_Game_UWP_x86 | Triage

Resubmissions

11-10-2023 02:26

231011-cxdmbsca24 3

09-10-2023 09:59

231009-lz5m9seb77 3

Sharing

Copy URL

Twitter E-mail

General

Target

_Game_UWP_x86
Size

33.4MB
MD5

080edf44e7527837f4cbca5c524ff045
SHA1

5b1c2b2cee4b35eaaee77fcbb04451d9a18faf3e
SHA256

0b612fdfa659b44999c8fecf09a09020b959d603a7de41812fb696fb170e3feb
SHA512

51ce0abef23938ad5f8478fcedd7bd2df5df60ecaec2948231270e9e1c5239198fcafc3009f8add5a078d082fea8a93e8d74cf820cb25b3e2b7744ccc3ed8534
SSDEEP

393216:x+WrereIbnq3Hv88cg6fqfuopUKhtjeHUDMx59sM/9cOl3+LEDuzpUQE2rcrZCIu:srjM3vk0nEDE3I5eMSsmxTCKxpxIxFO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_Game_UWP_x86

Files

_Game_UWP_x86
.exe windows:6 windows x86

446fe6117375896128c011f6d5189650

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

dxgi

CreateDXGIFactory1

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter
QueryPerformanceFrequency

api-ms-win-core-com-l1-1-0

CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoGetContextToken
CoCreateGuid
CoTaskMemFree

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
WaitForMultipleObjectsEx
ReleaseSRWLockShared
CreateMutexExW
ReleaseMutex
InitializeCriticalSection
AcquireSRWLockShared
SetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
CreateEventExW
AcquireSRWLockExclusive
WaitForSingleObject
CreateSemaphoreExW
ReleaseSemaphore
ResetEvent
InitializeCriticalSectionEx
DeleteCriticalSection
ReleaseSRWLockExclusive
EnterCriticalSection

api-ms-win-core-processthreads-l1-1-0

TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentThreadId
SetThreadPriority
GetCurrentThread
GetCurrentProcessId
TlsFree
CreateThread

