d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc

Sharing

Copy URL Twitter E-mail

General

Target
d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc
Size 9.3MB
Sample261027-tykkpsft4q
SHA256 d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc
MD5 8264dac43a206e487932933555a9bdee
SHA1 c03fdb123ff9d2330ec799c5c3da88bbf747f7bd
SHA512 d48ca515af41a7247d68f52639c9c14d5e008df8d47410fddf334a9671004ec36d9b612afcb8f053743595874422a8ed6961585de01fddadae097d47038eed20
SSDEEP 196608:sfYcLfGR1AXF4XLjsvgDxJZBQq9cgyjZonmdynAnPxS/j26onMpEjJh2o:swyfGR1UF4XLjsYDDZGq9Tyt3gAnJSrY
TLSH
T12FA63384B8F4C3FFC77A423EC6E796846B6AD53298FD95961A000D58BE1EAC0D04F476
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
static1/unpack001/CrossDesk.exe	embeds_openssl

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsProcess.dll
unpack001/CrossDesk.exe
unpack001/crossdesk_privacy_cursor_helper.exe
unpack001/crossdesk_privacy_window.dll
unpack001/crossdesk_service.exe
unpack001/crossdesk_session_helper.exe
unpack001/usbmmidd_v2/Win32/usbmmIdd.dll
unpack001/usbmmidd_v2/deviceinstaller.exe
unpack001/usbmmidd_v2/deviceinstaller64.exe
unpack001/usbmmidd_v2/x64/usbmmIdd.dll
unpack001/wgc_plugin.dll

File Explorer

d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc

.exe 9.3MB
$PLUGINSDIR/InstallOptions.dll

.dll 15KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/ioSpecial.ini

211B
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsProcess.dll

.dll 4KB
CrossDesk.exe

.exe 33.9MB
crossdesk_privacy_cursor_helper.exe

.exe 115KB
crossdesk_privacy_window.dll

.dll 225KB
crossdesk_service.exe

.exe 717KB
crossdesk_session_helper.exe

.exe 780KB
usbmmidd_v2/License.txt

999B
usbmmidd_v2/Win32/usbmmIdd.dll

.dll 60KB
usbmmidd_v2/deviceinstaller.exe

.exe 139KB
usbmmidd_v2/deviceinstaller64.exe

.exe 158KB
usbmmidd_v2/idd_instructions.txt

2KB
usbmmidd_v2/usbmmIdd.inf

5KB
usbmmidd_v2/usbmmidd.bat

306B
usbmmidd_v2/usbmmidd.cat

11KB
usbmmidd_v2/x64/usbmmIdd.dll

.dll 69KB
wgc_plugin.dll

.dll 574KB

d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc
MD5 8264dac43a206e487932933555a9bdee
SHA1 c03fdb123ff9d2330ec799c5c3da88bbf747f7bd
SHA512 d48ca515af41a7247d68f52639c9c14d5e008df8d47410fddf334a9671004ec36d9b612afcb8f053743595874422a8ed6961585de01fddadae097d47038eed20
SSDEEP 196608:sfYcLfGR1AXF4XLjsvgDxJZBQq9cgyjZonmdynAnPxS/j26onMpEjJh2o:swyfGR1UF4XLjsYDDZGq9Tyt3gAnJSrY
TLSH
T12FA63384B8F4C3FFC77A423EC6E796846B6AD53298FD95961A000D58BE1EAC0D04F476
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 89dd7d646278d8bfc41d5446bdc348b9a9afaa832abf02c1396272bb7ac7262a
MD5 d1eefb07abc2577dfb92eb2e95a975e4
SHA1 0584c2b1807bc3bd10d4b60d2d23eeb0e6832ca2
SHA512 eaffd9940b1df59e95e2adb79b3b6415fff5bf196ebea5fe625a6c52e552a00b44d985a36a8dd9eb33eba2425ffea4244ed07a75d87284ff51ec9f9a5e1ac65e
SSDEEP 192:E6GQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT311929WtshLAzgSrX8:E6Nt+4t7uJalUnGesY7Lt8nC3/Yosa
TLSH
T186624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4678565805D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsProcess.dll

IMPHASH 439074d1c01f7b16781bdf060930814a
SHA256 30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
MD5 f0438a894f3a7e01a4aae8d1b5dd0289
SHA1 b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA512 f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
SSDEEP 48:Sz4joMeH+Iwdf8Rom/L+rOnnk5/OCnXeAdbdOAa4GPI+CJ87eILzlq7gthwIsEQW:64c/eFdfS/SSnkxNa4G+ueqPuCtGsj
TLSH
T11191D87597D804B1C197093276620A672FBD843603A7651FE7836E962ED0EFBE874321
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

CrossDesk.exe

IMPHASH 0baa2fa606acaaf768b83842aff1fbd9
SHA256 cfcbd2c280153775e275c7db0833493d038150b93a56547810ea1b344427ea3a
MD5 d83d5b377d27e81c568cd23f5f8591c6
SHA1 dd23cf64575087cd5185ea62b7c0d2e1a17ab09c
SHA512 0d0a818cc1963e530c300cdb349fae4a2841f38c5c7bfa08e1b7a8672e857f1fd3b39c537c3b07b6d6d9130f498711ebf07f9e6d9ed2d1a2f3cd212fa16928b4
SSDEEP 393216:QDY7kDfbs0ZNnR458D3Q5mqcR7GKLP3u2/h8yTgzx7JzyesMvgyr4/K85EEbgnF9:4DG4xwb3
TLSH
T1AA77BE0AB2A30CA5F776C074C6A74613E771743913721BDB1A9487662F6FAF01B7AB40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Embeds OpenSSL

Embeds OpenSSL, may be used to circumvent TLS interception.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19414156

