2026-10-01_ba2a962c0e28cea63e2da43ec250eb6d_coinminer_glassworm_icedid_njrat_vidar

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-01_ba2a962c0e28cea63e2da43ec250eb6d_coinminer_glassworm_icedid_njrat_vidar
Size 19.0MB
Sample261002-e8l4ysvz7k
SHA256 4fc5891c306a1a7c6610f0a0516313b6562905339dff2a16064442d768ef41e0
MD5 ba2a962c0e28cea63e2da43ec250eb6d
SHA1 f006c6cfd2b2903a25495cf0a5ed7c95d9d2fa04
SHA512 bfed229f53aa595ce693fc50dd08e7d6da5f74578b44f95ceab9a22e5483775204e735b6d4e48e410306636035bed82342a7a71011fc192c87924236ff07d75c
SSDEEP 196608:jmo2jfl0awN69UwqueqDVjYdZwK54rjzhVPsr2yk3:lY/wNFwqueqDVjYdZwK54jvUSy
TLSH
T16017AE6A67A840ECC47BC17CCA478A53E7B2782507709BDF16A016AA1F376F05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

2026-10-01_ba2a962c0e28cea63e2da43ec250eb6d_coinminer_glassworm_icedid_njrat_vidar

.exe 19.0MB

2026-10-01_ba2a962c0e28cea63e2da43ec250eb6d_coinminer_glassworm_icedid_njrat_vidar

IMPHASH d7ddcc6497f257cba172c1071556dc52
SHA256 4fc5891c306a1a7c6610f0a0516313b6562905339dff2a16064442d768ef41e0
MD5 ba2a962c0e28cea63e2da43ec250eb6d
SHA1 f006c6cfd2b2903a25495cf0a5ed7c95d9d2fa04
SHA512 bfed229f53aa595ce693fc50dd08e7d6da5f74578b44f95ceab9a22e5483775204e735b6d4e48e410306636035bed82342a7a71011fc192c87924236ff07d75c
SSDEEP 196608:jmo2jfl0awN69UwqueqDVjYdZwK54rjzhVPsr2yk3:lY/wNFwqueqDVjYdZwK54jvUSy
TLSH
T16017AE6A67A840ECC47BC17CCA478A53E7B2782507709BDF16A016AA1F376F05E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Digest

f4:cd:4f:8a:a2:a7:6d:0e:9a:d6:6e:00:c9:2d:29:54:2e:92:22:1e:3c:e9:6d:15:a5:89:91:65:0c:66:61:5b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=515189686,CN=CYNET SECURITY LTD,O=CYNET SECURITY LTD,STREET=2 Sderot Nim,L=Rishon LeZion,ST=Central District,C=IL,1.3.6.1.4.1.311.60.2.1.3=#1302494c,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Sep 2, 2026

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Mar 18, 2029

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

Serial Number

0b:a5:5d:13:c2:fd:9c:79:5c:b3:0b:62

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 14, 2023 - Sep 10, 2026

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

Major OS version

Entry point

9761560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\azagent\A1\_work\3\s\EPSDev\WindowsEPS\ReleaseVersion\OutputFiles\x64\sym\MemScanner.pdb

ws2_32

getpeername connect closesocket WSAAddressToStringW WSAGetLastError WSASetLastError select WSAStartup inet_ntoa gethostbyaddr getservbyport getservbyname recv send accept htons listen setsockopt shutdown recvfrom sendto GetAddrInfoW FreeAddrInfoW InetNtopW WSASocketA inet_addr socket getsockname WSAStringToAddressA __WSAFDIsSet WSAIoctl freeaddrinfo inet_ntop WSAStringToAddressW gethostbyname gethostname ntohs htonl ntohl bind ioctlsocket getaddrinfo WSACleanup getsockopt WSAAddressToStringA WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents

user32

MessageBoxW MsgWaitForMultipleObjects GetSystemMetrics RegisterDeviceNotificationW GetProcessWindowStation PeekMessageW DispatchMessageW GetUserObjectInformationW CreateWindowExW RegisterClassExW GetMessageW UnregisterDeviceNotification TranslateMessage

