hl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hl.exe
Size

920KB
MD5

77cce9925d2a039ae38b679b1225e944
SHA1

0c35624875984b439e9c55293db59bd3c40b7b1e
SHA256

907ee949c5b33c327938e4b3d3d6a702e3a2cd7b8d2f9653fb374a54bd586af5
SHA512

688d1242a9d9d01a24c959719d7fb65dd56bf6c23fba2eac75a6335e389f29fc5c57891b8451e272904dba0afbeccfd17d52dba6d8c41e954a2200b8bf13a2e1
SSDEEP

24576:yC7pJNmgKd6FiifF/BX3ygjdGQ64JDRKM1DpqqjlQVT7+qlrv+Tljdg:jTE4dt/Bnr2g0M1DpqqjlkGqlL+rg

Score

1^/10

Malware Config

Signatures

Files

hl.exe
.exe windows x86

7cdf9f382d781d7f55562fca05df07d9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wonauth

?NewAuthPublicKeyBlock1@WON_AuthFactory@@SAPAVWON_AuthPublicKeyBlock1@@PBEG@Z
?NewAuthCertificate1@WON_AuthFactory@@SAPAVWON_AuthCertificate1@@PBEG@Z
?GetNumKeys@WON_AuthPublicKeyBlock1@@QBEHXZ
?GetNextKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?GetBlockId@WON_AuthPublicKeyBlock1@@QBEGXZ
?DeleteAuthPublicKeyBlock1@WON_AuthFactory@@SAXPAVWON_AuthPublicKeyBlock1@@@Z
?GetPubKey@WON_AuthCertificate1@@QBEPBEXZ
?IsValid@WON_AuthFamilyBuffer@@QBEHXZ
?Verify@WON_AuthFamilyBuffer@@QBEHPBEG@Z
?GetIssueTime@WON_AuthFamilyBuffer@@QBEJXZ
?GetExpireTime@WON_AuthFamilyBuffer@@QBEJXZ
?GetPubKeyLen@WON_AuthCertificate1@@QBEGXZ
?GetRaw@WON_AuthFamilyBuffer@@QBEPBEXZ
?GetRawLen@WON_AuthFamilyBuffer@@QBEGXZ
?GetUserId@WON_AuthCertificate1@@QBEKXZ
?GetCommunityId@WON_AuthCertificate1@@QBEKXZ
?GetFirstKey@WON_AuthPublicKeyBlock1@@QBE?AUPubKeyReturn@1@XZ
?DeleteAuthCertificate1@WON_AuthFactory@@SAXPAVWON_AuthCertificate1@@@Z

woncrypt

?GetKey@WON_CryptKeyBase@@QBEPBEXZ
?GetKeyLen@WON_CryptKeyBase@@QBEGXZ
?DeleteEGPublicKey@WON_CryptFactory@@SAXPAVWON_EGPublicKey@@@Z
?NewEGPublicKey@WON_CryptFactory@@SAPAVWON_EGPublicKey@@GPBE@Z
?NewEGPrivateKey@WON_CryptFactory@@SAPAVWON_EGPrivateKey@@GPBE@Z
?Encrypt@WON_EGPublicKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
?NewBFSymmetricKey@WON_CryptFactory@@SAPAVWON_BFSymmetricKey@@GPBE@Z
?Decrypt@WON_EGPrivateKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
?DeleteBFSymmetricKey@WON_CryptFactory@@SAXPAVWON_BFSymmetricKey@@@Z
??4CryptReturn@WON_CryptKeyBase@@QAEAAV01@ABV01@@Z
?Encrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBXK@Z
??0CryptReturn@WON_CryptKeyBase@@QAE@PAEK@Z
?Decrypt@WON_BFSymmetricKey@@QAE?AVCryptReturn@WON_CryptKeyBase@@PBEK@Z
??1CryptReturn@WON_CryptKeyBase@@QAE@XZ
?DeleteEGPrivateKey@WON_CryptFactory@@SAXPAVWON_EGPrivateKey@@@Z