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

opengl32

glScissor glIsEnabled glGetString glGetFloatv glGetError glGetBooleanv glFinish glEnable glDrawArrays glDisable glViewport glClearColor glClear wglGetProcAddress glTexSubImage2D glTexParameteri glTexImage2D glPixelStorei glGetIntegerv glGenTextures glDeleteTextures glBindTexture glColorMask

slint_cpp

slint_get_ContextMenuVTable slint_get_OpacityVTable slint_get_TransformVTable slint_get_BoxShadowVTable slint_get_ClipVTable slint_get_TextInputVTable slint_get_WindowItemVTable slint_get_PathVTable slint_get_ComplexTextVTable slint_get_StyledTextItemVTable slint_get_SimpleTextVTable slint_get_FlickableVTable slint_get_KeyBindingVTable slint_get_FocusScopeVTable slint_windowrc_set_rendering_notifier slint_string_character_count slint_maybe_key_binding_list_init slint_maybe_key_binding_list_free slint_solve_box_layout slint_get_TouchAreaVTable slint_box_layout_info slint_box_layout_info_ortho slint_menus_create_wrapper slint_repeater_ensure_updated slint_translate slint_windowrc_drop slint_windowrc_clone slint_windowrc_ensure_tree_instantiated slint_windowrc_show slint_windowrc_hide slint_windowrc_is_visible slint_windowrc_get_scale_factor slint_windowrc_set_focus_item slint_windowrc_set_component slint_windowrc_show_popup slint_windowrc_create_child_window_adapter slint_windowrc_close_popup slint_windowrc_on_close_requested slint_windowrc_request_redraw slint_cpp_text_item_fontmetrics slint_textinput_paste slint_textinput_copy slint_textinput_cut slint_textinput_clear_selection slint_textinput_select_all slint_textinput_set_selection_offsets slint_flickable_data_free slint_flickable_data_init slint_item_absolute_position slint_register_font_from_data slint_contextmenu_close slint_visit_item_tree slint_unregister_item_tree slint_register_item_tree slint_timer_interval slint_timer_running slint_timer_restart slint_windowrc_take_snapshot slint_timer_destroy slint_timer_start slint_brush_compare_equal slint_new_path_events slint_callback_drop slint_callback_set_handler slint_callback_call slint_callback_init slint_animation_tick slint_change_tracker_init slint_change_tracker_drop slint_change_tracker_construct slint_property_set_animated_binding_brush slint_property_set_animated_binding_float slint_property_set_animated_value_float slint_property_drop slint_property_set_constant slint_property_mark_dirty slint_property_is_dirty slint_property_set_binding_internal slint_property_set_binding slint_property_set_changed slint_property_register_as_dependency slint_property_update slint_property_init slint_keys_to_string slint_data_transfer_plain_text slint_data_transfer_has_plain_text slint_data_transfer_clone slint_data_transfer_drop slint_image_compare_equal slint_image_size slint_image_load_from_embedded_data slint_color_to_oklch slint_color_from_oklch slint_shared_vector_empty slint_shared_vector_free slint_shared_vector_allocate slint_styled_text_from_markdown slint_styled_text_from_plain_text slint_styled_text_clone slint_styled_text_eq slint_styled_text_drop slint_styled_text_new slint_shared_string_append slint_shared_string_from_number slint_shared_string_from_bytes slint_shared_string_clone slint_shared_string_drop slint_shared_string_bytes slint_windowrc_position slint_windowrc_set_physical_position slint_windowrc_size slint_windowrc_set_logical_size slint_windowrc_show_native_popup_menu slint_windowrc_is_fullscreen slint_windowrc_is_maximized slint_windowrc_set_fullscreen slint_windowrc_set_minimized slint_windowrc_set_maximized slint_windowrc_hwnd_win32 slint_get_EmptyVTable slint_get_RectangleVTable slint_get_BasicBorderRectangleVTable slint_get_DropAreaVTable slint_quit_event_loop slint_run_event_loop slint_ensure_backend slint_windowrc_init slint_context_color_scheme slint_context_accent_color slint_timer_stop slint_contextmenu_is_open slint_get_MenuItemVTable slint_get_ImageItemVTable slint_get_ClippedImageVTable

advapi32

CryptSetHashParam CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt RegSetValueExA RegQueryValueExA RegOpenKeyExA RegDeleteValueA SetSecurityInfo GetSecurityInfo SetEntriesInAclW StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CreateWellKnownSid OpenProcessToken RegEnumKeyExW RegEnumValueW RegNotifyChangeKeyValue GetFileSecurityW GetSecurityDescriptorGroup GetSecurityDescriptorOwner LookupAccountSidW RegQueryInfoKeyW RegLoadMUIStringW GetCurrentHwProfileW CopySid GetLengthSid GetTokenInformation IsValidSid ConvertSidToStringSidW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey CryptExportKey CryptGetProvParam CryptGetUserKey CryptEnumProvidersW

crypt32

CertFindCertificateInStore CertCloseStore CertGetCertificateContextProperty CertEnumCertificatesInStore CertOpenStore CertOpenSystemStoreW CertFreeCertificateContext CertDuplicateCertificateContext

shell32

SHFileOperationW SHGetPathFromIDListW SHGetDesktopFolder SHBindToParent CommandLineToArgvW SHQueryUserNotificationState SHGetKnownFolderPath Shell_NotifyIconW SHBrowseForFolderW ShellExecuteW DragAcceptFiles SHGetFolderPathW DragFinish DragQueryFileW

dwmapi

DwmIsCompositionEnabled DwmGetWindowAttribute

user32

EnumDisplaySettingsExW ChangeDisplaySettingsExW DisplayConfigGetDeviceInfo QueryDisplayConfig GetDisplayConfigBufferSizes EnumDisplayMonitors ReleaseDC GetDC GetMonitorInfoW MonitorFromPoint EnumDisplayDevicesW GetIconInfo DrawIconEx GetDpiForWindow DestroyIcon GetSystemMetricsForDpi SendMessageW GetCursorPos SetForegroundWindow SetMenuInfo TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW MapVirtualKeyW LockWorkStation GetRawInputDeviceList GetCursorInfo LoadCursorW GetSystemMetrics LoadImageW LoadIconW SetWindowLongPtrW RegisterRawInputDevices GetProcessWindowStation OpenDesktopW SetThreadDesktop GetWindowLongPtrW GetForegroundWindow SetWindowPos GetUserObjectInformationW CloseDesktop OpenInputDesktop UnregisterClassA CreateWindowExA OpenClipboard TranslateMessage DispatchMessageW PeekMessageW RegisterHotKey UnregisterHotKey UnregisterClassW RegisterClassExW GetLayeredWindowAttributes GetWindowDisplayAffinity IsWindowVisible CloseClipboard SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable SendMessageA WaitForInputIdle GetWindowTextW MessageBoxW IsIconic EnumWindows GetClassNameW IsWindow MsgWaitForMultipleObjectsEx GetQueueStatus CreateIconFromResource SetParent SetWindowLongW PtInRect ClipCursor GetClipCursor GetWindowTextLengthW SetWindowTextW RemovePropW SetPropW SetActiveWindow EnableWindow GetFocus GetClipboardFormatNameA RegisterClipboardFormatW FlashWindowEx SetLayeredWindowAttributes AttachThreadInput CreateIconIndirect DestroyCursor SetCursorPos ReleaseCapture SetCapture EnumDisplaySettingsW ToUnicode GetKeyboardState GetKeyboardLayout SetWindowRgn EnumClipboardFormats GetClipboardSequenceNumber SystemParametersInfoW SystemParametersInfoA DrawTextW SetFocus GetDlgItem EndDialog DialogBoxIndirectParamW GetDesktopWindow SetMenuItemInfoW GetWindowRect SetCursor IntersectRect GetClassNameA GetWindowThreadProcessId GetWindow SetWinEventHook UnhookWinEvent GetAncestor PostMessageW GetAsyncKeyState SendInput GetMenuItemInfoW DeleteMenu InsertMenuW EnableMenuItem CheckMenuItem RegisterClassExA UnregisterDeviceNotification RegisterDeviceNotificationW GetRawInputBuffer GetRawInputDeviceInfoA MonitorFromWindow GetWindowLongW SetRectEmpty FillRect ScreenToClient ClientToScreen AdjustWindowRectEx GetClientRect GetPropW ValidateRect InvalidateRect GetUpdateRect EndPaint BeginPaint GetMenu KillTimer SetTimer MsgWaitForMultipleObjects GetKeyState IsZoomed GetWindowPlacement GetClassInfoExW CallWindowProcW GetMessageExtraInfo GetMessageTime GetMessagePos TrackMouseEvent RegisterWindowMessageA GetDoubleClickTime MessageBoxA SetWindowsHookExW UnhookWindowsHookEx CallNextHookEx GetMessageW PostThreadMessageW GetThreadDesktop EnumChildWindows GetRawInputData

kernel32

InitializeCriticalSectionEx GetStringTypeW IsProcessorFeaturePresent FreeLibraryWhenCallbackReturns RtlPcToFileHeader SwitchToThread GetEnvironmentVariableA GetFileSizeEx SetFilePointer OutputDebugStringW SetEnvironmentVariableA FreeLibraryAndExitThread SetStdHandle SetEndOfFile EncodePointer FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetNumberOfConsoleInputEvents PeekConsoleInputA HeapSize HeapQueryInformation GetOEMCP ExitProcess GlobalMemoryStatusEx SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetThreadExecutionState IsWow64Process EnumResourceNamesW VerSetConditionMask VerifyVersionInfoW GetFileTime FindFirstFileExW CopyFileExW SetHandleInformation CreatePipe MulDiv DecodePointer RtlUnwindEx InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext CompareStringEx GetCommandLineA LCMapStringEx GlobalSize CompareStringA GetSystemPowerStatus GetLocaleInfoEx GetFullPathNameW SetFileAttributesW AreFileApisANSI TryEnterCriticalSection ReadConsoleA ConvertThreadToFiberEx ConvertFiberToThread RtlVirtualUnwind GetExitCodeThread SystemTimeToFileTime GetSystemTime FindNextFileW FindFirstFileW FindClose CreateFiberEx DeleteFiber SwitchToFiber VirtualProtect EnumResourceLanguagesA EnumSystemLocalesA GetLocaleInfoA VirtualFree VirtualAlloc PeekConsoleInputW ReadConsoleInputW PeekNamedPipe GetTimeFormatW GetDateFormatW CloseThreadpoolWork WaitForThreadpoolWorkCallbacks SubmitThreadpoolWork CreateThreadpoolWork WaitForMultipleObjectsEx WaitForSingleObjectEx GetTimeZoneInformation IsDBCSLeadByteEx GetCPInfo IsValidCodePage DeviceIoControl GetCurrentDirectoryW GetWindowsDirectoryW DebugBreak SetEnvironmentVariableW GetThreadLocale GetLocaleInfoW FormatMessageW RemoveVectoredExceptionHandler AddVectoredExceptionHandler OutputDebugStringA GetCommandLineW GetNativeSystemInfo GetThreadPriority TryAcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockShared RaiseException IsDebuggerPresent GetFileType Module32NextW Module32FirstW SetThreadErrorMode CancelIo GetFileInformationByHandleEx SetFilePointerEx SetFileInformationByHandle GetFinalPathNameByHandleW CreateMutexW GetDriveTypeW ReadDirectoryChangesW GetShortPathNameW GetLongPathNameW GetFileAttributesExW GetSystemWow64DirectoryW Wow64RevertWow64FsRedirection Wow64DisableWow64FsRedirection SetFileTime QueryMemoryResourceNotification CreateMemoryResourceNotification GetLogicalDrives ExitThread GetVolumePathNameW GetVolumeInformationW GetDiskFreeSpaceExW GetModuleHandleExW ExpandEnvironmentStringsW GetSystemDirectoryA UnregisterWait RegisterWaitForSingleObject GetVersionExA RtlUnwind GetMaximumProcessorCount GetLastError GetModuleFileNameW AllocConsole AttachConsole SetConsoleOutputCP CloseHandle WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessA GetModuleFileNameA CreateFileW FlushFileBuffers ReadFile WriteFile SetNamedPipeHandleState WaitNamedPipeW CancelIoEx SetEvent CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId GetCurrentThreadId CreateProcessW ProcessIdToSessionId GetTickCount GetTickCount64 FreeLibrary GetProcAddress LoadLibraryW LocalFree WTSGetActiveConsoleSessionId MultiByteToWideChar WideCharToMultiByte SetConsoleCtrlHandler CreateToolhelp32Snapshot GetStdHandle GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetSystemTimeAsFileTime GetModuleHandleW MoveFileExW ResumeThread CreateJobObjectW AssignProcessToJobObject SetInformationJobObject SetErrorMode GetEnvironmentVariableW GetOverlappedResult ResetEvent OpenEventW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetEnvironmentStringsW FreeEnvironmentStringsW CreateDirectoryW DeleteFileW GetFileAttributesW RemoveDirectoryW GetTempPathW DuplicateHandle SetLastError QueueUserAPC GetProcessId InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute GetSystemDirectoryW VirtualAllocEx WriteProcessMemory CreateFileMappingW CopyFileW LoadLibraryExW CreateFileA GetFileInformationByHandle QueryPerformanceCounter QueryPerformanceFrequency ReleaseSemaphore CreateEventA CreateSemaphoreW CreateThread SetThreadPriority LoadLibraryA GlobalAlloc GlobalUnlock GlobalLock GlobalFree GetACP GetConsoleCP GetConsoleOutputCP SetConsoleMode ReadConsoleW WriteConsoleW SetConsoleCP GetConsoleWindow PostQueuedCompletionStatus EnterCriticalSection LeaveCriticalSection TlsAlloc TlsFree FormatMessageA CreateIoCompletionPort GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount DeleteCriticalSection SleepEx SetWaitableTimer CreateWaitableTimerW TerminateThread TlsGetValue TlsSetValue GetModuleHandleA InitializeCriticalSection GetCurrentThread GetSystemInfo CreateSemaphoreA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetThreadGroupAffinity InitOnceBeginInitialize InitOnceComplete WakeConditionVariable SetThreadGroupAffinity SetThreadAffinityMask GetActiveProcessorGroupCount GetActiveProcessorCount SleepConditionVariableCS ReleaseMutex CreateMutexA InitOnceExecuteOnce HeapAlloc HeapFree GetProcessHeap GetLogicalProcessorInformationEx GetMaximumProcessorGroupCount

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

comctl32

ord412 ord411 ord413 ord410

comdlg32

GetOpenFileNameW

setupapi

SetupDiGetClassDevsA CM_Get_Device_IDA CM_Get_Parent CM_Locate_DevNodeA SetupDiGetClassDevsW SetupDiGetDeviceInstanceIdA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW

api-ms-win-core-winrt-l1-1-0

RoUninitialize RoInitialize

ws2_32

gethostname WSAStartup WSACleanup WSAGetLastError closesocket connect ioctlsocket getpeername getsockname getsockopt recv send ntohs shutdown socket WSASocketW WSAPoll getaddrinfo freeaddrinfo getnameinfo inet_pton __WSAFDIsSet accept bind htonl listen ntohl select WSASetLastError WSAIoctl WSARecv WSASend htons setsockopt WSAAddressToStringW WSASendTo WSARecvFrom recvfrom sendto WSAAddressToStringA inet_ntop getservbyname WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAWaitForMultipleEvents inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport WSADuplicateSocketW WSASetEvent

iphlpapi

GetBestInterfaceEx GetIpNetTable2 FreeMibTable ConvertInterfaceLuidToIndex ConvertInterfaceGuidToLuid if_nametoindex GetIpForwardTable2 NotifyRouteChange2 CancelMibChangeNotify2 GetAdaptersAddresses

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

ole32

OleUninitialize OleInitialize CoTaskMemAlloc CoCreateInstance CLSIDFromString CoInitializeEx CoUninitialize CoCreateGuid StringFromGUID2 CoTaskMemFree RevokeDragDrop ReleaseStgMedium PropVariantClear RegisterDragDrop

gdi32

CreateBitmap CreateCompatibleBitmap CreateRectRgn CombineRgn SetPixelFormat DescribePixelFormat CreateSolidBrush DeleteObject CreateCompatibleDC DeleteDC SelectObject SwapBuffers GetPixelFormat GetICMProfileW GetDIBits SetPixel CreateDCW CreateDIBSection GetObjectW GdiFlush BitBlt GetStockObject CreateFontIndirectW GetDeviceCaps GetTextExtentPoint32A GetTextMetricsW ChoosePixelFormat

winmm

timeEndPeriod timeBeginPeriod timeGetTime

oleaut32

SysFreeString

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

dnsapi

DnsQuery_UTF8 DnsFree

shlwapi

StrRetToStrW ord487

bcrypt

BCryptGenRandom

imm32

ImmGetContext ImmSetCandidateWindow ImmReleaseContext ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionStringW ImmGetCandidateListW ImmGetCompositionFontW ImmNotifyIME ImmSetCompositionWindow ImmGetIMEFileNameA

Name

.text

Size

19.0MB

Virtual Size

19.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.2MB

Virtual Size

13.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

693KB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

676KB

Virtual Size

675KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

240KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=247, id=261, version=33145,

count=38, id=259, version=33145,

count=14, id=253, version=35207,

count=19, id=260, version=35207,

count=15, id=259, version=35207,

count=118, id=261, version=35207,

count=77, id=260, version=33145,

count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=1, id=262, version=33145,

count=1, id=259, version=35222,

count=3, id=260, version=35222,

count=1, id=260, version=33813,

count=15, id=260, version=34808,

count=138, productName=Unmarked objects (old),

count=2, id=257, version=35228,

count=2084, id=260, version=35228,

count=51, id=257, version=33145,

count=911, id=1, productName=Unmarked objects,

count=313, id=261, version=35228,

count=1, id=256, version=35228,

count=1, id=255, version=35228,

count=1, id=258, version=35228,

crossdesk_privacy_cursor_helper.exe

IMPHASH 3e9d42b4cdc4b6860ff6e6887c5845cc
SHA256 872314b430cbb613426e31e0610df77b3c3959fa644cdc7e80c7a0e67d450cc2
MD5 ded175c90118a01c5535044f2fa8b4cf
SHA1 9a784c48e94fb349e20361fbbf0f886806b5dbaf
SHA512 ca167c1bff9f9ab79a67b372c0b009a2828d277900dfb4dc487380a571d106676f944ceeb8d39aacf61da16ddd637bcd3f218ceb1cbfc891002713659f8bfcb1
SSDEEP 1536:UMw1eDfLY4YR5qPGcZ3A1J3oTHSOZaXbyVzRzsntdsWJdA9dlHW5xcwS:UnervGUA1JkyOYXbyVVzspwVW5xc
TLSH
T1C3C3495773E530F8E0BBC139C8964A05EBB2B8755B609BEF0764469A5F236D08C3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5876

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

MsgWaitForMultipleObjects PeekMessageW DispatchMessageW TranslateMessage

kernel32

GetCommandLineA WriteConsoleW CreateFileW CloseHandle GetLastError SetLastError SetEvent WaitForSingleObject MapViewOfFile UnmapViewOfFile FreeLibrary GetProcAddress LoadLibraryExW SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

crossdesk_privacy_window.dll

IMPHASH 116c391c4930208c768d55393a815189
SHA256 e1257ca27afa3439c0e5784688b44a7332cf03c7ef8adb9c10ddfd38c120f856
MD5 1df09120a1008858994ad10179ae5e72
SHA1 c2614a6b462e3e654e3cd64ef123fef63e1fce5d
SHA512 3adf7e6dbb55b11717c7a43cd0f3873bf9f309ab4c21ce36b82622cb1e81eac858b723ac9d273f1d600eddb7773dbdd9e21978f11cc7509659266f3b127c6214
SSDEEP 3072:gECx/uhO1c3erREme1N7if3qX5pZGQ7fUcOBWyuiMaNm/TLa1+Q73DHa8+RZO:DC9cOl9Iif3k48f9OtuANmO+KD6
TLSH
T1C6349E57B6B5107BE16B8974C5530A02EB72BC519BA1ABDF07500AEA0F237D0DE3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

14768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

user32

PeekMessageW DefWindowProcW DispatchMessageW RedrawWindow UnregisterClassW DrawIconEx LoadImageW DestroyIcon FillRect DrawTextW EnumDisplayMonitors SetWindowLongPtrW GetWindowLongPtrW SetCursor GetWindowRect GetClientRect TranslateMessage InvalidateRect EndPaint BeginPaint MsgWaitForMultipleObjectsEx IsWindowVisible SetWindowDisplayAffinity GetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes GetLayeredWindowAttributes DestroyWindow RegisterClassExW

kernel32

GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc HeapSize GetStringTypeW GetFileType GetStdHandle GetProcessHeap LCMapStringW VirtualProtect InitializeCriticalSectionEx GetConsoleMode SetEnvironmentVariableW CloseHandle GetLastError SetLastError SetEvent WaitForSingleObject QueueUserAPC GetCurrentProcessId ExitProcess GetCurrentThread GetProcessId GetTickCount64 MapViewOfFile UnmapViewOfFile GetModuleHandleW GetProcAddress FlsFree FlsSetValue FlsGetValue FlsAlloc SetFilePointerEx CreateFileW WriteConsoleW GetEnvironmentVariableW GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW

dwmapi

DwmSetWindowAttribute DwmFlush DwmGetWindowAttribute

gdi32

SetBkMode SelectObject SaveDC RestoreDC DeleteObject CreateFontW GetStockObject SetTextColor

Name

.text

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

86KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

crossdesk_service.exe

IMPHASH 1b5c9dcbed955d23ed657e0018c4a0cc
SHA256 6c20b6fbbe33826fa9042e940aee36871a26d63de13cb9d42565c87d0fe7e10e
MD5 878832ff72725a49aed00065c4e63d16
SHA1 f69f76127b2a9b89b046706a207c40c63b49ff58
SHA512 cf378787a0cfaaaed29a29289fd7b01562dae655a6b6d7bb7f35c9553893602ab153523a1cdb4f190b03e8ecdaccf2d2ffb4ac12b9e70fb4691b807c3ee648d3
SSDEEP 12288:wAXTwKUl5OUODq9/eqQY2rXft3RTdNAkofignnLkRS5:wwgkUODq92qjGXtdEkofxnLkI
TLSH
T177F47D26B79801F8D0B7C17ACE568916FBB178064761ABDF13D047A61F27AE44E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

339016

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CreateProcessAsUserW OpenProcessToken CreateWellKnownSid DuplicateTokenEx SetTokenInformation RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerW OpenServiceW QueryServiceStatusEx RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW SetEntriesInAclW GetSecurityInfo SetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationW

ole32

CoTaskMemFree

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

SHGetKnownFolderPath

user32

OpenInputDesktop CloseDesktop GetUserObjectInformationW

kernel32

SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetStdHandle DeleteFileW GetModuleFileNameW CreateFileW FlushFileBuffers ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe SetNamedPipeHandleState CreateNamedPipeW WaitNamedPipeW CancelIoEx SetEvent WaitForSingleObject CreateEventW Sleep WaitForMultipleObjects GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess GetCurrentThreadId CreateProcessW ProcessIdToSessionId GetTickCount GetTickCount64 FreeLibrary GetProcAddress LoadLibraryW LocalFree GetNamedPipeClientSessionId WTSGetActiveConsoleSessionId MultiByteToWideChar WideCharToMultiByte SetConsoleCtrlHandler CreateToolhelp32Snapshot Process32FirstW Process32NextW GetStdHandle GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute SetFilePointerEx FormatMessageA QueryPerformanceCounter GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetTimeZoneInformation FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetFileSizeEx RtlUnwind

Name

.text

Size

521KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

crossdesk_session_helper.exe

IMPHASH 15a42966ef16abe8a326883017de31d0
SHA256 91d09a13a921c144a0791fd995473fe6afa95633be4fbf769831f4ebfcc1a4f4
MD5 a3b9cb7f1eeec7989f43e148b3999fe5
SHA1 ccc31020f13f345d4abee1aeb7dd7d40250cc4e4
SHA512 ada3060c2ee9eb6457cba29aa10ea2a1056de633637c981b7cfe7bc34562940dc336e970139177b02f83eefb964d245e8f32bd2b154a9d76e9b5f3b8b7773ec4
SSDEEP 12288:qYk0RZtCA17spRh/CGYLv0BGYhgWdF2aYVFT9PHDVgyP+:97t4pRh/bYgBHhgWdYa+CN
TLSH
T105057C26B79402FCD177C17AC9568912FB72780607A16BCF07D08B665F2BAE45E3E702
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