kernel32

GetCurrentProcessId SetPriorityClass GetQueuedCompletionStatus CreateIoCompletionPort SleepEx GetShortPathNameW ProcessIdToSessionId GetTempFileNameW Sleep GetLogicalDriveStringsW WideCharToMultiByte CreateWaitableTimerW FormatMessageW FormatMessageA LocalFree GetCurrentThreadId SetWaitableTimer WaitForSingleObject DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException CloseHandle DecodePointer GetCurrentProcess CreateEventA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage HeapSize GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetFullPathNameA PeekNamedPipe SetConsoleCtrlHandler WriteConsoleW SetStdHandle GetCommandLineA UnregisterWaitEx LoadLibraryExA AddVectoredExceptionHandler LocalAlloc lstrlenW GetTickCount OpenProcess lstrcpyW SetLastError GetVersion TerminateProcess ResumeThread CreateProcessW WriteProcessMemory VirtualProtectEx UnmapViewOfFile DuplicateHandle MapViewOfFile GetExitCodeThread ReadProcessMemory ExitProcess WriteFile CreateFileA GetSystemDirectoryW GetCurrentDirectoryW GetModuleFileNameW GetFileAttributesW DeviceIoControl CreateFileW SetEvent LeaveCriticalSection EnterCriticalSection CancelIo ResetEvent GetOverlappedResult WaitForMultipleObjects CreateEventW GetFileSize CreateFileMappingA InitializeCriticalSection CreateThread VirtualFree VirtualAlloc GetModuleHandleW VirtualAllocEx VirtualQueryEx VirtualFreeEx VirtualQuery Thread32Next OpenThread Thread32First CreateToolhelp32Snapshot GetCurrentThread GetProcAddress LoadLibraryW HeapAlloc GetProcessHeap VirtualProtect HeapFree TerminateThread SetThreadContext GetThreadContext CreateRemoteThread GetWindowsDirectoryW CreateFileMappingW GetModuleFileNameA GetVersionExW CreateMutexW lstrlenA OpenFileMappingW OpenEventW lstrcatA lstrcpyA GetModuleHandleA ExitThread FreeLibrary LoadLibraryA ReleaseMutex SetThreadPriority CreateSemaphoreW ReleaseSemaphore CreatePipe ReadFile GetStdHandle GetFileAttributesA OutputDebugStringA SetHandleInformation GetTimeZoneInformation GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleA MultiByteToWideChar IsDebuggerPresent DebugBreak OutputDebugStringW WaitForSingleObjectEx OpenSemaphoreW GetModuleHandleExW GetComputerNameW GetEnvironmentVariableA GetEnvironmentVariableW SuspendThread GetVersionExA FindClose FreeResource CreateDirectoryW GetDiskFreeSpaceExW SetFileAttributesW MoveFileExW CompareFileTime FileTimeToLocalFileTime GetSystemTimeAsFileTime SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetEnvironmentVariableA GetComputerNameExW FindFirstFileW FindNextFileW RemoveDirectoryW GetProcessTimes GetExitCodeProcess GetNativeSystemInfo IsWow64Process Process32FirstW Process32NextW LoadLibraryExW GetSystemInfo ExpandEnvironmentStringsW GetDriveTypeW GetLongPathNameW FindFirstVolumeW FindNextVolumeW FindVolumeClose QueryDosDeviceW DeleteFileW GetFileInformationByHandle GetFileSizeEx GetLogicalDrives GetVolumePathNameW SetFilePointerEx CancelSynchronousIo GetSystemWindowsDirectoryW GetVolumeInformationW GetTempPathW VerifyVersionInfoW IsProcessInJob CreateJobObjectA OpenJobObjectA AssignProcessToJobObject SetInformationJobObject CreateMutexA GetVolumeInformationA GetFileType GetUserDefaultUILanguage GetThreadTimes QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree HeapCreate HeapReAlloc InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetACP TryEnterCriticalSection CreateSemaphoreA SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA LoadResource LockResource SizeofResource FindResourceW GetSystemTime SystemTimeToFileTime ConvertFiberToThread ConvertThreadToFiberEx SwitchToThread GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW OpenEventA OpenMutexA OpenFileMappingA WritePrivateProfileStringW GetCommandLineW GetTickCount64 SetDllDirectoryW WTSGetActiveConsoleSessionId SetFilePointer GetComputerNameA Module32FirstW Module32NextW EncodePointer GetStringTypeW FindFirstFileExW GetFileAttributesExW GetFullPathNameW AreFileApisANSI SetEndOfFile QueueUserWorkItem IsProcessorFeaturePresent GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW CreateTimerQueue SignalObjectAndWait GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibraryAndExitThread InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList

advapi32

ImpersonateLoggedOnUser DuplicateTokenEx RegEnumKeyExW LookupAccountSidA StartServiceA OpenServiceA OpenSCManagerA CloseServiceHandle StartServiceW QueryServiceStatus OpenSCManagerW CreateServiceW DeleteService RegDeleteKeyW RegCloseKey RegEnumKeyW RegOpenKeyExW RegSetValueExW RegCreateKeyExW ControlService RegSetValueExA RegDeleteValueA RegQueryValueExA RegOpenKeyExA AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation OpenProcessToken OpenServiceW FreeSid AllocateAndInitializeSid GetKernelObjectSecurity SetSecurityDescriptorDacl InitializeSecurityDescriptor QueryServiceStatusEx SetThreadToken RevertToSelf RegDeleteValueW RegEnumValueW RegQueryInfoKeyW RegQueryValueExW QueryAllTracesW StartTraceW CloseTrace ProcessTrace OpenTraceW ControlTraceW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey LookupPrivilegeValueA CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource ConvertSidToStringSidA LookupAccountNameW ConvertStringSidToSidA ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorOwner SetKernelObjectSecurity MakeAbsoluteSD CreateWellKnownSid GetSidSubAuthorityCount GetSidSubAuthority DuplicateToken LsaQueryInformationPolicy LsaOpenPolicy LsaClose LsaFreeMemory SetEntriesInAclW LookupAccountSidW CreateProcessAsUserW

ole32

CoUninitialize CoCreateInstance StringFromGUID2 CoInitialize CoInitializeEx CoInitializeSecurity StringFromCLSID CLSIDFromString CoCreateGuid CoTaskMemFree

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetShareEnum DsRoleFreeMemory DsRoleGetPrimaryDomainInformation NetApiBufferFree

setupapi

CM_Request_Device_EjectW CM_Get_Parent CM_Get_DevNode_Registry_PropertyW CM_Get_Device_IDW SetupDiGetClassDevsW SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdW SetupDiGetDeviceInstanceIdA SetupDiDestroyDeviceInfoList

psapi

GetModuleFileNameExW EmptyWorkingSet GetMappedFileNameW GetProcessImageFileNameW GetProcessMemoryInfo EnumProcessModules GetModuleFileNameExA

iphlpapi

SendARP GetAdaptersAddresses GetExtendedTcpTable GetAdaptersInfo DeleteIpNetEntry GetIpNetTable GetExtendedUdpTable

crypt32

CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore PFXExportCertStoreEx CertCloseStore CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertGetCertificateChain CertSetCertificateContextProperty CertOpenSystemStoreW CertCreateCertificateContext CertEnumCertificatesInStore CertGetNameStringW CryptHashCertificate

wtsapi32

WTSQueryUserToken WTSFreeMemory WTSEnumerateSessionsW WTSQuerySessionInformationW

userenv

GetProfilesDirectoryW DestroyEnvironmentBlock CreateEnvironmentBlock

shlwapi

PathFindFileNameW PathIsUNCW PathFileExistsW

wintrust

WinVerifyTrust

ntdll

RtlCaptureContext VerSetConditionMask RtlVirtualUnwind NtQueryVirtualMemory RtlUnwind RtlUnwindEx RtlInitUnicodeString RtlUpcaseUnicodeChar NtQuerySystemInformation RtlLookupFunctionEntry RtlPcToFileHeader NtSetSystemInformation RtlUpcaseUnicodeString

