Static task
static1
Behavioral task
behavioral1
Sample
gamesense.dll
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
gamesense.dll
Resource
win10v2004-20230220-en
General
-
Target
gamesense.dll
-
Size
5.9MB
-
MD5
e5ae79178b8393df92724a9a23458faf
-
SHA1
cf1c1fc882eb9aec2fda9ae53c9142d127297919
-
SHA256
3cac603f1c9ebdf4a5abd23712ce415ef22c0e016b47368d23f45ee8a2339fb2
-
SHA512
18dfc46fb2c6cd394c310576c8a858ab8d9e2cee4edda37ed474d837bbbe38ea806ea2def37c0acabf6c86da9c703a53bdd27293dec848ae2d52aa7841c1f234
-
SSDEEP
98304:tdp1EOumt5JCO9zHWvZHF5d3yfHrBYcocYpLD:thZDJcZHF7IrBYcFYp
Malware Config
Signatures
Files
-
gamesense.dll.dll windows x86
43c13e4850d550b4ebdcfc8f26e16589
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
WSACleanup
closesocket
getaddrinfo
WSAStartup
WSAGetLastError
socket
connect
recv
freeaddrinfo
send
kernel32
SetLastError
VirtualProtect
CreateDirectoryA
FindFirstFileA
FindNextFileA
FindClose
GetLastError
CloseHandle
GetCurrentProcessId
MultiByteToWideChar
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
WriteProcessMemory
GetCurrentProcess
CreateThread
WideCharToMultiByte
GetModuleHandleA
K32GetModuleInformation
EnterCriticalSection
LoadLibraryA
GetProcAddress
FormatMessageA
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
FindNextFileW
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
AreFileApisANSI
FindFirstFileExW
GetCurrentThreadId
FlushInstructionCache
FreeLibrary
GetSystemTimeAsFileTime
InitializeSListHead
LoadLibraryExA
GetModuleFileNameA
LocalFree
user32
ScreenToClient
CallWindowProcA
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseCapture
FindWindowA
GetCapture
SetCursorPos
GetClientRect
SetCursor
GetForegroundWindow
IsChild
ClientToScreen
GetKeyState
GetAsyncKeyState
GetCursorPos
SetCapture
LoadCursorA
MessageBoxA
shell32
ShellExecuteA
SHGetFolderPathA
msvcp140
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?good@ios_base@std@@QBE_NXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPBDH@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBE_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?setf@ios_base@std@@QAEHHH@Z
?setf@ios_base@std@@QAEHH@Z
?uncaught_exception@std@@YA_NXZ
?rdstate@ios_base@std@@QBEHXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Xtime_get_ticks
?_Xinvalid_argument@std@@YAXPBD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?bad@ios_base@std@@QBE_NXZ
_Query_perf_frequency
_Thrd_sleep
_Query_perf_counter
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?fail@ios_base@std@@QBE_NXZ
d3dx9_43
D3DXCreateTextureFromFileInMemory
D3DXCreateTextureFromFileA
D3DXCreateTextureFromFileInMemoryEx
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
xinput1_3
ord2
ord4
vcruntime140
__std_exception_copy
__CxxFrameHandler3
_purecall
__std_type_info_destroy_list
_except_handler4_common
_CxxThrowException
__current_exception_context
__current_exception
_setjmp3
memchr
memmove
longjmp
strrchr
memcpy
memcmp
memset
strchr
strstr
__std_exception_destroy
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
malloc
free
api-ms-win-crt-math-l1-1-0
fmaxf
llround
copysignf
_dsign
_libm_sse2_atan_precise
_fdclass
remainderf
_libm_sse2_pow_precise
_dclass
ldexp
ceil
_libm_sse2_tan_precise
_libm_sse2_sqrt_precise
_libm_sse2_sin_precise
roundf
_libm_sse2_log_precise
_libm_sse2_log10_precise
_libm_sse2_exp_precise
_libm_sse2_cos_precise
_libm_sse2_asin_precise
_libm_sse2_acos_precise
_CIfmod
_CIatan2
floor
frexp
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
exit
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
abort
_seh_filter_dll
strerror
_errno
terminate
system
api-ms-win-crt-stdio-l1-1-0
tmpfile
_popen
_pclose
__stdio_common_vsprintf_s
_ftelli64
clearerr
__stdio_common_vfprintf
__stdio_common_vsprintf
tmpnam
__acrt_iob_func
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
getc
freopen
setvbuf
fgets
fgetpos
fputc
fflush
ferror
feof
fwrite
fclose
ftell
fseek
fgetc
_wfopen
__stdio_common_vsscanf
fopen
api-ms-win-crt-utility-l1-1-0
rand
qsort
srand
api-ms-win-crt-string-l1-1-0
isprint
strncmp
strncpy
strpbrk
isdigit
isspace
isalnum
toupper
isblank
strcoll
strspn
iswalpha
strcpy_s
towlower
isalpha
isupper
islower
isxdigit
ispunct
isgraph
iscntrl
tolower
api-ms-win-crt-convert-l1-1-0
strtoull
strtol
atoi
strtoul
strtoll
strtod
atof
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
rename
remove
api-ms-win-crt-locale-l1-1-0
setlocale
localeconv
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
strftime
_mktime64
_localtime64
_time64
_gmtime64
clock
_difftime64
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 480KB - Virtual size: 480KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2.9MB - Virtual size: 10.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