vgui

?setMouseFocus@App@vgui@@EAEXPAVPanel@2@@Z
?init@App@vgui@@EAEXXZ
?internalKeyReleased@App@vgui@@UAEXW4KeyCode@2@PAVSurfaceBase@2@@Z
?internalKeyTyped@App@vgui@@UAEXW4KeyCode@2@PAVSurfaceBase@2@@Z
?internalKeyPressed@App@vgui@@UAEXW4KeyCode@2@PAVSurfaceBase@2@@Z
?internalMouseWheeled@App@vgui@@UAEXHPAVSurfaceBase@2@@Z
?internalMouseReleased@App@vgui@@UAEXW4MouseCode@2@PAVSurfaceBase@2@@Z
?internalMouseDoublePressed@App@vgui@@UAEXW4MouseCode@2@PAVSurfaceBase@2@@Z
?internalMousePressed@App@vgui@@UAEXW4MouseCode@2@PAVSurfaceBase@2@@Z
?internalCursorMoved@App@vgui@@UAEXHHPAVSurfaceBase@2@@Z
?run@App@vgui@@UAEXXZ
?setMinimumTickMillisInterval@App@vgui@@UAEXH@Z
?getCursorOveride@App@vgui@@UAEPAVCursor@2@XZ
?setCursorOveride@App@vgui@@UAEXPAVCursor@2@@Z
?getRegistryInteger@App@vgui@@UAE_NPBDAAH@Z
?setRegistryInteger@App@vgui@@UAE_NPBDH@Z
?surfaceBaseCreated@App@vgui@@MAEXPAVSurfaceBase@2@@Z
?updateMouseFocus@App@vgui@@EAEXHHPAVSurfaceBase@2@@Z
?internalSetMouseArena@App@vgui@@UAEXHHHH_N@Z
?reset@App@vgui@@UAEXXZ
?getClipboardText@App@vgui@@UAEHHPADH@Z
?setClipboardText@App@vgui@@UAEXPBDH@Z
?getClipboardTextCount@App@vgui@@UAEHXZ
?getKeyCodeText@App@vgui@@UAEXW4KeyCode@2@PADH@Z
?getKeyCodeChar@App@vgui@@UAEDW4KeyCode@2@_N@Z
?getDefaultCursor@Cursor@vgui@@UAE?AW4DefaultCursor@12@XZ
?enableBuildMode@App@vgui@@UAEXXZ
?getScheme@App@vgui@@UAEPAVScheme@2@XZ
?setScheme@App@vgui@@UAEXPAVScheme@2@@Z
?repaintAll@App@vgui@@UAEXXZ
?getFocus@App@vgui@@UAEPAVPanel@2@XZ
?requestFocus@App@vgui@@UAEXPAVPanel@2@@Z
?setMouseArena@App@vgui@@UAEXHHHH_N@Z
?setMouseArena@App@vgui@@UAEXPAVPanel@2@@Z
?setMouseCapture@App@vgui@@UAEXPAVPanel@2@@Z
?internalTick@App@vgui@@MAEXXZ
?surfaceBaseDeleted@App@vgui@@MAEXPAVSurfaceBase@2@@Z
?platTick@App@vgui@@MAEXXZ
?getBitmap@Cursor@vgui@@UAEPAVBitmap@2@XZ
?getHotspot@Cursor@vgui@@UAEXAAH0@Z
?privateInit@Cursor@vgui@@EAEXPAVBitmap@2@HH@Z
?getRegistryString@App@vgui@@UAE_NPBDPADH@Z
?setRegistryString@App@vgui@@UAE_NPBD0@Z
?getTimeMillis@App@vgui@@UAEJXZ
?getCursorPos@App@vgui@@UAEXAAH0@Z
?setCursorPos@App@vgui@@UAEXHH@Z
?addTickSignal@App@vgui@@UAEXPAVTickSignal@2@@Z
?wasKeyReleased@App@vgui@@UAE_NW4KeyCode@2@PAVPanel@2@@Z
?wasKeyTyped@App@vgui@@UAE_NW4KeyCode@2@PAVPanel@2@@Z
?isKeyDown@App@vgui@@UAE_NW4KeyCode@2@PAVPanel@2@@Z
?wasKeyPressed@App@vgui@@UAE_NW4KeyCode@2@PAVPanel@2@@Z
?wasMouseReleased@App@vgui@@UAE_NW4MouseCode@2@PAVPanel@2@@Z
?isMouseDown@App@vgui@@UAE_NW4MouseCode@2@PAVPanel@2@@Z
?wasMouseDoublePressed@App@vgui@@UAE_NW4MouseCode@2@PAVPanel@2@@Z
?wasMousePressed@App@vgui@@UAE_NW4MouseCode@2@PAVPanel@2@@Z
?externalTick@App@vgui@@UAEXXZ
?stop@App@vgui@@UAEXXZ
?start@App@vgui@@UAEXXZ
??0App@vgui@@QAE@_N@Z

