stellaris[.]exe

Resubmissions

25-05-2023 17:54

230525-wg6sqacc4v 1

Sharing

Copy URL

Twitter E-mail

General

Target

stellaris.exe
Size

32.6MB
MD5

802e95841eef7adde8f527658257132b
SHA1

3534410191138bf1ac42319afdfb35b8ae7a76f1
SHA256

1c175d65d20d0ae57414899e50f1cb34dbfa349f432620f96e475fc080fb8193
SHA512

c55071f2a583df2a01884406f75b1b349b4268ff612e91a58fdff75c3e00c5c5d2918f648891785d09fc5e9a8614f119ab709500d04331b43d7de39a8b4fe1ef
SSDEEP

393216:dRoQ7/cXbiuY8Rx8LlnvVHF3RG52iogyX:ToQ7/cX5Yyx8dtHFRHic

Score

1^/10

Malware Config

Signatures

Files

stellaris.exe
.exe windows x64

0265e766dd394be9dc0daa9d8814d7d5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21-09-2022 00:00

Not After

21-11-2033 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16-11-2022 00:00

Not After

15-12-2023 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0b:9e:53:ee:3c:b9:ea:a8:06:3e:d1:45:4a:8f:d1:6c:51:94:2c:85
Signer

Actual PE Digest

0b:9e:53:ee:3c:b9:ea:a8:06:3e:d1:45:4a:8f:d1:6c:51:94:2c:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

setupapi

SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Device_IDA
CM_Get_Parent
CM_Locate_DevNodeA
SetupDiEnumDeviceInfo

steam_api64

SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamGameServer_GetHSteamUser
SteamGameServer_Shutdown
SteamGameServer_RunCallbacks
SteamAPI_Init
SteamAPI_Shutdown
SteamInternal_GameServer_Init
SteamAPI_RunCallbacks
SteamInternal_ContextInit
SteamAPI_IsSteamRunning
SteamAPI_GetHSteamUser
SteamInternal_FindOrCreateUserInterface
SteamInternal_FindOrCreateGameServerInterface

pops_api

POPS_AccountGetDetails
POPS_SocialProfileRetrieve
POPS_SocialProfileCreate
POPS_AccountConnectAccountSteam
POPS_NewsletterSubscribe
POPS_AccountConnections
POPS_AccountLogInSteamTicket
POPS_AccountLogInWithAuthToken
POPS_Shutdown
POPS_TelemetryEnable
POPS_AutoStandardTelemetryEnable
POPS_SocialSetXMPPLogLevel
POPS_SetRootPath
POPS_SetFileIO
POPS_Initialize
POPS_TokenRetrieveCurrent
POPS_AccountCreate
POPS_AccountGetCountries
POPS_TelemetrySendMulti
POPS_RunCallbacks
POPS_AccountLogIn
POPS_AccountGetGuid

pdx_red_king

?PdxABTestCurlGlobalCleanup@@YAXXZ
?CreateABTestObject@@YAPEAVCPdxABTestInterface@@AEBUSPdxABTestInitInfo@@@Z
?PdxABTestCurlGlobalInit@@YAXXZ
??0SPdxABTestInitInfo@@QEAA@XZ

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

d3dx9_43

D3DXSaveSurfaceToFileInMemory
D3DXCreateLine
D3DXCompileShader
D3DXCreateTexture
D3DXCreateCubeTexture
D3DXLoadSurfaceFromMemory
D3DXLoadSurfaceFromSurface

d3d9

Direct3DCreate9Ex
Direct3DCreate9

opengl32

glGetIntegerv
glGetFloatv
glReadPixels
glTexParameterf
glTexEnvf
glDeleteTextures
glTexSubImage2D
wglGetProcAddress
glPixelStorei
glTexParameteri
glBindTexture
glGenTextures
glFrontFace
glCullFace
glPolygonMode
glStencilOp
glStencilFunc
glDepthFunc
wglGetCurrentDC
glTexImage2D
glGetBooleanv
glGetString
glViewport
glDepthMask
glStencilMask
glScissor
glEnable
glColorMask
glClearColor
glClear
glAlphaFunc
glBlendFunc
glGetError
glEnd
glVertex2f
glColor4f
glBegin
glLineWidth
glOrtho
glLoadIdentity
glMatrixMode
glDrawElements
glDrawArrays
glDisable

kernel32

GetTimeZoneInformation
GetConsoleOutputCP
HeapSize
MoveFileExW
SetStdHandle
IsValidCodePage
GetUserDefaultLCID
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
HeapAlloc
HeapFree
EnumSystemLocalesW
ReadConsoleW
AttachConsole
GetStdHandle
WriteFile
Sleep
WinExec
GetModuleHandleA
FatalExit
K32GetProcessMemoryInfo
GetCurrentProcess
SetFileAttributesA
CreateDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
FreeLibrary
GetModuleFileNameW
GetProcAddress
LoadLibraryA
ExitProcess
OutputDebugStringW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
CloseHandle
SetErrorMode
GetTickCount
GetModuleHandleW
SetThreadExecutionState
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
GetLastError
LoadLibraryW
CreateToolhelp32Snapshot
Process32First
Process32Next
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
VerSetConditionMask
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
LocalFree
FormatMessageW
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
MulDiv
GetModuleHandleExW
WideCharToMultiByte
GetSystemPowerStatus
GetLocaleInfoA
GlobalFree
MultiByteToWideChar
OutputDebugStringA
GetFullPathNameW
GetSystemDefaultUILanguage
GetNativeSystemInfo
GetComputerNameA
VirtualAlloc
VirtualFree
VirtualProtect
GetCurrentProcessId
RtlCaptureStackBackTrace
FindFirstFileW
GetFileSize
FindClose
GetDriveTypeA
GetVolumeInformationA
SetEvent
CreateEventA
FindNextFileW
FlushFileBuffers
GetFileAttributesExW
RemoveDirectoryW
DeleteFileW
InitializeSRWLock
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
FormatMessageA
InitializeCriticalSectionEx
DecodePointer
CreateProcessW
GetThreadId
SetUnhandledExceptionFilter
LocalAlloc
SleepEx
SetLastError
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
RtlCaptureContext
GetCurrentDirectoryA
GetFileAttributesA
SuspendThread
ResumeThread
GetThreadContext
GetVersionExA
ReadProcessMemory
GetModuleFileNameA
SwitchToThread
GetConsoleMode
GetFileInformationByHandle
GetDriveTypeW
FreeLibraryAndExitThread
ExitThread
SetConsoleCtrlHandler
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
WriteConsoleW
LoadLibraryExW
TlsFree
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCPInfo
LCMapStringEx
EncodePointer
GetSystemTimeAsFileTime
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetStringTypeW
GetExitCodeThread

user32

IsChild
LoadCursorA
GetActiveWindow
SystemParametersInfoW
SystemParametersInfoA
DrawTextW
SetFocus
GetDlgItem
EndDialog
DialogBoxIndirectParamW
PostThreadMessageW
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetDesktopWindow
SetWindowRgn
CreateIconFromResource
UnhookWindowsHookEx
SetWindowsHookExW
GetParent
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
IntersectRect
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
RemovePropW
SetPropW
CreateWindowExA
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
SetClipboardData
GetClipboardData
SetForegroundWindow
GetFocus
SetWindowPos
FlashWindowEx
SetLayeredWindowAttributes
CreateWindowExW
RegisterClassW
SendMessageW
RegisterRawInputDevices
CreateIconIndirect
CopyImage
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
LoadCursorFromFileA
ToUnicode
MapVirtualKeyW
RegisterDeviceNotificationW
GetDoubleClickTime
RegisterWindowMessageA
GetRawInputData
DestroyIcon
LoadIconW
CallNextHookEx
GetWindowLongW
IsRectEmpty
ClipCursor
ScreenToClient
ClientToScreen
GetClipCursor
GetCursorPos
SetCursor
AdjustWindowRectEx
GetWindowRect
GetClientRect
GetPropW
UnregisterDeviceNotification
InvalidateRect
GetUpdateRect
GetForegroundWindow
GetMenu
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
MessageBoxA
GetSystemMetrics
RegisterClassExA
FindWindowExA
UpdateWindow
ShowWindow
UnregisterClassA
DestroyWindow
MapVirtualKeyA
GetDC
ReleaseDC
DefWindowProcA
GetKeyboardState
ValidateRect
LoadCursorW
SetCursorPos
ReleaseCapture
SetCapture
EnumDisplayMonitors
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
ChangeDisplaySettingsExW