331204

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegSetValueExW ConvertStringSecurityDescriptorToSecurityDescriptorW

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

gdi32

GdiFlush GetObjectW CreateDIBSection BitBlt CreateCompatibleDC DeleteDC DeleteObject SelectObject

setupapi

SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW

shell32

SHGetKnownFolderPath

user32

SetProcessDpiAwarenessContext UnhookWinEvent SetWinEventHook GetIconInfo DrawIconEx LoadCursorW ReleaseDC GetDC EnumDisplaySettingsExW MsgWaitForMultipleObjects GetRawInputDeviceList SendInput PeekMessageW DispatchMessageW TranslateMessage GetUserObjectInformationW GetThreadDesktop CloseDesktop SetThreadDesktop OpenInputDesktop OpenDesktopW GetCursorInfo MapVirtualKeyW ChangeDisplaySettingsExW EnumDisplayDevicesW GetSystemMetrics

kernel32

SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapReAlloc ReadConsoleW SetStdHandle DeleteFileW SetFilePointerEx GetFileSizeEx GetConsoleOutputCP GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc FlushFileBuffers ReadFile WriteFile CloseHandle GetLastError SetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW CancelIoEx SetEvent WaitForSingleObject CreateEventW OpenEventW WaitForMultipleObjects GetCurrentProcessId GetCurrentThreadId ProcessIdToSessionId OpenProcess GetTickCount64 CreateFileMappingW MapViewOfFile UnmapViewOfFile GetModuleFileNameW LocalFree QueryFullProcessImageNameW GetNamedPipeClientProcessId MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW Sleep TerminateProcess GetExitCodeProcess CreateProcessW GetStdHandle GetDynamicTimeZoneInformation GetConsoleMode WriteConsoleA GetConsoleScreenBufferInfo SetConsoleTextAttribute GetCommandLineW GetCommandLineA ExitProcess QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW FormatMessageA GetLocaleInfoEx InitOnceBeginInitialize InitOnceComplete GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW AreFileApisANSI GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx WakeConditionVariable WakeAllConditionVariable EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime RtlUnwind

ole32

CoTaskMemFree

Name

.text

Size

497KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

87KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

usbmmidd_v2/Win32/usbmmIdd.dll

IMPHASH 19d9a8bb29ad0d1cd4508f86a13e762e
SHA256 07ceebaecf203fef39117576d8b49d803c0fb1f6c7aa5175a6ebab110d54fed2
MD5 35b4cd69a125d475a9456e0fe43b6514
SHA1 71947900cf78c146a4cddd667bc3228390d429be
SHA512 f02542203a5c992eabaf7cf6b706537128ffca85348f808bf6c897d8fba02087d7e8cdaf0a91329f8abde2148adf071eb967f47ececdb6a6f7c9f98fed11b730
SSDEEP 768:cwVtOoQ+DUHe4TnqkgCQEpc6jpRaGRKgmU3deh9pKyRiopmilCjKfdsqQ2bx1CVu:ciZWqkg2cWsFRRRo4C74xk1t29
TLSH
T1DE538E22BEE044B3CF5A5A3074A6EE1B2E7D76815DF0C8676B6D830C1E75392771421B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

X:\Projects\usbmm\usbmmIdd\Release\usbmmIdd.pdb

ntdll

RtlUnwind DbgPrintEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter SetLastError GetLastError RaiseException

api-ms-win-core-synch-l1-1-0

CreateEventW WaitForSingleObject DeleteCriticalSection SetEvent InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId GetCurrentProcessId TerminateProcess TlsAlloc GetCurrentProcess TlsFree TlsSetValue TlsGetValue CreateThread

api-ms-win-core-com-l1-1-0

IIDFromString

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

api-ms-win-crt-runtime-l1-1-0

_initterm _errno _initterm_e abort _invalid_parameter_noinfo _cexit _crt_atexit _execute_onexit_table terminate _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _seh_filter_dll _configure_narrow_argv _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s __stdio_common_vswscanf

api-ms-win-crt-string-l1-1-0

wcsncmp memset strcpy_s

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InterlockedFlushSList InitializeSListHead

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-crt-heap-l1-1-0

malloc _callnewh calloc free

usbmmidd_v2/deviceinstaller.exe

IMPHASH 28b870b50bd87a6fd54a27892f1a94bf
SHA256 918be90cccf70ccd20d42f564710335f1b6a7322ecef8e432737b6a4d2743a6c
MD5 9dc576103b6c58580612c060310d5897
SHA1 1f48037c5e17cb489a24221e3ba5a120d8a5850d
SHA512 71cf06e711b3e408f599db3db9d795d4ebbf7d2d515fcc5f61bab97d9b54d4e7fead05ef247239d5bdab1dcbe180bb39ae7a6b08cab563bd54c13a81e07f1446
SSDEEP 1536:5GSSEzaP6vDymVnGOBFmGRlxJjNJVCniTcjr/sWjcdc+hH7V1F7mF4O7WNI:oSSzP6bL7JjNJVLYrAc+dV1F7ARWNI
TLSH
T148D34F0273E58525F1F32A3069B456710E7BBCA1AE39CA4E6388515D0BF3E90DD74BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30278

