SiloAI[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SiloAI.zip
Size 20.8MB
Sample261027-mx2dhadt6l
SHA256 7b55a0cce9a65ba19901d1d3e3c4e0137d6e78155977e175f414e3ea002cac02
MD5 2f1dd80ae4c0bb2f73f048167df445db
SHA1 074c7b2d1563e31377765185c4b7fea607c32210
SHA512 13a069f97d33ccdab5ea3568702c502c70f8e15af2b963fd22784e89da6b7d9b1299adedb257694cde84175f33124f27c2173a8ae2938026c00cc052b64efd33
SSDEEP 393216:kvYv6lpE4p8DLPSZnc2DTGse+oMkX9Tv9IjI0NSb/G99VzkE5czx7h9Bb7AHLQhX:kvYylp8vPP2HdHkzF0Mb/GGP1h9BbcHU
TLSH
T11B27339D2244A26DB14CF508424E6005DFBA254ACE2901BDAFEBB6577DEED7831FC0B1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

DLL Hijacking vulnerability 1 IoCs

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.

resource
unpack001/version.dll

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/bin/res.exe
unpack001/bin/tor.exe
unpack001/version.dll

File Explorer

SiloAI.zip

.zip 20.8MB
SiloAI.exe

.exe 4.2MB
bin/geoip

8.9MB
bin/geoip6

16.4MB
bin/res.exe

.exe 11.5MB
bin/tor.exe

.exe 9.7MB
bin/torrc

68B
version.dll

.dll 103KB
vresion.dll

.dll 31KB

SiloAI.zip

SHA256 7b55a0cce9a65ba19901d1d3e3c4e0137d6e78155977e175f414e3ea002cac02
MD5 2f1dd80ae4c0bb2f73f048167df445db
SHA1 074c7b2d1563e31377765185c4b7fea607c32210
SHA512 13a069f97d33ccdab5ea3568702c502c70f8e15af2b963fd22784e89da6b7d9b1299adedb257694cde84175f33124f27c2173a8ae2938026c00cc052b64efd33
SSDEEP 393216:kvYv6lpE4p8DLPSZnc2DTGse+oMkX9Tv9IjI0NSb/G99VzkE5czx7h9Bb7AHLQhX:kvYylp8vPP2HdHkzF0Mb/GGP1h9BbcHU
TLSH
T11B27339D2244A26DB14CF508424E6005DFBA254ACE2901BDAFEBB6577DEED7831FC0B1
MD5 SHA1 SHA512 SSDEEP TLSH

SiloAI.exe

IMPHASH 1aae64d0027b18f2628158cde85b6f4a
SHA256 4dbedc9ed26ca15103eafef15f9b7bdcacaedc61b1e61ef5ce393dbdf4888aba
MD5 98133fa62a46e79226e839ebc4e14d5e
SHA1 e73042b4d75cfcb1ebe42d1014a884a9dbb6f81d
SHA512 d5321c6b764cd69736bf0b42977ef3c38f7d99266fbf0d1decb4af21f8ed6c3aa8bedb5b515c24b78e356106183437b9cc443d061675f69a6ac334f4ee7514b1
SSDEEP 49152:bNuCHZGcaRsw0qJ5Y0Sx/MAKUqR/Db2V9q1BwhC9dc02e7BOZTHkvu:HMRIVI9fFqkvu
TLSH
T170264A0BA7F901F4D0BBD1798AA79517FAB2B859873197DF0290465A0F237E09E3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

1c:b1:6c:34:45:e1:6a:71:79:44:50:d5:50:87:f8:af:a7:a6:0c:61:8f:5a:cc:c7:dd:18:86:9e:05:f3:8f:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

May 15, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Jun 23, 2035

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:02:02:7d:bc:9d:2a:9d:33:07:00:00:00:00:01:02

Issuer

CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Mar 5, 2026 - Mar 3, 2027

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

255904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\dbs\sh\odct\0514_174732_0\client\onedrive\Product\StandaloneUpdater\exe\obj\amd64\OneDriveStandaloneUpdater.pdb

kernel32

WriteFile FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetTempPathW VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetStdHandle GetStringTypeW GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW WriteConsoleW FlsAlloc SetLastError InterlockedPushEntrySList RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader CompareFileTime FindClose FindNextFileW FindFirstFileW GetFileAttributesExW GetStdHandle ReplaceFileW SetDllDirectoryW RemoveDirectoryW Process32NextW OpenProcess Process32FirstW CreateToolhelp32Snapshot LocalFree OpenMutexW FileTimeToSystemTime FileTimeToLocalFileTime GetCurrentProcess IsWow64Process CreateEventW SetEvent GetTickCount64 GetVolumePathNameW Sleep GetCommandLineW GetModuleHandleExW GetProcAddress FreeLibrary CloseHandle GetEnvironmentVariableW InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetModuleFileNameW LeaveCriticalSection DecodePointer EnterCriticalSection RaiseException OutputDebugStringW IsDebuggerPresent RegisterApplicationRestart GetFileInformationByHandleEx OpenFileById GetProcessTimes GetExitCodeProcess CreateProcessW SetProcessShutdownParameters GetSystemTimes ExitProcess IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext EncodePointer FlsFree FlsSetValue SetThreadInformation GetProductInfo VerifyVersionInfoW ReadProcessMemory ExpandEnvironmentStringsW WaitForMultipleObjectsEx DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy GetLastError FreeLibraryAndExitThread ResumeThread ExitThread CreateThread RtlUnwind LoadLibraryExA VirtualQuery InitOnceExecuteOnce TryEnterCriticalSection InitializeCriticalSection HeapCreate GetDiskFreeSpaceW LockFile GetFullPathNameA SetEndOfFile UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA LoadLibraryA DeleteFileA GetSystemInfo HeapCompact UnlockFile CreateFileMappingW MapViewOfFile GetSystemPowerStatus GetNativeSystemInfo GetModuleFileNameA OutputDebugStringA CompareStringEx LCMapStringEx CreateHardLinkW CopyFile2 AreFileApisANSI CreateFile2 GetLocaleInfoEx AcquireSRWLockShared ReleaseSRWLockShared WakeConditionVariable GetExitCodeThread SwitchToThread WaitForSingleObjectEx TryAcquireSRWLockExclusive FormatMessageA GetSystemTimePreciseAsFileTime WritePrivateProfileStringW QueryPerformanceFrequency GetDllDirectoryW ReleaseSRWLockExclusive FlsGetValue DeleteFileW GetSystemTime LocalAlloc CreateDirectoryW GetFullPathNameW GetTempFileNameW SetFileTime CopyFileW MoveFileExW SystemTimeToFileTime LockFileEx UnlockFileEx LoadLibraryW DeviceIoControl WerRegisterFile WerUnregisterFile GetTickCount K32GetModuleFileNameExW WaitForSingleObject ResetEvent WaitForMultipleObjects QueueUserWorkItem CreateMutexW GetVersionExW MoveFileW LCIDToLocaleName GetUserGeoID GetUserDefaultLocaleName GetComputerNameW ReleaseMutex FindFirstVolumeW FindNextVolumeW FindVolumeClose GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFinalPathNameByHandleW GetLongPathNameW SetFileAttributesW SetFileInformationByHandle SetFilePointer GetCompressedFileSizeW FindFirstFileNameW SetHandleInformation CreatePipe CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GlobalAlloc GlobalUnlock GlobalLock GlobalFree ReadDirectoryChangesW CreateSymbolicLinkW CompareStringOrdinal GetProcessIoCounters GetPrivateProfileStringW CreateEventExW

user32

UnregisterSuspendResumeNotification RegisterClassW CreateWindowExW DestroyWindow ShowWindow OpenClipboard CloseClipboard SetClipboardData RegisterClipboardFormatW SendMessageTimeoutW PeekMessageW UnregisterPowerSettingNotification MsgWaitForMultipleObjectsEx SetCursor LoadCursorW PostThreadMessageW DispatchMessageW TranslateMessage GetMessageW GetWindowThreadProcessId GetClassNameW EnumWindows PostMessageW RegisterSuspendResumeNotification PostQuitMessage RegisterPowerSettingNotification SystemParametersInfoW

oleaut32

SysAllocStringLen SysStringLen SysStringByteLen SysAllocStringByteLen VariantInit VariantClear SysAllocString VarBstrCmp LoadTypeLi LoadRegTypeLi GetRecordInfoFromTypeInfo SysFreeString GetErrorInfo SetErrorInfo VariantChangeType

shlwapi

SHDeleteValueW SHDeleteKeyW SHRegGetUSValueW SHGetValueW SHSetValueW PathStripToRootW PathStripPathW PathFindFileNameW SHRegGetValueW SHCreateStreamOnFileEx PathRemoveFileSpecW PathIsDirectoryW PathFileExistsW SHCreateStreamOnFileW SHRegGetPathW SHRegGetBoolUSValueW AssocQueryStringW PathIsDirectoryEmptyW StrStrIW PathIsPrefixW PathIsRelativeW ord219 SHGetValueA

