not After

  16-01-2026 23:59

  Subject

  CN=NVIDIA Corporation,OU=2-J,O=NVIDIA Corporation,L=Santa Clara,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  38:63:de:f8

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  24-12-1999 17:50

  Not After

  24-07-2029 14:15

  Subject

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:da:13:ff:00:00:00:00:51:ce:0d:f7

  Certificate

  Issuer

  CN=Entrust.net Certification Authority (2048),OU=www.entrust.net/CPS_2048 incorp. by ref. (limits liab.)+OU=(c) 1999 Entrust.net Limited,O=Entrust.net

  Not Before

  22-07-2015 19:02

  Not After

  22-06-2029 19:32

  Subject

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  56:ab:95:75:28:9c:a5:9f:0e:17:d4:0b:ea:05:c3:1f

  Certificate

  Issuer

  CN=Entrust Timestamping CA - TS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

  Not Before

  04-10-2022 17:21

  Not After

  01-01-2029 00:00

  Subject

  CN=Entrust Timestamp Authority - TSA1,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  bb:69:34:9c:54:91:58:69:13:86:01:09:53:41:03:8f:28:75:31:c6:23:7e:0e:ac:b2:21:ab:8a:aa:89:64:f8

  Signer

  Actual PE Digest

  bb:69:34:9c:54:91:58:69:13:86:01:09:53:41:03:8f:28:75:31:c6:23:7e:0e:ac:b2:21:ab:8a:aa:89:64:f8

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  c:\4a39bj1qnm7h\obj\Release\' .pdb

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e823a87e4314fdebeb23a66198ee8d65aff734962d66c989ead9450dbf82ed9d.exe

  .exe windows:5 windows x86 arch:x86

  c4540f421523fe2dc591e50be5ad7d0b

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  gethostbyname

  recv

  send

  socket

  inet_ntoa

  setsockopt

  ntohs

  WSACleanup

  WSAStartup

  sendto

  htons

  __WSAFDIsSet

  select

  accept

  listen

  bind

  inet_addr

  ioctlsocket

  recvfrom

  WSAGetLastError

  closesocket

  gethostname

  connect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_ReplaceIcon

  ImageList_Destroy

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  InitCommonControlsEx

  ImageList_Create

  mpr

  WNetGetConnectionW

  WNetCancelConnection2W

  WNetUseConnectionW

  WNetAddConnection2W

  wininet

  HttpOpenRequestW

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetQueryOptionW

  InternetConnectW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetReadFile

  InternetQueryDataAvailable

  psapi

  GetProcessMemoryInfo

  iphlpapi

  IcmpSendEcho

  IcmpCloseHandle

  IcmpCreateFile

  userenv

  DestroyEnvironmentBlock

  LoadUserProfileW

  CreateEnvironmentBlock

  UnloadUserProfile

  uxtheme

  IsThemeActive

  kernel32

  DuplicateHandle

  CreateThread

  WaitForSingleObject

  HeapAlloc

  GetProcessHeap

  HeapFree

  Sleep

  GetCurrentThreadId

  MultiByteToWideChar

  MulDiv

  GetVersionExW

  IsWow64Process

  GetSystemInfo

  FreeLibrary

  LoadLibraryA

  GetProcAddress

  SetErrorMode

  GetModuleFileNameW

  WideCharToMultiByte

  lstrcpyW

  lstrlenW

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  SetEndOfFile

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  GetLongPathNameW

  GetShortPathNameW

  DeleteFileW

  IsDebuggerPresent

  CopyFileExW

  MoveFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  LoadResource

  LockResource

  SizeofResource

  OutputDebugStringW

  GetTempPathW

  GetTempFileNameW

  DeviceIoControl

  LoadLibraryW

  GetLocalTime

  CompareStringW

  GetCurrentThread

  EnterCriticalSection

  LeaveCriticalSection

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  LoadLibraryExW

  FindResourceExW

  CopyFileW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  SetFileAttributesW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetSystemDirectoryW

  HeapReAlloc

  HeapSize

  GetComputerNameW

  GetWindowsDirectoryW

  GetCurrentProcessId

  GetProcessIoCounters

  CreateProcessW

  GetProcessId

  SetPriorityClass

  VirtualAlloc

  GetCurrentDirectoryW

  lstrcmpiW

  DecodePointer

  GetLastError

  RaiseException

  InitializeCriticalSectionAndSpinCount

  DeleteCriticalSection

  InterlockedDecrement

  InterlockedIncrement

  ResetEvent

  WaitForSingleObjectEx

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  CloseHandle

  GetFullPathNameW

  GetStartupInfoW

  GetSystemTimeAsFileTime

  InitializeSListHead

  RtlUnwind

  SetLastError

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  EncodePointer

  ExitProcess

  GetModuleHandleExW

  ExitThread

  ResumeThread

  FreeLibraryAndExitThread

  GetACP

  GetDateFormatW

  GetTimeFormatW

  LCMapStringW

  GetStringTypeW

  GetFileType

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  ReadConsoleW

  GetTimeZoneInformation

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableA

  SetCurrentDirectoryW

  FindNextFileW

  WriteConsoleW

  user32

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  CallWindowProcW

  ReleaseCapture

  SetCapture

  PeekMessageW

  GetInputState

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromPoint

  MonitorFromRect

  LoadImageW

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  ClientToScreen

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  GetMenuItemID

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  LockWindowUpdate

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowLongW

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  RegisterHotKey

  GetCursorInfo

  SetWindowPos

  CopyImage

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  TrackPopupMenuEx

  GetMessageW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  GetUserObjectSecurity

  MessageBoxW

  DefWindowProcW

  MoveWindow

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  DispatchMessageW

  keybd_event

  TranslateMessage

  ScreenToClient

  gdi32

  EndPath

  DeleteObject

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  GetDeviceCaps

  SetPixel

  CloseFigure

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  CreateCompatibleBitmap

  CreateCompatibleDC

  PolyDraw

  BeginPath

  Rectangle

  SetViewportOrgEx

  GetObjectW

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  SelectObject

  StretchBlt

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  GetDIBits

  StrokePath

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  GetAce

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegEnumKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  RegConnectRegistryW

  InitializeSecurityDescriptor

  InitializeAcl

  AdjustTokenPrivileges

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  GetLengthSid

  CopySid

  LogonUserW

  AllocateAndInitializeSid

  CheckTokenMembership

  FreeSid

  GetTokenInformation

  RegCreateKeyExW

  GetSecurityDescriptorDacl

  GetAclInformation

  GetUserNameW

  AddAce

  SetSecurityDescriptorDacl

  InitiateSystemShutdownExW

  shell32

  DragFinish

  DragQueryPoint

  ShellExecuteExW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHGetPathFromIDListW

  SHBrowseForFolderW

  SHCreateShellItem

  SHGetDesktopFolder

  SHGetSpecialFolderLocation

  SHGetFolderPathW

  SHFileOperationW

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  ole32

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  ProgIDFromCLSID

  CLSIDFromProgID

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoCreateInstance

  IIDFromString

  StringFromGUID2

  CreateStreamOnHGlobal

  OleInitialize

  OleUninitialize

  CoInitialize

  CoUninitialize

  GetRunningObjectTable

  CoGetInstanceFromFile

  CoGetObject

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  oleaut32

  CreateStdDispatch

  CreateDispTypeInfo

  UnRegisterTypeLi

  UnRegisterTypeLibForUser

  RegisterTypeLibForUser

  RegisterTypeLi

  LoadTypeLibEx

  VariantCopyInd

  SysReAllocString

  SysFreeString

  VariantChangeType

  SafeArrayDestroyData

  SafeArrayUnaccessData

  SafeArrayAccessData

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SafeArrayCreateVector

  SysStringLen

  QueryPathOfRegTypeLi

  SysAllocString

  VariantInit

  VariantClear

  DispCallFunc

  VariantTimeToSystemTime

  VarR8FromDec

  SafeArrayGetVartype

  SafeArrayDestroyDescriptor

  VariantCopy

  OleLoadPicture

  Sections

  .text

  Size: 619KB - Virtual size: 618KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 191KB - Virtual size: 190KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 18KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 453KB - Virtual size: 453KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 29KB - Virtual size: 29KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Samples - 10-09-2024/e82797a9b4a8fcc80f7a4521719d313119cc408b867b721a79f5967cdbac8a8c.exe

  .exe windows:6 windows x64 arch:x64

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Sections

  UPX0

  Size: - Virtual size: 232KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 128KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 60KB - Virtual size: 64KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE