Hexane (1)[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Hexane (1).exe
Size

169.3MB
MD5

82046c276101884e897f39e0fb2cdfbc
SHA1

c9b94fcaa626e749c6dbfd4c54f98da4d4a7f428
SHA256

ab651def3f3d4410d896f25ace994ae34fc4198ed014fdb833e894b59779ab66
SHA512

25dc8f36ea6acdb19f7ef312a70ba02bf362ff4304d83d81ad2dfd61a7f9fcd59d825ec32adff1c53d7ff2bd8044463155f3a5965a431e7e7887d2db2205efa6
SSDEEP

1572864:wnWFBYnWFB6K6InbInA3zL11wf0N8ispaWvYOB:wnWFBYnWFBcmPwMrEY

Score

1^/10

Malware Config

Signatures

Files

Hexane (1).exe
.exe windows x64

07aff04e7532fa67ab746e0c807ccfdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

x3daudio1_7

X3DAudioCalculate
X3DAudioInitialize

xapofx1_5

CreateFX

ws2_32

accept
__WSAFDIsSet
inet_pton
getnameinfo
gethostname
freeaddrinfo
getaddrinfo
WSAAddressToStringW
WSASocketW
socket
WSARecv
WSAIoctl
WSAGetLastError
WSASetLastError
WSACleanup
WSAStartup
shutdown
setsockopt
select
ntohs
ntohl
listen
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
sendto
send
recvfrom
WSASend
recv
gethostbyname

user32

SetWindowLongPtrW
GetWindowLongPtrW
SetRect
MsgWaitForMultipleObjects
MoveWindow
RegisterClassExW
EnumDisplayDevicesA
RegisterWindowMessageW
PostThreadMessageW
GetQueueStatus
ChangeDisplaySettingsExW
ChangeDisplaySettingsW
SetRectEmpty
GetKeyNameTextW
GetWindowDisplayAffinity
SetWindowDisplayAffinity
GetDesktopWindow
SetWindowPlacement
GetProcessWindowStation
GetUserObjectInformationW
IsIconic
GetWindowPlacement
GetKeyboardLayout
IsZoomed
SetFocus
GetActiveWindow
GetFocus
MapVirtualKeyW
GetRawInputData
FlashWindowEx
GetRawInputDeviceInfoW
RegisterRawInputDevices
GetRawInputDeviceList
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
PostQuitMessage
SetWindowPos
IsWindowVisible
DialogBoxParamW
EndDialog
GetDlgItem
SetDlgItemTextW
GetSystemMetrics
EnumDisplayDevicesW
GetWindow
GetWindowThreadProcessId
GetWindowInfo
EnumDisplayMonitors
GetMonitorInfoW
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
PostMessageW
EmptyClipboard
AllowSetForegroundWindow
PeekMessageW
RegisterHotKey
UnregisterHotKey
MonitorFromWindow
MonitorFromRect
MonitorFromPoint
SystemParametersInfoW
EnumDisplaySettingsW
SetForegroundWindow
LoadImageW
LoadIconW
LoadCursorFromFileW
LoadCursorW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
SendMessageW
GetMessageExtraInfo
DispatchMessageW
TranslateMessage
GetRawInputDeviceInfoA
DisableProcessWindowsGhosting
GetTopWindow
EnumWindows
ScreenToClient
MessageBoxW
GetWindowRect
SetWindowTextW
CreateIconIndirect
GetKeyState
GetAsyncKeyState
SendInput
GetTouchInputInfo
CloseTouchInputHandle
RegisterTouchWindow
GetCapture
SetCapture
ReleaseCapture
EnableWindow
IsWindowEnabled
GetSystemMenu
EnableMenuItem
DrawStateW
UpdateWindow
SetActiveWindow
GetForegroundWindow
FindWindowW
GetClassLongPtrW
SetWindowLongW
GetWindowLongW
ClipCursor
WindowFromPoint
ClientToScreen
GetClipCursor
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
AdjustWindowRectEx
GetClientRect
GetWindowTextW
InvalidateRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC

advapi32

CryptSetHashParam
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
GetUserNameW
RegEnumValueW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteTreeW
AllocateLocallyUniqueId
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
RegCloseKey
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
RegDeleteKeyExW

gdi32

GetTextMetricsW
CreateFontW
SwapBuffers
SetPixelFormat
ChoosePixelFormat
CreateFontIndirectW
TextOutW
GetObjectW
CreateDIBSection
SetTextAlign
SetTextColor
SetBkMode
SetBkColor
SelectObject
PtInRegion
GetStockObject
GetPixel
GetDeviceCaps
DeleteObject
CreateRoundRectRgn
CreateRectRgn
GetTextExtentPoint32W
DeleteDC
CreateCompatibleDC
CreateBitmap

crypt32

CertOpenStore
CertOpenSystemStoreW
CertGetNameStringW
CertEnumCertificatesInStore
CertCloseStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty

wldap32

ord211
ord50
ord41
ord22
ord60
ord26
ord27
ord32
ord143
ord33
ord35
ord46
ord79
ord301
ord200
ord30

normaliz

IdnToUnicode
IdnToAscii

xinput1_3

ord3
ord2

dxgi

CreateDXGIFactory
CreateDXGIFactory1

d3d9

D3DPERF_BeginEvent
D3DPERF_EndEvent

d3d11

D3D11CreateDevice

d3dcompiler_43

D3DDisassemble

dsound

ord11
ord8
ord6
ord12
ord1
ord3

winmm

timeBeginPeriod
timeEndPeriod
timeSetEvent
timeGetTime
waveOutGetNumDevs

kernel32

FreeConsole
AllocConsole
GetSystemDefaultLCID
GetLocaleInfoW
QueryIdleProcessorCycleTime
SetThreadAffinityMask
QueryFullProcessImageNameW
ReOpenFile
MoveFileW
GetComputerNameW
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemPowerStatus
GetNumaProcessorNodeEx
GetUserPreferredUILanguages
GetUserDefaultLocaleName
SetConsoleCtrlHandler
OpenFileMappingW
VirtualProtect
GetNativeSystemInfo
GetLogicalProcessorInformationEx
GetVersionExW
GetLocalTime
GetSystemTimeAsFileTime
GetSystemTime
GlobalMemoryStatusEx
GetThreadIdealProcessorEx
GetCurrentProcessorNumber
OpenProcess
FlushInstructionCache
GetConsoleWindow
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
InitializeProcThreadAttributeList
SetPriorityClass
CreateProcessW
ResumeThread
SuspendThread
GetModuleHandleW
SwitchToThread
GetExitCodeProcess
TerminateProcess
GetProcessTimes
K32EnumProcessModules
OpenSemaphoreW
ReleaseSemaphore
CreateNamedPipeW
PeekNamedPipe
DisconnectNamedPipe
SetThreadErrorMode
OutputDebugStringW
DebugBreak
IsDebuggerPresent
GetTempPathW
SetFileTime
SetFilePointer
SetFileAttributesW
RemoveDirectoryW
GetLongPathNameW
GetFullPathNameW
GetFinalPathNameByHandleW
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
DeleteFileW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetEnvironmentVariableW
RtlCaptureStackBackTrace
GetOverlappedResult
ConnectNamedPipe
Thread32Next
Thread32First
CreateToolhelp32Snapshot
K32GetModuleFileNameExW
K32EnumProcessModulesEx
GetModuleHandleExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetNumaNodeProcessorMaskEx
QueryProcessCycleTime
LoadLibraryExA
GetModuleFileNameA
SetConsoleWindowInfo
SetConsoleTextAttribute
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GetModuleFileNameW
OpenThread
AttachConsole
K32GetModuleFileNameExA
K32GetProcessMemoryInfo
Process32FirstW
Process32NextW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
GetProcessHandleCount
GetThreadContext
GetDllDirectoryW
VirtualQuery
SetDllDirectoryW