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

userenv

GetDefaultUserProfileDirectoryW GetProfileType CreateEnvironmentBlock

advapi32

RegGetValueW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AdjustTokenPrivileges AllocateAndInitializeSid FreeSid LookupPrivilegeValueW SetEntriesInAclW SetNamedSecurityInfoW ImpersonateLoggedOnUser RevertToSelf RegDeleteValueW RegEnumKeyExW RegEnumValueW RegQueryInfoKeyW RegSetKeyValueW LookupAccountNameW CryptDestroyKey CryptSetHashParam CryptImportKey CreateWellKnownSid DuplicateTokenEx GetAclInformation RegCreateKeyTransactedW RegDeleteKeyExW RegEnumKeyW RegLoadKeyW RegNotifyChangeKeyValue RegUnLoadKeyW RegDeleteTreeW ChangeServiceConfigW ChangeServiceConfig2W CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceConfigW QueryServiceStatus QueryServiceStatusEx RegisterServiceCtrlHandlerW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW GetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW SetFileSecurityW CreateProcessWithTokenW CreateProcessAsUserW RegGetValueA ConvertSidToStringSidW GetTokenInformation OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW GetUserNameW EventWriteTransfer EventUnregister EventRegister

shell32

SHCreateDirectoryExW ShellExecuteExW SHAssocEnumHandlers SHGetFolderPathW SHGetKnownFolderPath SHLoadNonloadedIconOverlayIdentifiers SHFileOperationW SHGetFolderPathAndSubDirW SHSetKnownFolderPath ord526 SHGetSpecialFolderPathW CommandLineToArgvW SHCreateItemFromParsingName SHParseDisplayName SHChangeNotify SHGetPropertyStoreFromParsingName

ole32

CoSetProxyBlanket CoCreateFreeThreadedMarshaler CoWaitForMultipleHandles CoInitialize CoTaskMemAlloc CreateBindCtx CoCreateInstance CoTaskMemFree CoInitializeEx CoCreateGuid CreateItemMoniker GetRunningObjectTable CLSIDFromString StringFromGUID2 StringFromCLSID CoUninitialize

winhttp

WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpSetOption WinHttpSetCredentials WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser

ntdll

VerSetConditionMask

rstrtmgr

RmGetList RmRegisterResources RmEndSession RmStartSession

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrustEx

wtsapi32

WTSEnumerateSessionsW WTSQuerySessionInformationW WTSFreeMemory WTSQueryUserToken

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGenRandom BCryptCloseAlgorithmProvider

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetEnhancedKeyUsage CryptBinaryToStringW CryptStringToBinaryW CertFindExtension

rpcrt4

UuidToStringW UuidCreate RpcStringFreeW RpcBindingVectorFree RpcExceptionFilter RpcBindingFree RpcBindingFromStringBindingW RpcStringBindingComposeW RpcServerInqBindings RpcServerRegisterIfEx RpcServerUnregisterIf RpcServerUseProtseqW RpcBindingSetAuthInfoExW RpcEpRegisterW RpcEpUnregister RpcServerInqCallAttributesW

secur32

GetUserNameExW

urlmon

URLOpenStreamW

wininet

InternetConnectA InternetReadFile InternetCheckConnectionW InternetCloseHandle InternetOpenW InternetCrackUrlA InternetSetStatusCallbackW HttpOpenRequestA HttpAddRequestHeadersA HttpSendRequestW HttpQueryInfoA InternetQueryOptionW

ws2_32

closesocket htonl bind listen send htons WSAGetLastError WSAStartup setsockopt socket accept

iphlpapi

GetAdaptersInfo

?$TSS0@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4HA ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventDispatcher@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventListener@Events@Applications@Microsoft@@QEAA@XZ ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0DebugEventSource@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@E@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@5@@Z ??0EventProperties@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@NV?$allocator@N@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEAV?$vector@_JV?$allocator@_J@std@@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@CW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@EW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@FW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@GW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@HW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@IW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@NW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@PEBDW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@UGUID_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@Utime_ticks_t@123@W4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ ??0EventProperty@Events@Applications@Microsoft@@QEAA@_JW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_KW4PiiKind@123@W4DataCategory@123@@Z ??0EventProperty@Events@Applications@Microsoft@@QEAA@_NW4PiiKind@123@W4DataCategory@123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@HHHAEBV?$initializer_list@E@std@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@PEBD@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@QEBE_N@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z ??0GUID_t@Events@Applications@Microsoft@@QEAA@XZ ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IAuthTokensController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@AEBV?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@std@@@Z ??0ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??0ILogController@Events@Applications@Microsoft@@QEAA@$$QEAV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogController@Events@Applications@Microsoft@@QEAA@XZ ??0ILogManager@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogManager@Events@Applications@Microsoft@@QEAA@XZ ??0ILogger@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ILogger@Events@Applications@Microsoft@@QEAA@XZ ??0IModule@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0IModule@Events@Applications@Microsoft@@QEAA@XZ ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@AEBV0123@@Z ??0ISemanticContext@Events@Applications@Microsoft@@QEAA@XZ ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@$$QEAU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@PEB_J@Z ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@XZ ??0time_ticks_t@Events@Applications@Microsoft@@QEAA@_K@Z ??1DebugEventDispatcher@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventListener@Events@Applications@Microsoft@@UEAA@XZ ??1DebugEventSource@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ ??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ ??1IAuthTokensController@Events@Applications@Microsoft@@UEAA@XZ ??1ILogConfiguration@Events@Applications@Microsoft@@QEAA@XZ ??1ILogManager@Events@Applications@Microsoft@@UEAA@XZ ??1ILogger@Events@Applications@Microsoft@@UEAA@XZ ??1IModule@Events@Applications@Microsoft@@UEAA@XZ ??1ISemanticContext@Events@Applications@Microsoft@@UEAA@XZ ??1LogConfiguration@Telemetry@Applications@Microsoft@@QEAA@XZ ??4DebugEventDispatcher@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventListener@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4DebugEventSource@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??4EventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@V?$initializer_list@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@NV?$allocator@N@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$vector@_JV?$allocator@_J@std@@@std@@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@C@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@E@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@F@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@G@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@Utime_ticks_t@123@@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_K@Z ??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z ??4GUID_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4IAuthTokensController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4ILogController@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogManager@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ILogger@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4IModule@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4ISemanticContext@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@$$QEAU0123@@Z ??4LogConfiguration@Telemetry@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@$$QEAV0123@@Z ??4LogManagerProvider@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV0123@@Z ??4time_ticks_t@Events@Applications@Microsoft@@QEAAAEAU0123@AEBU0123@@Z ??8EventProperty@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??8GUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??AILogConfiguration@Events@Applications@Microsoft@@QEAAAEAVVariant@123@PEBD@Z ??DILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@XZ ??MGUID_t@Events@Applications@Microsoft@@QEBA_NAEBU0123@@Z ??YEventProperties@Events@Applications@Microsoft@@QEAAAEAV0123@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@@Z ??_7DebugEventDispatcher@Events@Applications@Microsoft@@6B@ ??_7DebugEventListener@Events@Applications@Microsoft@@6B@ ??_7DebugEventSource@Events@Applications@Microsoft@@6B@ ??_7EventProperties@Events@Applications@Microsoft@@6B@ ??_7EventProperty@Events@Applications@Microsoft@@6B@ ??_7IAuthTokensController@Events@Applications@Microsoft@@6B@ ??_7ILogController@Events@Applications@Microsoft@@6B@ ??_7ILogManager@Events@Applications@Microsoft@@6BDebugEventDispatcher@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BIContextProvider@123@@ ??_7ILogManager@Events@Applications@Microsoft@@6BILogController@123@@ ??_7ILogger@Events@Applications@Microsoft@@6B@ ??_7IModule@Events@Applications@Microsoft@@6B@ ??_7ISemanticContext@Events@Applications@Microsoft@@6B@ ?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?AddModule@ILogConfiguration@Events@Applications@Microsoft@@QEAAXPEBDAEBV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@@Z ?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?ClearExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXXZ ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBDAEAW4status_t@234@_K@Z ?CreateLogManager@LogManagerProvider@Events@Applications@Microsoft@@SAPEAVILogManager@234@PEBD_NAEAVILogConfiguration@234@AEAW4status_t@234@_K@Z ?DecrementActiveHydrationsCount@QoS@@YAXXZ ?DestroyLogManager@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z ?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z ?DispatchEventBroadcast@ILogManager@Events@Applications@Microsoft@@SA_NVDebugEvent@234@@Z ?FromJSON@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@PEBD@Z ?FromLogConfiguration@Events@Applications@Microsoft@@YA?AVILogConfiguration@123@AEAULogConfiguration@Telemetry@23@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAVILogConfiguration@234@AEAW4status_t@234@@Z ?