ddraw

DirectDrawEnumerateA
DirectDrawCreate

winmm

mciSendCommandA
mmioGetInfo
mciGetErrorStringA
timeGetTime
mmioSetInfo
joyGetDevCapsA
joyGetPosEx
joyGetNumDevs
mciGetDeviceIDA
mciSendStringA
waveOutWrite
waveOutPrepareHeader
sndPlaySoundA
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetNumDevs
mixerClose
mixerGetControlDetailsA
mixerSetControlDetails
mmioClose
mmioAscend
mmioRead
mmioDescend
mmioOpenA
mmioSeek
mmioAdvance

kernel32

GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileSectionA
GetFileTime
SetErrorMode
CompareFileTime
FindClose
FindNextFileA
GetCurrentThreadId
WinExec
CreateProcessA
lstrcpyA
lstrlenA
GetExitCodeProcess
ReadFile
OpenFile
CopyFileA
SetFilePointer
LeaveCriticalSection
ResetEvent
FindFirstFileA
lstrcatA
DeleteCriticalSection
OutputDebugStringA
GetLastError
InitializeCriticalSection
SetEvent
LocalFree
FormatMessageA
GlobalHandle
CreateThread
lstrcpynA
lstrcmpiA
ReleaseMutex
InterlockedExchange
CreateMutexA
GetCurrentProcess
GetVersion
SetFileTime
GetFullPathNameA
FileTimeToLocalFileTime
SetVolumeLabelA
_lclose
GlobalDeleteAtom
GlobalGetAtomNameA
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
MultiByteToWideChar
SetLastError
TerminateThread
GetTimeZoneInformation
lstrcmpA
GetPrivateProfileIntA
GetPrivateProfileStringA
WritePrivateProfileStringA
FileTimeToSystemTime
LocalAlloc
GetFileAttributesA
GlobalMemoryStatus
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
MoveFileA
GetStringTypeExA
GetThreadLocale
GlobalFlags
SizeofResource
TlsAlloc
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
GetCurrentDirectoryA
LocalFileTimeToFileTime
SystemTimeToFileTime
RtlUnwind
GetSystemTime
GetLocalTime
IsBadReadPtr
ExitProcess
TerminateProcess
SetEnvironmentVariableA
SetCurrentDirectoryA
GetSystemTimeAsFileTime
CreateDirectoryA
GetStartupInfoA
RaiseException
GetACP
HeapReAlloc
HeapSize
SetStdHandle
GetFileType
CreateEventA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
LCMapStringA
LCMapStringW
SetHandleCount
GetStdHandle
GetStringTypeA
GetStringTypeW
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
CompareStringA
CompareStringW
GetVersionExA
GetProcAddress
QueryPerformanceCounter
QueryPerformanceFrequency
GetTickCount
GlobalFree
FindResourceA
LoadResource
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
LoadLibraryA
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
GetFileSize
GetDriveTypeA
GetVolumeInformationA
GetDiskFreeSpaceA
CreateFileA
WriteFile
CloseHandle
DeleteFileA
Sleep
SetFileAttributesA
GetTempFileNameA
DuplicateHandle
MulDiv
GetCurrentThread
GetProfileStringA
GlobalFindAtomA
GlobalAddAtomA
EnterCriticalSection
WaitForSingleObject
GetEnvironmentVariableA