GetTickCount
LocalAlloc
LoadLibraryExW
HeapAlloc
GetSystemDirectoryW
CompareFileTime
CreateFileMappingA
VerifyVersionInfoA
GetSystemDirectoryA
ExpandEnvironmentStringsA
GetDateFormatEx
GetTimeFormatEx
HeapFree
GetProcessHeap
WaitForSingleObjectEx
GetTickCount64
GetFileSize
DeviceIoControl
MulDiv
GetFileInformationByHandle
DuplicateHandle
SetNamedPipeHandleState
CancelSynchronousIo
GetThreadPriority
GetThreadId
SetThreadContext
VirtualAllocEx
VirtualProtectEx
VirtualQueryEx
ReadProcessMemory
VirtualFreeEx
CreateJobObjectW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
AssignProcessToJobObject
GetVersion
SetInformationJobObject
ResolveLocaleName
GetCurrencyFormatEx
GetNumberFormatEx
LocaleNameToLCID
LCIDToLocaleName
GetUserGeoID
GetGeoInfoW
GetDynamicTimeZoneInformation
GetLocaleInfoEx
GetACP
VirtualUnlock
GetLargePageMinimum
FlsSetValue
FlsAlloc
GetFullPathNameA
lstrcmpA
GetEnvironmentVariableA
GetModuleHandleExA
SleepConditionVariableCS
WakeConditionVariable
InitializeConditionVariable
InitializeCriticalSectionEx
CreateSemaphoreA
CreateProcessA
OutputDebugStringA
GetTempFileNameA
GetTempPathA
GetCommandLineA
ReadConsoleW
ReadConsoleA
SetConsoleMode
K32GetModuleInformation
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
GetStartupInfoW
CreateSemaphoreW
lstrcmpW
GetConsoleMode
ConvertThreadToFiber
ConvertFiberToThread
RtlVirtualUnwind
CreateFiber
DeleteFiber
InitializeCriticalSection
SetCriticalSectionSpinCount
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
QueryPerformanceCounter
GetCurrentThreadId
TlsGetValue
TlsSetValue
GetStdHandle
GetCommandLineW
FindClose
FindFirstFileW
GetFileType
GetLastError
SetErrorMode
ReleaseMutex
CreateMutexW
Sleep
GetCurrentProcessId
LocalFree
WriteConsoleW
VerSetConditionMask
CloseHandle
SetLastError
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
InitializeCriticalSectionAndSpinCount
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
SetWaitableTimer
WaitForMultipleObjects
CreateWaitableTimerW
QueueUserAPC
TerminateThread
TlsAlloc
TlsFree
GetModuleHandleA
GetProcAddress
FormatMessageA
VerifyVersionInfoW
WideCharToMultiByte
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
CreateFileW
GetFileAttributesExW
GetFileSizeEx
SetEndOfFile
SetFilePointerEx
GetSystemInfo
CreateFileMappingW
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
MultiByteToWideChar
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
TryEnterCriticalSection
FreeLibrary
LoadLibraryA
LoadLibraryW
FormatMessageW
CreateFileA
ReadFile
WriteFile
QueryPerformanceFrequency
CreateThread
HeapSetInformation
VirtualAlloc
VirtualFree
SetHandleInformation
CreatePipe
OpenEventW
GetFileAttributesW
RaiseException
SetUnhandledExceptionFilter
ResetEvent
GetCurrentProcess
ExitProcess
GetCurrentThread
SetThreadPriority
GetProcessId
SwitchToFiber

comdlg32

ChooseFontW

shell32

SHGetKnownFolderPath
CommandLineToArgvW
SHGetFolderPathW
SHCreateItemFromParsingName
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW

ole32

OleInitialize
OleUninitialize
RegisterDragDrop
CoInitialize
CoCreateGuid
RevokeDragDrop
StringFromGUID2
CoUninitialize
CoTaskMemFree
PropVariantClear
ReleaseStgMedium
IIDFromString
PropVariantCopy
CoTaskMemAlloc
CoFreeUnusedLibraries
CoCreateInstance