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@PEBDAEAW4status_t@234@@Z ?GetActiveHydrationsCount@QoS@@YAIXZ ?GetApplicationPropertyId@QoS@@YA?AW4Id@PropertyId@TelemetryConstants@@XZ ?GetDefaultConfiguration@Events@Applications@Microsoft@@YAAEBVILogConfiguration@123@XZ ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JI@Z ?GetErrorType@QoS@@YA?AW4Type@ErrorType@TelemetryConstants@@JIAEBV?$set@IU?$less@I@std@@V?$allocator@I@2@@std@@@Z ?GetInstance@Telemetry@@CAPEAV1@XZ ?GetLatency@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventLatency@234@XZ ?GetLogObfuscationKeyManger@@YAJPEAPEAVILogObfuscationKeyManager@@@Z ?GetLogObfuscatorAes@@YAJPEAPEAVILogObfuscatorAes@@@Z ?GetModule@ILogConfiguration@Events@Applications@Microsoft@@QEAA?AV?$shared_ptr@VIModule@Events@Applications@Microsoft@@@std@@PEBD@Z ?GetModules@ILogConfiguration@Events@Applications@Microsoft@@QEAAAEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$shared_ptr@VIModule@Events@Applications@Microsoft@@@2@@std@@@2@@std@@XZ ?GetName@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetPersistence@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPersistence@234@XZ ?GetPiiProperties@EventProperties@Events@Applications@Microsoft@@QEBA?BV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@U?$pair@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@Events@Applications@Microsoft@@@2@@std@@@2@@std@@W4DataCategory@234@@Z ?GetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEBA_KXZ ?GetPopSample@EventProperties@Events@Applications@Microsoft@@QEBANXZ ?GetPriority@EventProperties@Events@Applications@Microsoft@@QEBA?AW4EventPriority@234@XZ ?GetProperties@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@Events@Applications@Microsoft@@@std@@@2@@std@@W4DataCategory@234@@Z ?GetResultType@QoS@@YAPEB_WJI@Z ?GetResultType@QoS@@YAPEB_WW4Type@ErrorType@TelemetryConstants@@@Z ?GetTimestamp@EventProperties@Events@Applications@Microsoft@@QEBA_JXZ ?GetType@EventProperties@Events@Applications@Microsoft@@QEBAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?HasConfig@ILogConfiguration@Events@Applications@Microsoft@@QEAA_NPEBD@Z ?Hash@GUID_t@Events@Applications@Microsoft@@QEBA_KXZ ?IncrementActiveHydrationsCount@QoS@@YAXXZ ?Initialize@IModule@Events@Applications@Microsoft@@UEAAXPEAVILogManager@234@@Z ?InsertIntoIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?IsAnyLibraryIrmEnabled@QoS@@YA_NXZ ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAVILogConfiguration@234@@Z ?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@PEBD@Z ?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z ?RemoveFromIrmEnabledLibrarySet@QoS@@YAXAEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z ?SetAppEnv@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentETag@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppExperimentImpressionId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetAppVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetApplicationId@QoS@@YAXI@Z ?SetCommercialId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetCommonField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetCustomField@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBUEventProperty@234@@Z ?SetDeviceClass@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceMake@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceModel@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetDeviceOrgId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetEventExperimentIds@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z ?SetLatency@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventLatency@234@@Z ?SetLevel@EventProperties@Events@Applications@Microsoft@@QEAAXE@Z ?SetName@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkCost@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkCost@234@@Z ?SetNetworkProvider@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetNetworkType@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4NetworkType@234@@Z ?SetOsBuild@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsName@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetOsVersion@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetPersistence@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPersistence@234@@Z ?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z ?SetPopsample@EventProperties@Events@Applications@Microsoft@@QEAAXN@Z ?SetPriority@EventProperties@Events@Applications@Microsoft@@QEAAXW4EventPriority@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@NV?$allocator@N@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@UGUID_t@Events@Applications@Microsoft@@V?$allocator@UGUID_t@Events@Applications@Microsoft@@@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEAV?$vector@_JV?$allocator@_J@std@@@6@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@EW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@FW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@GW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@NW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PEBDW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UGUID_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@Utime_ticks_t@234@W4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_KW4PiiKind@234@W4DataCategory@234@@Z ?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_NW4PiiKind@234@W4DataCategory@234@@Z ?SetTicket@ISemanticContext@Events@Applications@Microsoft@@UEAAXW4TicketType@234@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetTimestamp@EventProperties@Events@Applications@Microsoft@@QEAAX_J@Z ?SetType@EventProperties@Events@Applications@Microsoft@@QEAA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserANID@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserAdvertisingId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4PiiKind@234@@Z ?SetUserLanguage@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserMsaId@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SetUserTimeZone@ISemanticContext@Events@Applications@Microsoft@@UEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z ?SizeUnknown@QoS@@YAIXZ ?Teardown@IModule@Events@Applications@Microsoft@@UEAAXXZ ?TryGetLevel@EventProperties@Events@Applications@Microsoft@@QEBA?AV?$tuple@_NE@std@@XZ ?clear@EventProperty@Events@Applications@Microsoft@@QEAAXXZ ?convertUintVectorToGUID@GUID_t@Events@Applications@Microsoft@@SA?AU_GUID@@AEBV?$vector@EV?$allocator@E@std@@@std@@@Z ?copydata@EventProperty@Events@Applications@Microsoft@@AEAAXPEBU1234@@Z ?empty@EventProperty@Events@Applications@Microsoft@@QEAA_NXZ ?erase@EventProperties@Events@Applications@Microsoft@@QEAA_KAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4DataCategory@234@@Z ?lock@?1??stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ@4V67@A ?pack@EventProperties@Events@Applications@Microsoft@@QEAAPEAUevt_prop@@XZ ?stateLock@DebugEventSource@Events@Applications@Microsoft@@KAAEAVrecursive_mutex@std@@XZ ?to_bytes@GUID_t@Events@Applications@Microsoft@@QEBAXAEAY0BA@E@Z ?to_string@EventProperty@Events@Applications@Microsoft@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?to_string@GUID_t@Events@Applications@Microsoft@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?type_name@EventProperty@Events@Applications@Microsoft@@SAPEBDI@Z ?unpack@EventProperties@Events@Applications@Microsoft@@QEAA_NPEAUevt_prop@@_K@Z evt_api_call_default