user32

GetCapture
PostMessageA
SetWindowsHookExA
CallNextHookEx
GetKeyState
DestroyWindow
UnhookWindowsHookEx
CreateWindowExA
AdjustWindowRectEx
RegisterClassA
LoadIconA
UnregisterClassA
ShowCursor
GetWindowLongA
CallWindowProcA
PtInRect
GetAsyncKeyState
KillTimer
SetTimer
SetCursor
RegisterWindowMessageA
ChangeDisplaySettingsA
GetMessageA
wsprintfA
ScreenToClient
GetCursorPos
DrawTextA
GetNextDlgTabItem
MsgWaitForMultipleObjects
DestroyCaret
GetClassNameA
GetWindow
ClientToScreen
IntersectRect
HideCaret
ShowCaret
EqualRect
AppendMenuA
CreatePopupMenu
DrawFocusRect
GetMenuState
DrawTextExA
BringWindowToTop
DispatchMessageA
TranslateMessage
OemToCharA
CharToOemA
GetDlgItem
CreateDialogIndirectParamA
EndDialog
GetWindowPlacement
IsIconic
SystemParametersInfoA
GetLastActivePopup
GetMessagePos
GetMessageTime
RemovePropA
GetPropA
SetPropA
GetClassLongA
GetDlgCtrlID
GetWindowTextA
GetWindowTextLengthA
TrackPopupMenu
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
GetClassInfoA
WinHelpA
GetTopWindow
SetScrollPos
ReleaseCapture
RedrawWindow
GetSysColor
MapWindowPoints
SendDlgItemMessageA
IsDialogMessageA
SetWindowTextA
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuCheckMarkDimensions
GetWindowDC
TabbedTextOutA
GrayStringA
CharUpperA
DestroyMenu
GetSysColorBrush
InsertMenuA
DeleteMenu
GetMenuStringA
BeginPaint
EndPaint
GetDesktopWindow
GetDC
ReleaseDC
FindWindowA
SetForegroundWindow
SetFocus
PostQuitMessage
EnumChildWindows
FindWindowExA
IsWindow
UnionRect
IsWindowEnabled
GetActiveWindow
GetParent
PeekMessageA
MoveWindow
MessageBoxA
ValidateRect
SetActiveWindow
GetWindowRect
GetSystemMetrics
LoadStringA
DefWindowProcA
GetClientRect
FrameRect
GetFocus
FillRect
CopyRect
LoadCursorA
InflateRect
SendMessageA
EnableWindow
LockWindowUpdate
ShowWindow
ClipCursor
UpdateWindow
SetWindowLongA
InvalidateRect
OffsetRect
IsWindowVisible
SetCapture
SetWindowPos
GetForegroundWindow
LoadBitmapA
IsWindowUnicode
CharNextA
DefDlgProcA
ExcludeUpdateRgn

gdi32

SetWindowExtEx
ScaleWindowExtEx
GetTextExtentPointA
CreateDIBitmap
ScaleViewportExtEx
CreateFontA
GetStockObject
StretchDIBits
SetDIBitsToDevice
SetStretchBltMode
DPtoLP
CreateFontIndirectA
Escape
ExtTextOutA
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
TextOutA
RectVisible
PtVisible
LineTo
MoveToEx
GetDeviceCaps
PatBlt
GetDIBits
GetObjectA
CreatePen
GetCurrentObject
DeleteObject
GetTextExtentPoint32A
GetTextMetricsA
CreateICA
Ellipse
GetBoundsRect
DeleteDC
CreateDIBSection
SelectObject
SetBkMode
SetTextColor
GetClipBox
SetBkColor
CreateBitmap
SaveDC
RestoreDC
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
StretchBlt
IntersectClipRect
CreateSolidBrush
SetViewportExtEx

comdlg32

GetFileTitleA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCreateKeyA
RegDeleteValueA
RegOpenKeyA
RegQueryValueExA
GetSecurityDescriptorLength
IsValidSid
RegCloseKey
RegSetValueExA
RegCreateKeyExA
RegFlushKey
RegOpenKeyExA
GetSecurityDescriptorOwner
IsValidAcl
GetSecurityDescriptorDacl
IsValidSecurityDescriptor
SetKernelObjectSecurity
GetKernelObjectSecurity
GetSecurityDescriptorControl
AdjustTokenPrivileges
LookupPrivilegeValueA
RegDeleteKeyA
RegEnumKeyExA
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup
OpenProcessToken
GetFileSecurityA
SetFileSecurityA

shell32

ShellExecuteA

comctl32

ord17
ImageList_Destroy

wsock32

ioctlsocket
gethostbyname
setsockopt
htons
WSACleanup
inet_ntoa
htonl
connect
WSAGetLastError
WSAStartup
recv
sendto
recvfrom
closesocket
WSASetLastError
accept
WSAAsyncSelect
ntohs
select
send
socket
bind
inet_addr

wininet

InternetSetFilePointer
InternetQueryDataAvailable
InternetOpenUrlA
InternetCloseHandle
InternetGetLastResponseInfoA
InternetSetStatusCallback
InternetFindNextFileA
FtpFindFirstFileA
FtpOpenFileA
FtpGetCurrentDirectoryA
InternetConnectA
InternetReadFile
FtpSetCurrentDirectoryA
InternetOpenA
InternetWriteFile
InternetCanonicalizeUrlA
InternetQueryOptionA
InternetCrackUrlA

Exports

Exports

??0?$Dar@D@vgui@@QAE@H@Z
??0?$Dar@D@vgui@@QAE@XZ
??0?$Dar@H@vgui@@QAE@H@Z
??0?$Dar@H@vgui@@QAE@XZ
??0?$Dar@PAD@vgui@@QAE@H@Z
??0?$Dar@PAD@vgui@@QAE@XZ
??0?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVActionSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVActionSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVButton@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVButton@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVChangeSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVChangeSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVFrame@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVFrame@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVFrameSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVFrameSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVInputSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVInputSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVLabel@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVLabel@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVPanel@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVPanel@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAE@XZ
??0?$Dar@PAVTickSignal@vgui@@@vgui@@QAE@H@Z
??0?$Dar@PAVTickSignal@vgui@@@vgui@@QAE@XZ
??0App@vgui@@QAE@ABV01@@Z
??0Cursor@vgui@@QAE@ABV01@@Z
??4?$Dar@D@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@H@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAD@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVActionSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVButton@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVFrame@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVInputSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVLabel@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVPanel@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4?$Dar@PAVTickSignal@vgui@@@vgui@@QAEAAV01@ABV01@@Z
??4App@vgui@@QAEAAV01@ABV01@@Z
??4Cursor@vgui@@QAEAAV01@ABV01@@Z
??A?$Dar@D@vgui@@QAEDH@Z
??A?$Dar@H@vgui@@QAEHH@Z
??A?$Dar@PAD@vgui@@QAEPADH@Z
??A?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEPAV?$Dar@D@1@H@Z
??A?$Dar@PAVActionSignal@vgui@@@vgui@@QAEPAVActionSignal@1@H@Z
??A?$Dar@PAVButton@vgui@@@vgui@@QAEPAVButton@1@H@Z
??A?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEPAVChangeSignal@1@H@Z
??A?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEPAVDesktopIcon@1@H@Z
??A?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEPAVFocusChangeSignal@1@H@Z
??A?$Dar@PAVFrame@vgui@@@vgui@@QAEPAVFrame@1@H@Z
??A?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEPAVFrameSignal@1@H@Z
??A?$Dar@PAVInputSignal@vgui@@@vgui@@QAEPAVInputSignal@1@H@Z
??A?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEPAVIntChangeSignal@1@H@Z
??A?$Dar@PAVLabel@vgui@@@vgui@@QAEPAVLabel@1@H@Z
??A?$Dar@PAVPanel@vgui@@@vgui@@QAEPAVPanel@1@H@Z
??A?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEPAVRepaintSignal@1@H@Z
??A?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEPAVSurfaceBase@1@H@Z
??A?$Dar@PAVTickSignal@vgui@@@vgui@@QAEPAVTickSignal@1@H@Z
??_7App@vgui@@6B@
??_7Cursor@vgui@@6B@
?addElement@?$Dar@D@vgui@@QAEXD@Z
?addElement@?$Dar@H@vgui@@QAEXH@Z
?addElement@?$Dar@PAD@vgui@@QAEXPAD@Z
?addElement@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXPAV?$Dar@D@2@@Z
?addElement@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXPAVActionSignal@2@@Z
?addElement@?$Dar@PAVButton@vgui@@@vgui@@QAEXPAVButton@2@@Z
?addElement@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXPAVChangeSignal@2@@Z
?addElement@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXPAVDesktopIcon@2@@Z
?addElement@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXPAVFocusChangeSignal@2@@Z
?addElement@?$Dar@PAVFrame@vgui@@@vgui@@QAEXPAVFrame@2@@Z
?addElement@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXPAVFrameSignal@2@@Z
?addElement@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXPAVInputSignal@2@@Z
?addElement@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXPAVIntChangeSignal@2@@Z
?addElement@?$Dar@PAVLabel@vgui@@@vgui@@QAEXPAVLabel@2@@Z
?addElement@?$Dar@PAVPanel@vgui@@@vgui@@QAEXPAVPanel@2@@Z
?addElement@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXPAVRepaintSignal@2@@Z
?addElement@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXPAVSurfaceBase@2@@Z
?addElement@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXPAVTickSignal@2@@Z
?ensureCapacity@?$Dar@D@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@H@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAD@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVButton@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVFrame@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVLabel@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVPanel@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXH@Z
?ensureCapacity@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXH@Z
?getCount@?$Dar@D@vgui@@QAEHXZ
?getCount@?$Dar@H@vgui@@QAEHXZ
?getCount@?$Dar@PAD@vgui@@QAEHXZ
?getCount@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVButton@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVFrame@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVLabel@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVPanel@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEHXZ
?getCount@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEHXZ
?hasElement@?$Dar@D@vgui@@QAE_ND@Z
?hasElement@?$Dar@H@vgui@@QAE_NH@Z
?hasElement@?$Dar@PAD@vgui@@QAE_NPAD@Z
?hasElement@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAE_NPAV?$Dar@D@2@@Z
?hasElement@?$Dar@PAVActionSignal@vgui@@@vgui@@QAE_NPAVActionSignal@2@@Z
?hasElement@?$Dar@PAVButton@vgui@@@vgui@@QAE_NPAVButton@2@@Z
?hasElement@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAE_NPAVChangeSignal@2@@Z
?hasElement@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAE_NPAVDesktopIcon@2@@Z
?hasElement@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAE_NPAVFocusChangeSignal@2@@Z
?hasElement@?$Dar@PAVFrame@vgui@@@vgui@@QAE_NPAVFrame@2@@Z
?hasElement@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAE_NPAVFrameSignal@2@@Z
?hasElement@?$Dar@PAVInputSignal@vgui@@@vgui@@QAE_NPAVInputSignal@2@@Z
?hasElement@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAE_NPAVIntChangeSignal@2@@Z
?hasElement@?$Dar@PAVLabel@vgui@@@vgui@@QAE_NPAVLabel@2@@Z
?hasElement@?$Dar@PAVPanel@vgui@@@vgui@@QAE_NPAVPanel@2@@Z
?hasElement@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAE_NPAVRepaintSignal@2@@Z
?hasElement@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAE_NPAVSurfaceBase@2@@Z
?hasElement@?$Dar@PAVTickSignal@vgui@@@vgui@@QAE_NPAVTickSignal@2@@Z
?insertElementAt@?$Dar@D@vgui@@QAEXDH@Z
?insertElementAt@?$Dar@H@vgui@@QAEXHH@Z
?insertElementAt@?$Dar@PAD@vgui@@QAEXPADH@Z
?insertElementAt@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXPAV?$Dar@D@2@H@Z
?insertElementAt@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXPAVActionSignal@2@H@Z
?insertElementAt@?$Dar@PAVButton@vgui@@@vgui@@QAEXPAVButton@2@H@Z
?insertElementAt@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXPAVChangeSignal@2@H@Z
?insertElementAt@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXPAVDesktopIcon@2@H@Z
?insertElementAt@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXPAVFocusChangeSignal@2@H@Z
?insertElementAt@?$Dar@PAVFrame@vgui@@@vgui@@QAEXPAVFrame@2@H@Z
?insertElementAt@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXPAVFrameSignal@2@H@Z
?insertElementAt@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXPAVInputSignal@2@H@Z
?insertElementAt@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXPAVIntChangeSignal@2@H@Z
?insertElementAt@?$Dar@PAVLabel@vgui@@@vgui@@QAEXPAVLabel@2@H@Z
?insertElementAt@?$Dar@PAVPanel@vgui@@@vgui@@QAEXPAVPanel@2@H@Z
?insertElementAt@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXPAVRepaintSignal@2@H@Z
?insertElementAt@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXPAVSurfaceBase@2@H@Z
?insertElementAt@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXPAVTickSignal@2@H@Z
?putElement@?$Dar@D@vgui@@QAEXD@Z
?putElement@?$Dar@H@vgui@@QAEXH@Z
?putElement@?$Dar@PAD@vgui@@QAEXPAD@Z
?putElement@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXPAV?$Dar@D@2@@Z
?putElement@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXPAVActionSignal@2@@Z
?putElement@?$Dar@PAVButton@vgui@@@vgui@@QAEXPAVButton@2@@Z
?putElement@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXPAVChangeSignal@2@@Z
?putElement@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXPAVDesktopIcon@2@@Z
?putElement@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXPAVFocusChangeSignal@2@@Z
?putElement@?$Dar@PAVFrame@vgui@@@vgui@@QAEXPAVFrame@2@@Z
?putElement@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXPAVFrameSignal@2@@Z
?putElement@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXPAVInputSignal@2@@Z
?putElement@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXPAVIntChangeSignal@2@@Z
?putElement@?$Dar@PAVLabel@vgui@@@vgui@@QAEXPAVLabel@2@@Z
?putElement@?$Dar@PAVPanel@vgui@@@vgui@@QAEXPAVPanel@2@@Z
?putElement@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXPAVRepaintSignal@2@@Z
?putElement@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXPAVSurfaceBase@2@@Z
?putElement@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXPAVTickSignal@2@@Z