oleaut32

SafeArrayPutElement
SysFreeString
SysAllocString
SafeArrayCreateVector
VariantClear
VariantInit
VariantCopy

netapi32

NetApiBufferFree
NetShareGetInfo

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsExW
SetupDiOpenDevRegKey
CM_Get_Device_IDW
SetupGetInfDriverStoreLocationW
SetupDiGetDevicePropertyW
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList

dwmapi

DwmGetCompositionTimingInfo
DwmFlush
DwmIsCompositionEnabled
DwmSetWindowAttribute

imm32

ImmCreateContext
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmGetDescriptionW
ImmGetIMEFileNameW
ImmGetProperty
ImmNotifyIME
ImmDestroyContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCandidateWindow

uiautomationcore

UiaClientsAreListening
UiaRaiseAutomationPropertyChangedEvent
UiaRaiseAutomationEvent
UiaReturnRawElementProvider
UiaHostProviderFromHwnd

opengl32

wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
wglCreateContext

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpGetDefaultProxyConfiguration
WinHttpSetStatusCallback
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser
WinHttpReadData

msvcp140

?_Xlength_error@std@@YAXPEBD@Z
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Thrd_join
_Thrd_id
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_do_broadcast_at_thread_exit
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
_Mbrtowc
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_W_Getdays@_Locinfo@std@@QEBAPEBGXZ
?_W_Getmonths@_Locinfo@std@@QEBAPEBGXZ
??Bid@locale@std@@QEAA_KXZ
?classic@locale@std@@SAAEBV12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?toupper@?$ctype@D@std@@QEBADD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xbad_function_call@std@@YAXXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Random_device@std@@YAIXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
_Thrd_start
_Mtx_init
_Mtx_destroy
_Cnd_init
_Cnd_destroy
_Cnd_wait
_Cnd_signal
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@F@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
?setbase@std@@YA?AU?$_Smanip@H@1@H@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
_Thrd_yield
?get_new_handler@std@@YAP6AXXZXZ
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_broadcast
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

powrprof

CallNtPowerInformation

bcrypt

BCryptGenRandom

vcruntime140

__std_type_info_destroy_list
__intrinsic_setjmp
__current_exception_context
__current_exception
__RTtypeid
__std_type_info_name
longjmp
_set_purecall_handler
strrchr
__RTDynamicCast
__CxxFrameHandler3
strstr
wcsrchr
wcschr
strchr
wcsstr
memchr
_CxxThrowException
__std_exception_destroy
__std_exception_copy
_purecall
__C_specific_handler
memcpy
__std_terminate
memmove
memset
memcmp
__std_type_info_compare

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-convert-l1-1-0

atof
_strtoi64
wcstod
wcstoul
strtoul
wcstol
_wcstoi64
strtoull
strtod
atol
_strtod_l
_strtoui64
_wcstoui64
_wtoi64
atoi
strtol
_wtoi
_wtof
strtoll
mbstowcs

api-ms-win-crt-runtime-l1-1-0

_wassert
_initialize_narrow_environment
_initialize_onexit_table
strerror_s
_register_onexit_function
_endthreadex
_getpid
_exit
raise
_set_abort_behavior
_set_error_mode
_execute_onexit_table
_Exit
_errno
_invalid_parameter_noinfo
abort
_crt_atexit
signal
_beginthreadex
_crt_at_quick_exit
_cexit
_seh_filter_exe
terminate
_set_app_type
_invoke_watson
_invalid_parameter_noinfo_noreturn
__sys_nerr
_get_narrow_winmain_command_line
strerror
_initterm
_initterm_e
_set_invalid_parameter_handler
exit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_dll
_configure_narrow_argv