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindFirstFileW FindNextFileW LocalFree GetCurrentProcess FormatMessageW FileTimeToSystemTime GetFileAttributesW SetFilePointerEx SetStdHandle HeapSize RtlUnwind HeapReAlloc CreateFileW GetFullPathNameW GetWindowsDirectoryW LoadLibraryW lstrlenW CloseHandle FindClose DeviceIoControl GetLastError GetProcAddress GetDateFormatW FreeLibrary GetConsoleMode GetConsoleCP FlushFileBuffers OutputDebugStringW LoadLibraryExW LCMapStringW WideCharToMultiByte GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStringTypeW GetStartupInfoW GetFileType Sleep InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW ExitProcess WriteConsoleW GetProcessHeap MultiByteToWideChar GetCurrentThreadId SetLastError GetCPInfo GetOEMCP GetACP IsValidCodePage InterlockedDecrement HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetCommandLineW EncodePointer DecodePointer RaiseException IsDebuggerPresent IsProcessorFeaturePresent InterlockedIncrement

user32

wsprintfW LoadStringW CharPrevW CharNextW

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegDeleteValueW RegCloseKey InitiateSystemShutdownExW

ole32

CLSIDFromString IIDFromString

setupapi

CM_Get_Next_Res_Des_Ex CM_Get_Res_Des_Data_Size_Ex CM_Get_Res_Des_Data_Ex CM_Get_First_Log_Conf_Ex CM_Free_Res_Des_Handle CM_Free_Log_Conf_Handle SetupDiGetDriverInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiOpenDevRegKey SetupDiGetDriverInfoDetailW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupScanFileQueueW SetupCloseFileQueue SetupOpenFileQueue SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoListExW CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExW CM_Disconnect_Machine CM_Connect_MachineW SetupDiClassGuidsFromNameExW SetupDiClassNameFromGuidExW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiOpenClassRegKeyExW SetupDiCallClassInstaller SetupDiGetClassDescriptionExW SetupDiBuildClassInfoListExW SetupDiGetINFClassW SetupDiGetClassDevsExW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoList SetupCopyOEMInfW SetupDiDestroyDriverInfoList

usbmmidd_v2/deviceinstaller64.exe

IMPHASH a1299172b42388a072e9cae23c8ffa69
SHA256 e9baa02cdae921acf0aae4d8e8c29a4cdf4057ab61f9c60862b7cc439e2753f7
MD5 41283e1240acfc163f0e697073f07413
SHA1 a10cf33fbb23c4465921e6590c934873f3155317
SHA512 d7361a1656c8a8bf0b2bb8fa332105912285d23933bbc37ebe955b36e3fc158472216757bd87638860542cefadbbc17d36d5ef16cbd910b64fc25a2d7f42cfaf
SSDEEP 3072:MXiK11hTwS8XjJ3T/yub0koXAUthu3MA/KARW:MbillTK60koTQL
TLSH
T118F3810323E961A9F1F7BB3499B145219B777CA19A38D74D0298815E0FF3E809D39B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindFirstFileW FindNextFileW LocalFree GetCurrentProcess FormatMessageW FileTimeToSystemTime GetFileAttributesW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc GetConsoleMode CreateFileW GetFullPathNameW GetWindowsDirectoryW LoadLibraryW lstrlenW CloseHandle FindClose DeviceIoControl GetLastError GetProcAddress GetDateFormatW FreeLibrary GetConsoleCP FlushFileBuffers OutputDebugStringW LoadLibraryExW LCMapStringW WideCharToMultiByte GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FreeEnvironmentStringsW GetEnvironmentStringsW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetStringTypeW GetStartupInfoW GetFileType RtlUnwindEx Sleep InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetModuleFileNameW WriteFile GetStdHandle GetModuleHandleExW WriteConsoleW ExitProcess GetProcessHeap MultiByteToWideChar GetCurrentThreadId SetLastError GetCPInfo GetOEMCP GetACP HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetCommandLineW EncodePointer DecodePointer RtlPcToFileHeader RaiseException IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage

user32

wsprintfW LoadStringW CharPrevW CharNextW

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken OpenServiceW OpenSCManagerW CloseServiceHandle RegSetValueExW RegDeleteValueW RegCloseKey InitiateSystemShutdownExW

ole32

CLSIDFromString IIDFromString

setupapi

CM_Get_Next_Res_Des_Ex CM_Get_Res_Des_Data_Size_Ex CM_Get_Res_Des_Data_Ex CM_Get_First_Log_Conf_Ex CM_Free_Res_Des_Handle CM_Free_Log_Conf_Handle SetupDiGetDriverInstallParamsW SetupDiSetDeviceInstallParamsW SetupDiDestroyDriverInfoList SetupDiGetDriverInfoDetailW SetupDiSetSelectedDriverW SetupDiEnumDriverInfoW SetupDiBuildDriverInfoList SetupScanFileQueueW SetupCloseFileQueue SetupOpenFileQueue SetupGetStringFieldW SetupFindFirstLineW SetupCloseInfFile SetupOpenInfFileW SetupDiGetDeviceRegistryPropertyW SetupDiOpenDeviceInfoW SetupDiCreateDeviceInfoListExW CM_Reenumerate_DevNode_Ex CM_Locate_DevNode_ExW CM_Get_Device_Interface_List_SizeW CM_Get_Device_Interface_ListW CM_Get_DevNode_Status_Ex CM_Get_Device_ID_ExW CM_Disconnect_Machine CM_Connect_MachineW SetupDiClassGuidsFromNameExW SetupDiClassNameFromGuidExW SetupDiSetClassInstallParamsW SetupDiGetDeviceInstallParamsW SetupDiSetDeviceRegistryPropertyW SetupDiOpenClassRegKeyExW SetupDiCallClassInstaller SetupDiGetClassDescriptionExW SetupDiBuildClassInfoListExW SetupDiGetINFClassW SetupDiGetClassDevsExW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiCreateDeviceInfoW SetupDiGetDeviceInfoListDetailW SetupDiCreateDeviceInfoList SetupCopyOEMInfW SetupDiOpenDevRegKey

usbmmidd_v2/x64/usbmmIdd.dll

IMPHASH 8cce31b273712b965675a6ee6b242015
SHA256 dc135d675127113915a7e5aa9fe57c84edad6be41d0890b265ef124ab26ea9e3
MD5 ee848c427145609d998725a38e7ad9af
SHA1 6b97d9ab1c3978cdc2d6735c227adca8f0aabddb
SHA512 5bd0eca69d16a6fe32856978047967e44f0d49c59cd611b02e9d24ca59c0d862ad5f8a4d50c6bed816fa11e2f4fee6fabbe3d6d735224084f47161693eee8007
SSDEEP 1536:fNgohwVuXUd9g0TOHISWaxVTYwZVtDEWoG:f32eSNOoSWMVVZVFYG
TLSH
T11B638D597BE448A1E46B9470C4E29E4FFAB1F1422F31969F0374C21D2F637E0A62D366
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18276