?removeAll@?$Dar@D@vgui@@QAEXXZ
?removeAll@?$Dar@H@vgui@@QAEXXZ
?removeAll@?$Dar@PAD@vgui@@QAEXXZ
?removeAll@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVButton@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVFrame@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVLabel@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVPanel@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXXZ
?removeAll@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXXZ
?removeElement@?$Dar@D@vgui@@QAEXD@Z
?removeElement@?$Dar@H@vgui@@QAEXH@Z
?removeElement@?$Dar@PAD@vgui@@QAEXPAD@Z
?removeElement@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXPAV?$Dar@D@2@@Z
?removeElement@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXPAVActionSignal@2@@Z
?removeElement@?$Dar@PAVButton@vgui@@@vgui@@QAEXPAVButton@2@@Z
?removeElement@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXPAVChangeSignal@2@@Z
?removeElement@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXPAVDesktopIcon@2@@Z
?removeElement@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXPAVFocusChangeSignal@2@@Z
?removeElement@?$Dar@PAVFrame@vgui@@@vgui@@QAEXPAVFrame@2@@Z
?removeElement@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXPAVFrameSignal@2@@Z
?removeElement@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXPAVInputSignal@2@@Z
?removeElement@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXPAVIntChangeSignal@2@@Z
?removeElement@?$Dar@PAVLabel@vgui@@@vgui@@QAEXPAVLabel@2@@Z
?removeElement@?$Dar@PAVPanel@vgui@@@vgui@@QAEXPAVPanel@2@@Z
?removeElement@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXPAVRepaintSignal@2@@Z
?removeElement@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXPAVSurfaceBase@2@@Z
?removeElement@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXPAVTickSignal@2@@Z
?removeElementAt@?$Dar@D@vgui@@QAEXH@Z
?removeElementAt@?$Dar@H@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAD@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVButton@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVFrame@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVLabel@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVPanel@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXH@Z
?removeElementAt@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@D@vgui@@QAEXH@Z
?setCount@?$Dar@H@vgui@@QAEXH@Z
?setCount@?$Dar@PAD@vgui@@QAEXH@Z
?setCount@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVButton@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVFrame@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVLabel@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVPanel@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXH@Z
?setCount@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXH@Z
?setElementAt@?$Dar@D@vgui@@QAEXDH@Z
?setElementAt@?$Dar@H@vgui@@QAEXHH@Z
?setElementAt@?$Dar@PAD@vgui@@QAEXPADH@Z
?setElementAt@?$Dar@PAV?$Dar@D@vgui@@@vgui@@QAEXPAV?$Dar@D@2@H@Z
?setElementAt@?$Dar@PAVActionSignal@vgui@@@vgui@@QAEXPAVActionSignal@2@H@Z
?setElementAt@?$Dar@PAVButton@vgui@@@vgui@@QAEXPAVButton@2@H@Z
?setElementAt@?$Dar@PAVChangeSignal@vgui@@@vgui@@QAEXPAVChangeSignal@2@H@Z
?setElementAt@?$Dar@PAVDesktopIcon@vgui@@@vgui@@QAEXPAVDesktopIcon@2@H@Z
?setElementAt@?$Dar@PAVFocusChangeSignal@vgui@@@vgui@@QAEXPAVFocusChangeSignal@2@H@Z
?setElementAt@?$Dar@PAVFrame@vgui@@@vgui@@QAEXPAVFrame@2@H@Z
?setElementAt@?$Dar@PAVFrameSignal@vgui@@@vgui@@QAEXPAVFrameSignal@2@H@Z
?setElementAt@?$Dar@PAVInputSignal@vgui@@@vgui@@QAEXPAVInputSignal@2@H@Z
?setElementAt@?$Dar@PAVIntChangeSignal@vgui@@@vgui@@QAEXPAVIntChangeSignal@2@H@Z
?setElementAt@?$Dar@PAVLabel@vgui@@@vgui@@QAEXPAVLabel@2@H@Z
?setElementAt@?$Dar@PAVPanel@vgui@@@vgui@@QAEXPAVPanel@2@H@Z
?setElementAt@?$Dar@PAVRepaintSignal@vgui@@@vgui@@QAEXPAVRepaintSignal@2@H@Z
?setElementAt@?$Dar@PAVSurfaceBase@vgui@@@vgui@@QAEXPAVSurfaceBase@2@H@Z
?setElementAt@?$Dar@PAVTickSignal@vgui@@@vgui@@QAEXPAVTickSignal@2@H@Z

Sections

.text
Size: 684KB - Virtual size: 682KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 255KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cdf9f382d781d7f55562fca05df07d9

Headers

File Characteristics

Imports

wonauth

woncrypt

vgui

ddraw

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

wsock32

wininet

Exports

Exports

Sections

.text Size: 684KB - Virtual size: 682KB

.rdata Size: 132KB - Virtual size: 129KB

.data Size: 52KB - Virtual size: 255KB

.rsrc Size: 48KB - Virtual size: 45KB

.text
Size: 684KB - Virtual size: 682KB

.rdata
Size: 132KB - Virtual size: 129KB

.data
Size: 52KB - Virtual size: 255KB

.rsrc
Size: 48KB - Virtual size: 45KB