dnsapi

DnsFree

shell32

CommandLineToArgvW

oleaut32

VariantChangeType VariantInit SysFreeString SysAllocString VariantClear

secur32

InitSecurityInterfaceW

?$TSS0@?1??create@?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$InputBindingMap@VBinaryInputArchive@cereal@@@34@XZ@4HA ?$TSS0@?1??create@?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$OutputBindingMap@VBinaryOutputArchive@cereal@@@34@XZ@4HA ?$TSS0@?1??create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@34@XZ@4HA ?$TSS0@?1??create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@34@XZ@4HA ?$TSS0@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4HA ??4?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z ??4?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z ??4?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z ??4?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z ??4?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@QEAAAEAV012@AEBV012@@Z ?PFObject_create@ProtocolFilters@@YAPEAVPFObject@1@HH@Z ?create@?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$InputBindingMap@VBinaryInputArchive@cereal@@@23@XZ ?create@?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$OutputBindingMap@VBinaryOutputArchive@cereal@@@23@XZ ?create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@23@XZ ?create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@23@XZ ?create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@23@XZ ?getInstance@?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@SAAEAU?$InputBindingMap@VBinaryInputArchive@cereal@@@23@XZ ?getInstance@?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@SAAEAU?$OutputBindingMap@VBinaryOutputArchive@cereal@@@23@XZ ?getInstance@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@SAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@23@XZ ?getInstance@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@SAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@23@XZ ?getInstance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SAAEAUPolymorphicCasters@23@XZ ?instance@?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@0AEAU?$InputBindingMap@VBinaryInputArchive@cereal@@@23@EA ?instance@?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@0AEAU?$OutputBindingMap@VBinaryOutputArchive@cereal@@@23@EA ?instance@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@0AEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@23@EA ?instance@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@0AEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@23@EA ?instance@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@0AEAUPolymorphicCasters@23@EA ?lock@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@SA?AVLockGuard@123@XZ ?nf_addBindingRule@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_BINDING_RULE@1@H@Z ?nf_addFlowCtl@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_FLOWCTL_DATA@1@PEAI@Z ?nf_addRule@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_RULE@1@H@Z ?nf_addRuleEx@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_RULE_EX@1@H@Z ?nf_adjustProcessPriviledges@nfapi@@YAXXZ ?nf_completeTCPConnectRequest@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_TCP_CONN_INFO@1@@Z ?nf_completeUDPConnectRequest@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_UDP_CONN_REQUEST@1@@Z ?nf_deleteBindingRules@nfapi@@YA?AW4_NF_STATUS@@XZ ?nf_deleteFlowCtl@nfapi@@YA?AW4_NF_STATUS@@I@Z ?nf_deleteRules@nfapi@@YA?AW4_NF_STATUS@@XZ ?nf_free@nfapi@@YAXXZ ?nf_getConnCount@nfapi@@YAKXZ ?nf_getDriverType@nfapi@@YAKXZ ?nf_getFlowCtlStat@nfapi@@YA?AW4_NF_STATUS@@IPEFAU_NF_FLOWCTL_STAT@1@@Z ?nf_getProcessNameA@nfapi@@YAHKPEADK@Z ?nf_getProcessNameFromKernel@nfapi@@YAHKPEA_WK@Z ?nf_getProcessNameW@nfapi@@YAHKPEA_WK@Z ?nf_getTCPConnInfo@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_TCP_CONN_INFO@1@@Z ?nf_getTCPStat@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_FLOWCTL_STAT@1@@Z ?nf_getUDPConnInfo@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_UDP_CONN_INFO@1@@Z ?nf_getUDPStat@nfapi@@YA?AW4_NF_STATUS@@_KPEFAU_NF_FLOWCTL_STAT@1@@Z ?nf_init@nfapi@@YA?AW4_NF_STATUS@@PEBDPEAVNF_EventHandler@1@@Z ?nf_ipPostReceive@nfapi@@YA?AW4_NF_STATUS@@PEBDHPEAU_NF_IP_PACKET_OPTIONS@1@@Z ?nf_ipPostSend@nfapi@@YA?AW4_NF_STATUS@@PEBDHPEAU_NF_IP_PACKET_OPTIONS@1@@Z ?nf_modifyFlowCtl@nfapi@@YA?AW4_NF_STATUS@@IPEFAU_NF_FLOWCTL_DATA@1@@Z ?nf_registerDriver@nfapi@@YA?AW4_NF_STATUS@@PEBD@Z ?nf_registerDriverEx@nfapi@@YA?AW4_NF_STATUS@@PEBD0@Z ?nf_setIPEventHandler@nfapi@@YAXPEAVNF_IPEventHandler@1@@Z ?nf_setOptions@nfapi@@YAXKK@Z ?nf_setRules@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_RULE@1@H@Z ?nf_setRulesEx@nfapi@@YA?AW4_NF_STATUS@@PEFAU_NF_RULE_EX@1@H@Z ?nf_setTCPFlowCtl@nfapi@@YA?AW4_NF_STATUS@@_KI@Z ?nf_setTCPTimeout@nfapi@@YAKK@Z ?nf_setUDPFlowCtl@nfapi@@YA?AW4_NF_STATUS@@_KI@Z ?nf_tcpClose@nfapi@@YA?AW4_NF_STATUS@@_K@Z ?nf_tcpDisableFiltering@nfapi@@YA?AW4_NF_STATUS@@_K@Z ?nf_tcpIsProxy@nfapi@@YAHK@Z ?nf_tcpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPEBDH@Z ?nf_tcpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPEBDH@Z ?nf_tcpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z ?nf_tcpSetSockOpt@nfapi@@YA?AW4_NF_STATUS@@_KHPEBDH@Z ?nf_udpDisableFiltering@nfapi@@YA?AW4_NF_STATUS@@_K@Z ?nf_udpPostReceive@nfapi@@YA?AW4_NF_STATUS@@_KPEBEPEBDHPEFAU_NF_UDP_OPTIONS@1@@Z ?nf_udpPostSend@nfapi@@YA?AW4_NF_STATUS@@_KPEBEPEBDHPEFAU_NF_UDP_OPTIONS@1@@Z ?nf_udpSetConnectionState@nfapi@@YA?AW4_NF_STATUS@@_KH@Z ?nf_unRegisterDriver@nfapi@@YA?AW4_NF_STATUS@@PEBD@Z ?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z ?pf_canDisableFiltering@ProtocolFilters@@YAH_K@Z ?pf_deleteExceptions@ProtocolFilters@@YAXW4_eEXCEPTION_CLASS@1@@Z ?pf_deleteFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z ?pf_free@ProtocolFilters@@YAXXZ ?pf_getFilterCount@ProtocolFilters@@YAH_K@Z ?pf_getNFEventHandler@ProtocolFilters@@YAPEAVNF_EventHandler@nfapi@@XZ ?pf_getProcessOwnerA@ProtocolFilters@@YAHKPEADH@Z ?pf_getProcessOwnerW@ProtocolFilters@@YAHKPEA_WH@Z ?pf_getRootSSLCertFileName@ProtocolFilters@@YAHPEA_WH@Z ?pf_importCompleted@ProtocolFilters@@YAHXZ ?pf_init@ProtocolFilters@@YAHPEAVPFEvents@1@PEB_W@Z ?pf_isFilterActive@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z ?pf_loadCAStore@ProtocolFilters@@YAHPEBD@Z ?pf_postObject@ProtocolFilters@@YAH_KPEAVPFObject@1@@Z ?pf_setExceptionsTimeout@ProtocolFilters@@YAXW4_eEXCEPTION_CLASS@1@_K@Z ?pf_setRootSSLCertImportFlags@ProtocolFilters@@YAXK@Z ?pf_setRootSSLCertSubject@ProtocolFilters@@YAXPEBD@Z ?pf_setRootSSLCertSubjectEx@ProtocolFilters@@YAXPEBD0H0H@Z ?pf_startLog@ProtocolFilters@@YAHPEBD@Z ?pf_stopLog@ProtocolFilters@@YAXXZ ?pf_unzipStream@ProtocolFilters@@YAHPEAVPFStream@1@@Z ?pf_waitForImportCompletion@ProtocolFilters@@YAXXZ ?t@?1??create@?$StaticObject@U?$InputBindingMap@VBinaryInputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$InputBindingMap@VBinaryInputArchive@cereal@@@34@XZ@4U534@A ?t@?1??create@?$StaticObject@U?$OutputBindingMap@VBinaryOutputArchive@cereal@@@detail@cereal@@@detail@cereal@@CAAEAU?$OutputBindingMap@VBinaryOutputArchive@cereal@@@34@XZ@4U534@A ?t@?1??create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@FileCertificateCacheTypes@@@@@34@XZ@4U534@A ?t@?1??create@?$StaticObject@U?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@detail@cereal@@@detail@cereal@@CAAEAU?$PolymorphicVirtualCaster@V?$BaseLruCache@U?$ExpiringLruCacheEntry@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@@V?$ExpiringLruCache@V?$array@_K$02@std@@UCacheValue@hash@cynet@@@@@34@XZ@4U534@A ?t@?1??create@?$StaticObject@UPolymorphicCasters@detail@cereal@@@detail@cereal@@CAAEAUPolymorphicCasters@34@XZ@4U534@A argon2_ctx argon2_encodedlen argon2_error_message argon2_hash argon2_type2string argon2_verify argon2_verify_ctx argon2d_ctx argon2d_hash_encoded argon2d_hash_raw argon2d_verify argon2d_verify_ctx argon2i_ctx argon2i_hash_encoded argon2i_hash_raw argon2i_verify argon2i_verify_ctx argon2id_ctx argon2id_hash_encoded argon2id_hash_raw argon2id_verify argon2id_verify_ctx

Name

.text

Size

13.3MB

Virtual Size

13.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

351KB

Virtual Size

511KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

578KB

Virtual Size

578KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=1, id=208, version=65501,

count=19, id=241, version=40116,

count=215, id=243, version=40116,

count=41, id=242, version=40116,

count=9, id=199, version=41118,

count=11, id=259, version=26706,

count=39, id=260, version=26706,

count=39, productName=Unmarked objects (old),

count=1, id=264, version=27048,

count=2, id=125, productName=VS2005 build 50727, version=50727,

count=21, id=110, productName=VS2005 build 50727, version=50727,

count=242, id=260, version=27048,

count=154, id=261, version=26706,

count=2, id=206, version=65501,

count=45, id=203, version=65501,

count=585, id=1, productName=Unmarked objects,

count=932, id=260, version=34120,

count=56, id=261, productName=VS2017 v15.7.2 build 26429, version=26429,

count=587, id=261, version=27048,

count=1, id=256, version=27048,

count=1, id=255, version=27048,

count=1, id=258, version=27048,