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

963KB

Virtual Size

963KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

125KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/res.exe

IMPHASH 664195c1e265daf2f6b5b2237342eb3d
SHA256 c5002ed4869d998b79b13c8365af9d7403f80d7218ad34f429f94fc662e33ebd
MD5 fc1cca30ac645ec586a3388e7588bbe8
SHA1 9543a7c56f7cb8421e44a97bd12ff51c81494b58
SHA512 7272dafc9a53cd085119485bf6fa7eddd2b688730dc935d54404eaec140ba99751337943c78d7f06048c1c67284e8c62f17649570abbeb52d4c184b8193aa8e0
SSDEEP 196608:ZCRGPtteP9cYhgeErOpTyDpU++iJ2BkXyuOR99g39riNOce05OPecbOhdd+zg9ZR:HD23fEqpTuU++iKkXH339mNOcvOP32z1
TLSH
T1F7C63305F29655BFD09BE43482524126FB36B4420B3187DF17A58A622EAF7F81F7E321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

190468

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoUninitialize CoCreateInstance CoInitializeSecurity CoInitializeEx

shell32

SHGetFolderPathW

advapi32

RegGetValueW RegOpenKeyExW RegQueryValueExA RegSetValueExW FreeSid CheckTokenMembership AllocateAndInitializeSid OpenProcessToken GetTokenInformation LookupPrivilegeValueA AdjustTokenPrivileges RegCloseKey RegEnumKeyExW

shlwapi

PathFileExistsW

user32

GetDC ReleaseDC

gdi32

GetDeviceCaps

setupapi

SetupDiGetClassDevsW SetupDiEnumDeviceInfo SetupDiGetDevicePropertyW SetupDiGetDeviceRegistryPropertyA SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiGetDeviceRegistryPropertyW SetupDiDestroyDeviceInfoList

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

kernel32

FlushFileBuffers GetConsoleOutputCP CreateFileW SetFilePointerEx SetStdHandle WriteConsoleW WaitForSingleObjectEx GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ExitProcess CloseHandle GetLastError LocalFree LocalAlloc IsNativeVhdBoot GetModuleHandleA BuildCommDCBAndTimeoutsA EnumSystemFirmwareTables GetSystemFirmwareTable GetNativeSystemInfo SetThreadAffinityMask GetComputerNameA GetModuleHandleW VirtualQuery WideCharToMultiByte IsWow64Process2 GetProcessAffinityMask GetLogicalProcessorInformationEx GetThreadPriority GetPriorityClass SetPriorityClass SetThreadPriority SetThreadPriorityBoost SleepEx VirtualLock VirtualUnlock GetModuleFileNameW CreateDirectoryW MoveFileW DeleteFileW FindFirstFileW FindNextFileW CopyFileW FindClose CreateProcessW AddVectoredExceptionHandler GetModuleFileNameA ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess TerminateProcess GetExitCodeThread TryAcquireSRWLockExclusive EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection MultiByteToWideChar LCMapStringEx GetProcAddress GetStringTypeW GetCPInfo VirtualProtect HeapSize RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile HeapAlloc HeapReAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetConsoleMode

ntdll

RtlPcToFileHeader RtlUnwindEx

Name

.text

Size

328KB

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10.9MB

Virtual Size

10.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

bin/tor.exe

IMPHASH f8460819d7079d12bc2b1a7376e2b969
SHA256 1e02f3d7074d82d9ce76ea3dcf9a9d6fcc68f25745888c47e7eee88fd6b67cb9
MD5 b2f54a49b7a61bff64524bfde6d00aa1
SHA1 dad989043566a412f0c53bdee0c46bf40ad43b40
SHA512 e373bde75946c835a5f8f436ebcbb8b53379e48eed995592fbb5468a789d70ce0db6b085a5063159256e4038ce309df780ccd0cc73d9f9ee1ff8fb0cf4f89557
SSDEEP 98304:r/iXVtCslXFszsJ4IZRK0ex92eH9XwNa5y1AXgLwe7jpxTI2PC+h:ziTJ+Xh9XCaE1AX04
TLSH
T1F1A61947F27710DDC5BAC07892177223F9A13C8C81346B6B599097A22B74B68AF7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4992

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove strchr strrchr strstr wcsstr

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _chsize _close _fileno _get_osfhandle _getcwd _locking _lseek _lseeki64 _open _read _setmode _wfopen _write fclose feof ferror fflush fgetc fgets fopen fputc fputs fread fseek ftell fwrite getc puts ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthread _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthread _endthreadex _errno _exit _getpid _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit raise signal strerror

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _strnicmp isdigit isspace isxdigit mbrlen memset strcat strcmp strcpy strcspn strlen strncmp strncpy strnlen strpbrk strspn tolower wcscpy wcslen wcsnlen

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared CloseHandle ConvertFiberToThread ConvertThreadToFiberEx CreateFiberEx CreateFileA CreateFileMappingA CreateIoCompletionPort CreateNamedPipeA CreateProcessA CreateSemaphoreA CreateWaitableTimerA DeleteCriticalSection DeleteFiber EnterCriticalSection FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileSize GetFileType GetLastError GetModuleFileNameA GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetQueuedCompletionStatus GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GlobalMemoryStatusEx HeapSetInformation InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSRWLock IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalAlloc LocalFree MapViewOfFile MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleA ReadConsoleW ReadFileEx ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetHandleInformation SetLastError SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx SwitchToFiber SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteFileEx

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASetLastError WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getpeername getprotobynumber getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen ceil exp expm1 floor frexp llround log log1p lround pow

api-ms-win-crt-utility-l1-1-0

qsort rand_s

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-time-l1-1-0

_gmtime64 _gmtime64_s _localtime64 _mktime64 _time64 _utime64 strftime

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc strtol strtoll strtoul strtoull wcrtomb wcstombs

shell32

SHGetMalloc SHGetPathFromIDListA SHGetSpecialFolderLocation SHGetSpecialFolderPathA

api-ms-win-crt-filesystem-l1-1-0

_fstat64 _fullpath _lock_file _mkdir _stat64 _stat64i32 _unlink _unlock_file rename

shlwapi

PathMatchSpecA

advapi32

CryptAcquireContextA CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource RegCloseKey RegOpenKeyExA RegQueryValueExA RegisterEventSourceW ReportEventW

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-conio-l1-1-0

_getwch _putch

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenSystemStoreW

Name

.text

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

78KB

Virtual Size

118KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

version.dll

IMPHASH f167901fa38229daa94949b3c3fbc0f5
SHA256 d98e929adc6dea5d76b64b956d02dc7a6563f03a0e09f0e7e6c164045ad3a02b
MD5 99d65e11667d108e4482bfd0fe153156
SHA1 654aa6116b7f6272079c3893687a083c27e0eedc
SHA512 44efbb5d4c2143dfa6db1dd0ae9c4ecd78a6c983b5eeec0b01e635fa7c753931ad976335a725f06790811c4d9a010b4950477d7a0bd1a90da78d77f17da64677
SSDEEP 3072:ywte5xrBGJTsmCWW2vv0vkqbpqps7FhNkr25AcokBVbPFxEIOiHTC3iIMw:yD5xVG1Wl230cqkdV
TLSH
T16FA34A5B62E600BBE17A9278C4A70E05D772BC4507A0AFEF43A0065A6F277D14D39F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