gdi32

CreateDCW
DeleteDC
GetICMProfileW
CreateCompatibleDC
DeleteObject
SetPixel
GetObjectA
GetTextMetricsW
GetTextExtentPoint32A
CreateFontIndirectW
BitBlt
SwapBuffers
SetPixelFormat
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateRectRgn
CombineRgn
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateBitmap
GetDIBits
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
CreateDIBSection

shell32

CommandLineToArgvW
ShellExecuteExA
ShellExecuteA
SHCreateDirectoryExW
ShellExecuteW
DragAcceptFiles
SHGetFolderPathW
ExtractIconExW
DragFinish
DragQueryFileW

ole32

CoInitializeEx
CoCreateInstance
CoTaskMemFree
PropVariantClear
StringFromGUID2
CoUninitialize

oleaut32

SysFreeString

advapi32

OpenProcessToken
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegGetValueA

winmm

waveOutReset
timeBeginPeriod
timeEndPeriod
waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsW
waveOutGetErrorTextW
waveOutOpen
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveInGetDevCapsW
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
timeGetTime
waveOutWrite

ws2_32

setsockopt
recv
WSASetLastError
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
WSAGetLastError
WSACleanup
gethostname
getnameinfo
htonl
freeaddrinfo
ntohl
getaddrinfo
WSAStartup
socket
inet_pton
send
gethostbyname
__WSAFDIsSet
select
accept
listen
recvfrom
sendto
ioctlsocket
ntohs

shlwapi

PathAppendW
PathFileExistsW

imm32

ImmSetCompositionWindow
ImmNotifyIME
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmGetIMEFileNameA
ImmSetCandidateWindow

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

nakama-cpp

NSession_getUserId
NSession_getCreateTime
NSession_getExpireTime
NSession_isExpired
NSession_isExpiredByTime
NSession_getVariables
NStringMap_destroy
NRtClient_setUserData
NRtClient_destroy
NRtClient_tick
NRtClient_getUserData
NRtClient_setConnectCallback
NRtClient_setDisconnectCallback
NRtClient_setErrorCallback
NRtClient_setChannelMessageCallback
NRtClient_setChannelPresenceCallback
NRtClient_setMatchmakerMatchedCallback
NRtClient_setMatchDataCallback
NRtClient_setMatchPresenceCallback
NRtClient_setNotificationsCallback
NRtClient_setStatusPresenceCallback
NRtClient_setStreamPresenceCallback
NRtClient_setStreamDataCallback
NRtClient_connect
NRtClient_isConnected
NRtClient_disconnect
NRtClient_joinChat
NRtClient_leaveChat
NStringMap_setValue
NRtClient_updateChatMessage
NRtClient_removeChatMessage
NRtClient_createMatch
NRtClient_joinMatch
NRtClient_joinMatchByToken
NRtClient_leaveMatch
NRtClient_addMatchmaker
NStringDoubleMap_destroy
NRtClient_removeMatchmaker
NRtClient_sendMatchData
NRtClient_followUsers
NRtClient_unfollowUsers
NRtClient_rpc
NClient_setUserData
destroyNakamaClient
NClient_getUserData
NClient_setErrorCallback
NClient_disconnect
NClient_tick
NClient_createRtClientEx
NClient_authenticateDevice
NClient_authenticateEmail
NClient_authenticateFacebook
NClient_authenticateGoogle
NClient_authenticateGameCenter
NClient_authenticateApple
NClient_authenticateCustom
NClient_authenticateSteam
NStringMap_create
NClient_linkEmail
NStringDoubleMap_getValue
NClient_linkGoogle
NClient_linkGameCenter
NSession_getUsername
NClient_linkSteam
NClient_linkCustom
NClient_unlinkFacebook
NClient_unlinkEmail
NClient_unlinkGoogle
NClient_unlinkGameCenter
NClient_unlinkApple
NClient_unlinkSteam
NClient_unlinkDevice
NClient_unlinkCustom
NClient_importFacebookFriends
NClient_getAccount
NClient_updateAccount
NClient_getUsers
NClient_addFriends
NClient_deleteFriends
NClient_blockFriends
NClient_listFriends
NClient_createGroup
NClient_deleteGroup
NClient_addGroupUsers
NClient_listGroupUsers
NClient_kickGroupUsers
NClient_joinGroup
NClient_leaveGroup
NClient_listGroups
NClient_listUserGroups
NClient_promoteGroupUsers
NClient_demoteGroupUsers
NClient_updateGroup
NClient_listLeaderboardRecords
NClient_listLeaderboardRecordsAroundOwner
NClient_writeLeaderboardRecord
NClient_writeTournamentRecord
NClient_deleteLeaderboardRecord
NClient_listMatches
NClient_listNotifications
NClient_deleteNotifications
NClient_listChannelMessages
NClient_listTournaments
NClient_listTournamentRecords
NClient_listTournamentRecordsAroundOwner
NClient_joinTournament
NClient_listStorageObjects
NClient_listUsersStorageObjects
NClient_writeStorageObjects
NClient_readStorageObjects
NClient_deleteStorageObjects
NClient_rpc
NClient_rpc_with_http_key
createDefaultNakamaClient
NStringDoubleMap_getKeys
NStringDoubleMap_getSize
NStringMap_getValue
NSession_isCreated
NSession_getAuthToken
NSession_destroy
NStringDoubleMap_setValue
NStringMap_getKeys
NStringMap_getSize
NClient_linkApple
NStringDoubleMap_create
NClient_linkDevice
NClient_linkFacebook
NRtClient_writeChatMessage

Exports

Exports

?PHYSFS_addToSearchPath@@YAHPEBDH@Z
?PHYSFS_caseFold@@YAHIPEAI@Z
?PHYSFS_close@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_deinit@@YAHXZ
?PHYSFS_delete@@YAHPEBD@Z
?PHYSFS_deregisterArchiver@@YAHPEBD@Z
?PHYSFS_enumerate@@YAHPEBDP6A?AW4PHYSFS_EnumerateCallbackResult@@PEAX00W4PHYSFS_FileType@@@Z1@Z
?PHYSFS_enumerateFiles@@YAPEAPEADPEBD@Z
?PHYSFS_enumerateFilesCallback@@YAXPEBDP6AXPEAX00@Z1@Z
?PHYSFS_eof@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_exists@@YAHPEBD@Z
?PHYSFS_fileLength@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_flush@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_freeList@@YAXPEAX@Z
?PHYSFS_freezeConfig@@YAX_N@Z
?PHYSFS_getAllocator@@YAPEBUPHYSFS_Allocator@@XZ
?PHYSFS_getBaseDir@@YAPEBDXZ
?PHYSFS_getCdRomDirs@@YAPEAPEADXZ
?PHYSFS_getCdRomDirsCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getDirSeparator@@YAPEBDXZ
?PHYSFS_getErrorByCode@@YAPEBDW4PHYSFS_ErrorCode@@@Z
?PHYSFS_getLastError@@YAPEBDXZ
?PHYSFS_getLastErrorCode@@YA?AW4PHYSFS_ErrorCode@@XZ
?PHYSFS_getLastModTime@@YA_JPEBD@Z
?PHYSFS_getLinkedVersion@@YAXPEAUPHYSFS_Version@@@Z
?PHYSFS_getMountPoint@@YAPEBDPEBD@Z
?PHYSFS_getPrefDir@@YAPEBDPEBD0@Z
?PHYSFS_getRealDir@@YAPEBDPEBD@Z
?PHYSFS_getSearchPath@@YAPEAPEADXZ
?PHYSFS_getSearchPathCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getUserDir@@YAPEBDXZ
?PHYSFS_getWriteDir@@YAPEBDXZ
?PHYSFS_init@@YAHPEBD@Z
?PHYSFS_isDirectory@@YAHPEBD@Z
?PHYSFS_isInit@@YAHXZ
?PHYSFS_isSymbolicLink@@YAHPEBD@Z
?PHYSFS_mkdir@@YAHPEBD@Z
?PHYSFS_mount@@YAHPEBD0H@Z
?PHYSFS_mountHandle@@YAHPEAUPHYSFS_File@@PEBD1H@Z
?PHYSFS_mountIo@@YAHPEAUPHYSFS_Io@@PEBD1H@Z
?PHYSFS_mountMemory@@YAHPEBX_KP6AXPEAX@ZPEBD4H@Z
?PHYSFS_openAppend@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openRead@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openWrite@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_permitSymbolicLinks@@YAXH@Z
?PHYSFS_read@@YA_JPEAUPHYSFS_File@@PEAXII@Z
?PHYSFS_readBytes@@YA_JPEAUPHYSFS_File@@PEAX_K@Z
?PHYSFS_readSBE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSBE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSBE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readSLE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSLE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSLE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readUBE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readUBE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readUBE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_readULE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readULE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readULE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_registerArchiver@@YAHPEBUPHYSFS_Archiver@@@Z
?PHYSFS_removeFromSearchPath@@YAHPEBD@Z
?PHYSFS_seek@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setAllocator@@YAHPEBUPHYSFS_Allocator@@@Z
?PHYSFS_setBuffer@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setRoot@@YAHPEBD0@Z
?PHYSFS_setSaneConfig@@YAHPEBD00HH@Z
?PHYSFS_setWriteDir@@YAHPEBD@Z
?PHYSFS_stat@@YAHPEBDPEAUPHYSFS_Stat@@@Z
?PHYSFS_supportedArchiveTypes@@YAPEAPEBUPHYSFS_ArchiveInfo@@XZ
?PHYSFS_swapSBE16@@YAFF@Z
?PHYSFS_swapSBE32@@YAHH@Z
?PHYSFS_swapSBE64@@YA_J_J@Z
?PHYSFS_swapSLE16@@YAFF@Z
?PHYSFS_swapSLE32@@YAHH@Z
?PHYSFS_swapSLE64@@YA_J_J@Z
?PHYSFS_swapUBE16@@YAGG@Z
?PHYSFS_swapUBE32@@YAII@Z
?PHYSFS_swapUBE64@@YA_K_K@Z
?PHYSFS_swapULE16@@YAGG@Z
?PHYSFS_swapULE32@@YAII@Z
?PHYSFS_swapULE64@@YA_K_K@Z
?PHYSFS_symbolicLinksPermitted@@YAHXZ
?PHYSFS_tell@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_ucs4stricmp@@YAHPEBI0@Z
?PHYSFS_unmount@@YAHPEBD@Z
?PHYSFS_utf16stricmp@@YAHPEBG0@Z
?PHYSFS_utf8FromLatin1@@YAXPEBDPEAD_K@Z
?PHYSFS_utf8FromUcs2@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8FromUcs4@@YAXPEBIPEAD_K@Z
?PHYSFS_utf8FromUtf16@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8ToUcs2@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8ToUcs4@@YAXPEBDPEAI_K@Z
?PHYSFS_utf8ToUtf16@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8stricmp@@YAHPEBD0@Z
?PHYSFS_write@@YA_JPEAUPHYSFS_File@@PEBXII@Z
?PHYSFS_writeBytes@@YA_JPEAUPHYSFS_File@@PEBX_K@Z
?PHYSFS_writeSBE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSBE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSBE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeSLE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSLE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSLE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeUBE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeUBE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeUBE64@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_writeULE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeULE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeULE64@@YAHPEAUPHYSFS_File@@_K@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 26.3MB - Virtual size: 26.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 428KB - Virtual size: 12.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

0265e766dd394be9dc0daa9d8814d7d5

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cdCertificate

Extended Key Usages

Key Usages

0b:9e:53:ee:3c:b9:ea:a8:06:3e:d1:45:4a:8f:d1:6c:51:94:2c:85Signer

Headers

DLL Characteristics

File Characteristics

Imports

setupapi

steam_api64

pops_api

pdx_red_king

d3dcompiler_47

d3d11

dxgi

d3dx9_43

d3d9

opengl32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

winmm

ws2_32

shlwapi

imm32

version

nakama-cpp

Exports

Exports

Sections

.text Size: 26.3MB - Virtual size: 26.3MB

.rdata Size: 4.4MB - Virtual size: 4.4MB

.data Size: 428KB - Virtual size: 12.0MB

.pdata Size: 1.0MB - Virtual size: 1.0MB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 72KB - Virtual size: 72KB

.reloc Size: 276KB - Virtual size: 275KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

0b:9e:53:ee:3c:b9:ea:a8:06:3e:d1:45:4a:8f:d1:6c:51:94:2c:85
Signer

.text
Size: 26.3MB - Virtual size: 26.3MB

.rdata
Size: 4.4MB - Virtual size: 4.4MB

.data
Size: 428KB - Virtual size: 12.0MB

.pdata
Size: 1.0MB - Virtual size: 1.0MB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 72KB - Virtual size: 72KB

.reloc
Size: 276KB - Virtual size: 275KB