api-ms-win-crt-utility-l1-1-0

rand
srand
bsearch
div
qsort

api-ms-win-crt-stdio-l1-1-0

putc
__stdio_common_vfwprintf_s
_fileno
_setmode
fgets
__stdio_common_vfwprintf_p
rewind
__stdio_common_vfprintf
__stdio_common_vfwscanf
__stdio_common_vswprintf_s
__stdio_common_vsnwprintf_s
ferror
__stdio_common_vsprintf_s
feof
fopen_s
setbuf
__stdio_common_vsnprintf_s
clearerr
__stdio_common_vswprintf_p
__stdio_common_vswscanf
__stdio_common_vfprintf_s
__stdio_common_vfprintf_p
__stdio_common_vsscanf
ftell
fseek
_wfopen
__stdio_common_vfscanf
_lseeki64
__stdio_common_vsprintf_p
__stdio_common_vsprintf
ungetc
fwrite
fopen
_fseeki64
fsetpos
fputs
fread
fputc
fgetpos
fgetc
fclose
_get_stream_buffer_pointers
setvbuf
fflush
__stdio_common_vswprintf
__stdio_common_vfwprintf
__acrt_iob_func
_set_fmode
__p__commode
_close
_getcwd
_creat
_isatty
_open_osfhandle
_dup
_dup2
_read
_write
_open
getc
puts

api-ms-win-crt-string-l1-1-0

strtok
_wcsdup
iscntrl
strncat
isxdigit
wcsncmp
wcsncpy
iswspace
isdigit
tolower
strlen
_wcsicmp
wcslen
wcscmp
iswalpha
isalpha
strpbrk
wmemcpy_s
_strdup
strspn
strcspn
_strnicmp
strcpy_s
wcscpy_s
iswpunct
towlower
isupper
islower
isgraph
towupper
iswlower
strnlen
wcsnlen
strncpy_s
_strupr
_wcsupr
wcsncpy_s
_wcsnicmp
wcstok
iswalnum
iswupper
strtok_s
isprint
strncmp
iswdigit
iswxdigit
strcmp
toupper
isspace
strncpy
_stricmp
isalnum

api-ms-win-crt-math-l1-1-0

__setusermatherr
modff
exp2
_fpclass
roundf
sqrtf
pow
_dtest
cosf
expf
truncf
lrint
atanf
sinf
tanf
_isnan
lrintf
acos
cos
sin
tan
sinhf
atan
log10f
fabs
_fdtest
fmod
exp
sqrt
floor
trunc
_dsign
log
fmodf
ldexp
logf
atan2
atan2f
frexp
_fdopen
lroundf
log10
round
floorf
ceilf
ceil
_finite
acosf
asinf
modf
asin
powf

api-ms-win-crt-heap-l1-1-0

free
_heapchk
_aligned_free
malloc
realloc
_set_new_mode
_aligned_malloc
_get_heap_handle
calloc

api-ms-win-crt-time-l1-1-0

_ftime64
__timezone
_gmtime64
_gmtime64_s
_time64
_localtime64_s
_tzset
__tzname

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_unlock_file
_chmod
_stat64
_stat64i32
remove
_fstat64i32
_mkdir
_lock_file