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

X:\Projects\usbmm\usbmmIdd\x64\Release\usbmmIdd.pdb

ntdll

RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlPcToFileHeader RtlUnwindEx DbgPrintEx

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter RaiseException GetLastError

api-ms-win-core-synch-l1-1-0

SetEvent DeleteCriticalSection WaitForSingleObject CreateEventW InitializeCriticalSectionAndSpinCount

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-processthreads-l1-1-0

TerminateProcess CreateThread GetCurrentThreadId GetCurrentProcessId GetCurrentProcess TlsFree TlsSetValue TlsGetValue TlsAlloc

api-ms-win-core-com-l1-1-0

IIDFromString

dxgi

CreateDXGIFactory2

d3d11

D3D11CreateDevice

avrt

AvSetMmThreadCharacteristicsW AvRevertMmThreadCharacteristics

api-ms-win-crt-runtime-l1-1-0

_initterm _cexit _crt_atexit _initterm_e abort _errno _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _execute_onexit_table _seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswscanf __stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

wcsncmp memset strcpy_s

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary GetProcAddress LoadLibraryExW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-crt-heap-l1-1-0

malloc _callnewh calloc free

wgc_plugin.dll

IMPHASH 49141006c16fceb9e4ddaa06303a649e
SHA256 905150fd0c49164b46a8b342d750625bc25816b36db68fcfb873c29b3465b4a9
MD5 c9f3b5e2806cb9316919f098a0fc1274
SHA1 71751b3eebfd52049a46e9a32734bb57b58b5ad3
SHA512 22f5674716fd32bf014bfc43a559648d169d0d80cdc0243df34a6c767043fca06069c06da65250d8be0358a82fcc4a4e49b5b2fce8ef64a8f701056c5652d763
SSDEEP 6144:tvCCCLdTFfldm9x0PNNa6g//IpaAIXqdU9sAe90DF4x/q3qCiO1jBncYSnR4SpXC:WdTFf7jg//Oi9NDKxfO1j5cYSnR4qR+
TLSH
T11CC46B26B6A803B8D16BC278CD578906EB727C454760AADF17D087A75E27BE05B3F301
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

241004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-core-processthreads-l1-1-0

TlsGetValue TlsAlloc GetExitCodeThread TlsFree TlsSetValue GetCurrentProcess GetCurrentProcessId GetStartupInfoW GetCurrentThreadId ExitProcess TerminateProcess

api-ms-win-ntuser-sysparams-l1-1-0

EnumDisplayMonitors GetMonitorInfoW

api-ms-win-core-string-l1-1-0

WideCharToMultiByte GetStringTypeW CompareStringW MultiByteToWideChar

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent OutputDebugStringW

d3d11

CreateDirect3D11DeviceFromDXGIDevice D3D11CreateDevice

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW GetCommandLineA GetCommandLineW SetStdHandle GetEnvironmentStringsW SetEnvironmentVariableW FreeEnvironmentStringsW GetStdHandle

api-ms-win-core-file-l1-1-0

GetFileType FlushFileBuffers ReadFile GetDriveTypeW GetFileSizeEx SetFilePointerEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW WriteFile DeleteFileW SetEndOfFile

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable WakeConditionVariable Sleep InitOnceBeginInitialize InitOnceComplete SleepConditionVariableSRW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime GetDynamicTimeZoneInformation SystemTimeToTzSpecificLocalTime GetTimeZoneInformation

api-ms-win-core-console-l1-1-0

WriteConsoleW GetConsoleOutputCP WriteConsoleA GetConsoleMode ReadConsoleW

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo SetConsoleTextAttribute

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress LoadLibraryExW GetModuleHandleW GetModuleHandleExW GetModuleFileNameW FreeLibrary

api-ms-win-core-com-l1-1-0

CoTaskMemFree CoCreateFreeThreadedMarshaler

shell32

SHGetKnownFolderPath

user32

MonitorFromPoint GetCursorInfo

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive ReleaseSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx InitializeCriticalSectionAndSpinCount EnterCriticalSection DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

IsValidLocale GetLocaleInfoW LCMapStringEx LCMapStringW FormatMessageA GetCPInfo EnumSystemLocalesW GetOEMCP GetACP GetLocaleInfoEx IsValidCodePage GetUserDefaultLCID

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter RaiseException SetLastError SetUnhandledExceptionFilter GetLastError

api-ms-win-core-file-l2-1-0

MoveFileExW GetFileInformationByHandleEx

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedFlushSList InterlockedPushEntrySList

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe

api-ms-win-core-heap-l1-1-0

HeapFree HeapSize HeapAlloc GetProcessHeap HeapReAlloc

api-ms-win-core-fibers-l1-1-0

FlsFree FlsSetValue FlsAlloc FlsGetValue

api-ms-win-core-memory-l1-1-0

VirtualProtect

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW GetDateFormatW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SetErrorInfo SysStringLen SysFreeString GetErrorInfo

Name

.text

Size

391KB

Virtual Size

391KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

928B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d5d129a9d1046c6f3342636f1f1eb1e52b491db206cfe2e938e0cb008f6d16dc

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsProcess.dll

kernel32

user32

generic

CrossDesk.exe

opengl32

slint_cpp

advapi32

crypt32

shell32

dwmapi

user32

kernel32

d3d11

dxgi

comctl32

comdlg32

setupapi

api-ms-win-core-winrt-l1-1-0

ws2_32

iphlpapi

wtsapi32

ole32

gdi32

winmm

oleaut32

version

dnsapi

shlwapi

bcrypt

imm32

generic

crossdesk_privacy_cursor_helper.exe

user32

kernel32

generic

crossdesk_privacy_window.dll

user32

kernel32

dwmapi

gdi32

generic

crossdesk_service.exe

advapi32

wtsapi32

ole32

userenv

shell32

user32

kernel32

generic