DLL Hijacking vulnerability

Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

shell32

ShellExecuteExW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

kernel32

WriteConsoleW HeapFree DisableThreadLibraryCalls CreateThread CloseHandle GetModuleFileNameW CreateProcessW ExitProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CreateFileW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetCurrentProcess TerminateProcess GetModuleHandleExW HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vresion.dll

IMPHASH 34340c2c4e9aa6ef6ad12bb695fc695b
SHA256 af45a728552ccfdcd9435c40ace60a9354d7c1b52abf507a2f1cb371dada4fde
MD5 ee901ff4ad552d0f8dc8fd5837ace5ab
SHA1 699cf845d7320c0a7c1407dbf8f73c9fdfb5c754
SHA512 a7f9bcfe7dfa74067fab32e313fa74e18c4ef10f6bc40a369f0a13c4fe96d2bb7bc7c25ed7e5f1f80cae7ecce2d18215388420d7ee4be23d7280f06a49e9c370
SSDEEP 768:MrAO9JmckVPxIiTAqMwYyO2ulzxAHjo1PU/C9zJ3V:MrnJmckVPxIiTAqMwg2ulzxAHjwPU/e3
TLSH
T19BE26B4DA7693195F5A766B88195E207A53073321320A5FF4BE1C5790D233C4AE38FEE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Digest

19:16:e3:15:08:26:76:2c:0f:f7:a8:02:a5:89:2f:9a:2d:67:94:13:77:83:fb:89:f5:db:d6:1b:ae:c3:86:1a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Oct 20, 2023

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 3, 2023 - Feb 1, 2024

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:07:76:56:00:00:00:00:00:08

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Oct 19, 2011 - Oct 19, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:D082-4BFD-EEBA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:ba:1f:3f:19:f7:c1:75:bd:7c:00:01:00:00:01:ba

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 20, 2022 - Dec 14, 2023

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

5008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

version.pdb

msvcrt

__C_specific_handler _initterm malloc free _amsg_exit _XcptFilter _vsnwprintf _vsnprintf memcmp

api-ms-win-core-errorhandling-l1-1-0

SetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError

api-ms-win-core-version-l1-1-0

VerQueryValueW VerFindFileW GetFileVersionInfoExW GetFileVersionInfoSizeExW

api-ms-win-core-localization-l1-2-0

IsDBCSLeadByte

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW GetFileVersionInfoSizeW

api-ms-win-core-file-l1-1-0

CreateFileW DeleteFileA GetFileSize DeleteFileW GetFullPathNameA SetFileTime GetFileTime GetFileAttributesW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

TlsFree GetCurrentProcessId GetCurrentThreadId TlsSetValue TerminateProcess TlsAlloc TlsGetValue GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-versionansi-l1-1-0

GetFileVersionInfoExA VerFindFileA GetFileVersionInfoSizeExA VerQueryValueA

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoSizeA GetFileVersionInfoA

api-ms-win-core-version-private-l1-1-0

GetFileVersionInfoByHandle

kernelbase

lstrcmpiA lstrcmpiW lstrlenW

ntdll

RtlAllocateHeap RtlFreeUnicodeString RtlAnsiStringToUnicodeString RtlInitAnsiString RtlUnicodeStringToAnsiString NlsMbCodePageTag

kernel32

_lwrite _lread _lopen _lclose _lcreat _llseek LZCreateFileW LZCloseFile LZInit LZCopy LZClose MoveFileW

Sharing

General

Malware Config

Signatures

File Explorer

SiloAI.zip

SiloAI.exe

kernel32

user32

oleaut32

shlwapi

version

userenv

advapi32

shell32

ole32

winhttp

ntdll

rstrtmgr

wintrust

wtsapi32

bcrypt

crypt32

rpcrt4

secur32

urlmon

wininet

ws2_32

iphlpapi

generic

bin/geoip

bin/geoip6

bin/res.exe

ole32

shell32

advapi32

shlwapi

user32

gdi32

setupapi

oleaut32

kernel32

ntdll

generic

bin/tor.exe

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

ws2_32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

shell32

api-ms-win-crt-filesystem-l1-1-0

shlwapi

advapi32

iphlpapi

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

user32

crypt32

generic

bin/torrc

version.dll

shell32

advapi32

kernel32

generic

vresion.dll

msvcrt

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-file-l1-1-0