api-ms-win-crt-locale-l1-1-0

__initialize_lconv_for_unsigned_char
_configthreadlocale
_free_locale
setlocale
_create_locale

api-ms-win-crt-environment-l1-1-0

_wgetenv
_putenv
getenv

api-ms-win-crt-conio-l1-1-0

_cputs

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
agsCheckDriverVersion
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_CreateDevice
agsDriverExtensionsDX11_CreateFromDevice
agsDriverExtensionsDX11_Destroy
agsDriverExtensionsDX11_DestroyDevice
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsDriverExtensionsDX11_WriteBreadcrumb
agsDriverExtensionsDX12_CreateCommandList
agsDriverExtensionsDX12_CreateDevice
agsDriverExtensionsDX12_CreateFromDevice
agsDriverExtensionsDX12_CreateGraphicsPipelineState
agsDriverExtensionsDX12_Destroy
agsDriverExtensionsDX12_DestroyCommandList
agsDriverExtensionsDX12_DestroyDevice
agsDriverExtensionsDX12_PopMarker
agsDriverExtensionsDX12_PushMarker
agsDriverExtensionsDX12_SetDepthBounds
agsDriverExtensionsDX12_SetMarker
agsInit
agsSetDisplayMode
png_access_version_number
png_benign_error
png_build_grayscale_palette
png_calloc
png_chunk_benign_error
png_chunk_error
png_chunk_warning
png_convert_from_struct_tm
png_convert_from_time_t
png_convert_to_rfc1123
png_create_info_struct
png_create_read_struct
png_create_read_struct_2
png_create_write_struct
png_create_write_struct_2
png_data_freer
png_destroy_info_struct
png_destroy_read_struct
png_destroy_write_struct
png_error
png_free
png_free_data
png_free_default
png_get_IHDR
png_get_PLTE
png_get_bKGD
png_get_bit_depth
png_get_cHRM
png_get_cHRM_fixed
png_get_channels
png_get_chunk_cache_max
png_get_chunk_malloc_max
png_get_color_type
png_get_compression_buffer_size
png_get_compression_type
png_get_copyright
png_get_current_pass_number
png_get_current_row_number
png_get_error_ptr
png_get_filter_type
png_get_gAMA
png_get_gAMA_fixed
png_get_hIST
png_get_header_ver
png_get_header_version
png_get_iCCP
png_get_image_height
png_get_image_width
png_get_int_32
png_get_interlace_type
png_get_io_chunk_name
png_get_io_chunk_type
png_get_io_ptr
png_get_io_state
png_get_libpng_ver
png_get_mem_ptr
png_get_oFFs
png_get_pCAL
png_get_pHYs
png_get_pHYs_dpi
png_get_pixel_aspect_ratio
png_get_pixel_aspect_ratio_fixed
png_get_pixels_per_inch
png_get_pixels_per_meter
png_get_rgb_to_gray_status
png_get_rowbytes
png_get_rows
png_get_sBIT
png_get_sCAL
png_get_sCAL_fixed
png_get_sCAL_s
png_get_sPLT
png_get_sRGB
png_get_signature
png_get_tIME
png_get_tRNS
png_get_text
png_get_uint_16
png_get_uint_31
png_get_uint_32
png_get_unknown_chunks
png_get_user_chunk_ptr
png_get_user_height_max
png_get_user_transform_ptr
png_get_user_width_max
png_get_valid
png_get_x_offset_inches
png_get_x_offset_inches_fixed
png_get_x_offset_microns
png_get_x_offset_pixels
png_get_x_pixels_per_inch
png_get_x_pixels_per_meter
png_get_y_offset_inches
png_get_y_offset_inches_fixed
png_get_y_offset_microns
png_get_y_offset_pixels
png_get_y_pixels_per_inch
png_get_y_pixels_per_meter
png_handle_as_unknown
png_info_init_3
png_init_io
png_longjmp
png_malloc
png_malloc_default
png_malloc_warn
png_permit_mng_features
png_read_end
png_read_image
png_read_info
png_read_png
png_read_row
png_read_rows
png_read_update_info
png_reset_zstream
png_save_int_32
png_save_uint_16
png_save_uint_32
png_set_IHDR
png_set_PLTE
png_set_add_alpha
png_set_bKGD
png_set_background
png_set_background_fixed
png_set_benign_errors
png_set_bgr
png_set_cHRM
png_set_cHRM_fixed
png_set_chunk_cache_max
png_set_chunk_malloc_max
png_set_compression_buffer_size
png_set_compression_level
png_set_compression_mem_level
png_set_compression_method
png_set_compression_strategy
png_set_compression_window_bits
png_set_crc_action
png_set_error_fn
png_set_expand
png_set_expand_16
png_set_expand_gray_1_2_4_to_8
png_set_filler
png_set_filter
png_set_filter_heuristics
png_set_filter_heuristics_fixed
png_set_flush
png_set_gAMA
png_set_gAMA_fixed
png_set_gamma
png_set_gamma_fixed
png_set_gray_to_rgb
png_set_hIST
png_set_iCCP
png_set_interlace_handling
png_set_invalid
png_set_invert_alpha
png_set_invert_mono
png_set_keep_unknown_chunks
png_set_longjmp_fn
png_set_mem_fn
png_set_oFFs
png_set_pCAL
png_set_pHYs
png_set_packing
png_set_packswap
png_set_palette_to_rgb
png_set_quantize
png_set_read_fn
png_set_read_status_fn
png_set_read_user_chunk_fn
png_set_read_user_transform_fn
png_set_rgb_to_gray
png_set_rgb_to_gray_fixed
png_set_rows
png_set_sBIT
png_set_sCAL
png_set_sCAL_fixed
png_set_sCAL_s
png_set_sPLT
png_set_sRGB
png_set_sRGB_gAMA_and_cHRM
png_set_shift
png_set_sig_bytes
png_set_strip_16
png_set_strip_alpha
png_set_swap
png_set_swap_alpha
png_set_tIME
png_set_tRNS
png_set_tRNS_to_alpha
png_set_text
png_set_unknown_chunk_location
png_set_unknown_chunks
png_set_user_limits
png_set_user_transform_info
png_set_write_fn
png_set_write_status_fn
png_set_write_user_transform_fn
png_sig_cmp
png_start_read_image
png_warning
png_write_chunk
png_write_chunk_data
png_write_chunk_end
png_write_chunk_start
png_write_end
png_write_flush
png_write_image
png_write_info
png_write_info_before_PLTE
png_write_png
png_write_row
png_write_rows
png_write_sig
src_callback_new
src_callback_read
src_clone
src_delete
src_error
src_float_to_int_array
src_float_to_short_array
src_get_channels
src_get_description
src_get_name
src_get_version
src_int_to_float_array
src_is_valid_ratio
src_new
src_process
src_reset
src_set_ratio
src_short_to_float_array
src_simple
src_strerror

Sections

.text
Size: 123.1MB - Virtual size: 123.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.uedbg
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27.3MB - Virtual size: 27.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.4MB - Virtual size: 7.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6.6MB - Virtual size: 6.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lpp_pre
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.lpp_pos
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

07aff04e7532fa67ab746e0c807ccfdb

Headers

DLL Characteristics

File Characteristics

Imports

x3daudio1_7

xapofx1_5

ws2_32

user32

advapi32

gdi32

crypt32

wldap32

normaliz

xinput1_3

dxgi

d3d9

d3d11

d3dcompiler_43

dsound

winmm

kernel32

comdlg32

shell32

ole32

oleaut32

netapi32

iphlpapi

setupapi

dwmapi

imm32

uiautomationcore

opengl32

winhttp

msvcp140

version

powrprof

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

Exports

Exports

Sections

.text Size: 123.1MB - Virtual size: 123.1MB

.uedbg Size: 6.0MB - Virtual size: 6.0MB

.rdata Size: 27.3MB - Virtual size: 27.3MB

.data Size: 4.4MB - Virtual size: 7.8MB

.pdata Size: 6.6MB - Virtual size: 6.6MB

.lpp_pre Size: 512B - Virtual size: 8B

.lpp_pos Size: 512B - Virtual size: 8B

.msvcjmc Size: 512B - Virtual size: 8B

.rodata Size: 4KB - Virtual size: 4KB

_RDATA Size: 155KB - Virtual size: 154KB

.rsrc Size: 27KB - Virtual size: 27KB

.reloc Size: 1.7MB - Virtual size: 1.7MB

.text
Size: 123.1MB - Virtual size: 123.1MB

.uedbg
Size: 6.0MB - Virtual size: 6.0MB

.rdata
Size: 27.3MB - Virtual size: 27.3MB

.data
Size: 4.4MB - Virtual size: 7.8MB

.pdata
Size: 6.6MB - Virtual size: 6.6MB

.lpp_pre
Size: 512B - Virtual size: 8B

.lpp_pos
Size: 512B - Virtual size: 8B

.msvcjmc
Size: 512B - Virtual size: 8B

.rodata
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 155KB - Virtual size: 154KB

.rsrc
Size: 27KB - Virtual size: 27KB

.reloc
Size: 1.7MB - Virtual size: 1.7MB