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

api-ms-win-core-errorhandling-l1-1-0

SetLastError
RaiseException
GetLastError

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

vccorlib140_app

?GetActivationFactoryByPCWSTR@@YGJPAXAAVGuid@Platform@@PAPAX@Z
?GetIidsFn@@YGJHPAKPBU__s_GUID@@PAPAVGuid@Platform@@@Z
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?GetType@Object@Platform@@Q$AAAP$AAVType@2@XZ
?ToString@float64@default@@QAAP$AAVString@Platform@@XZ
?ToString@uint32@default@@QAAP$AAVString@Platform@@XZ
?get@FullName@Type@Platform@@Q$AAAP$AAVString@3@XZ
?ToString@Enum@Platform@@Q$AAAP$AAVString@2@XZ
?CreateException@Exception@Platform@@SAP$AAV12@HP$AAVString@2@@Z
?CreateException@Exception@Platform@@SAP$AAV12@H@Z
?GetCmdArguments@Details@Platform@@YAPAPA_WPAH@Z
??0Exception@Platform@@Q$AAA@HP$AAVString@1@@Z
?ToString@Guid@Platform@@QAAP$AAVString@2@XZ
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@P$AAV12@@Z
?GetIBoxVtable@Details@Platform@@YGPAXPAX@Z
?CreateValue@Details@Platform@@YGP$AAVObject@2@W4TypeCode@2@PBX@Z
?__abi_make_type_id@@YGP$AAVType@Platform@@ABU__abi_type_descriptor@@@Z
?__abi_cast_Object_to_String@__abi_details@@YGP$AAVString@Platform@@_NP$AAVObject@3@@Z
?__abi_cast_String_to_Object@__abi_details@@YGP$AAVObject@Platform@@P$AAVString@3@@Z
?ReCreateException@Exception@Platform@@SAP$AAV12@H@Z
??0OutOfMemoryException@Platform@@Q$AAA@XZ
??0ChangedStateException@Platform@@Q$AAA@XZ
?EventSourceRemove@Details@Platform@@YGXPAPAXPAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
?EventSourceAdd@Details@Platform@@YG?AVEventRegistrationToken@Foundation@Windows@@PAPAXPAUEventLock@12@P$AAVDelegate@2@@Z
?EventSourceGetTargetArrayEvent@Details@Platform@@YGPAXPAXIPBXPA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YGIPAX@Z
?EventSourceGetTargetArray@Details@Platform@@YGPAXPAXPAUEventLock@12@@Z
?EventSourceUninitialize@Details@Platform@@YGXPAPAX@Z
?EventSourceInitialize@Details@Platform@@YGXPAPAX@Z
?Equals@Object@Platform@@Q$AAA_NP$AAV12@@Z
??0NullReferenceException@Platform@@Q$AAA@XZ
??0NotImplementedException@Platform@@Q$AAA@XZ
??0OutOfBoundsException@Platform@@Q$AAA@XZ
?ResolveWeakReference@Details@Platform@@YGP$AAVObject@2@ABU_GUID@@PAPAU__abi_IUnknown@@@Z
?TerminateModule@Details@Platform@@YG_NPAVModuleBase@1WRL@Microsoft@@@Z
?get@Message@Exception@Platform@@Q$AAAP$AAVString@3@XZ
?ReleaseInContextImpl@Details@Platform@@YGJPAUIUnknown@@0@Z
?GetProxyImpl@Details@Platform@@YGJPAUIUnknown@@ABU_GUID@@0PAPAU3@@Z
?GetObjectContext@Details@Platform@@YGPAUIUnknown@@XZ
??0FailureException@Platform@@Q$AAA@XZ
?ToString@int32@default@@QAAP$AAVString@Platform@@XZ
??0DisconnectedException@Platform@@Q$AAA@XZ
??0Delegate@Platform@@Q$AAA@XZ
?GetIBoxArrayVtable@Details@Platform@@YGPAXPAX@Z
?AllocateException@Heap@Details@Platform@@SAPAXII@Z
?AlignedFree@Heap@Details@Platform@@SAXPAX@Z
?Free@Heap@Details@Platform@@SAXPAX@Z
?Allocate@Heap@Details@Platform@@SAPAXII@Z
?Allocate@Heap@Details@Platform@@SAPAXI@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AAEXXZ
??0Object@Platform@@Q$AAA@XZ
?__abi_ObjectToString@__abi_details@@YGP$AAVString@Platform@@P$AAVObject@3@_N@Z
?__abi_translateCurrentException@@YGJ_N@Z
?__abi_WinRTraiseCOMException@@YGXJ@Z
?__abi_WinRTraiseObjectDisposedException@@YGXXZ
?__abi_WinRTraiseDisconnectedException@@YGXXZ
?__abi_WinRTraiseWrongThreadException@@YGXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YGXXZ
?__abi_WinRTraiseChangedStateException@@YGXXZ
?__abi_WinRTraiseOutOfBoundsException@@YGXXZ
?__abi_WinRTraiseInvalidArgumentException@@YGXXZ
?__abi_WinRTraiseOutOfMemoryException@@YGXXZ
?__abi_WinRTraiseAccessDeniedException@@YGXXZ
?__abi_WinRTraiseFailureException@@YGXXZ
?__abi_WinRTraiseOperationCanceledException@@YGXXZ
?__abi_WinRTraiseNullReferenceException@@YGXXZ
?__abi_WinRTraiseInvalidCastException@@YGXXZ
?__abi_WinRTraiseNotImplementedException@@YGXXZ
?GetWeakReference@Details@Platform@@YGPAU__abi_IUnknown@@Q$ADVObject@2@@Z
?GetActivationFactory@Details@Platform@@YGJPAVModuleBase@1WRL@Microsoft@@PAUHSTRING__@@PAPAUIActivationFactory@@@Z

msvcp140_app

_Cnd_unregister_at_thread_exit
_Cnd_register_at_thread_exit
?__ExceptionPtrToBool@@YA_NPBX@Z
?__ExceptionPtrAssign@@YAXPAXPBX@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?do_max_length@codecvt_base@std@@MBEHXZ
?do_encoding@codecvt_base@std@@MBEHXZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
??0ios_base@std@@IAE@XZ
??1ios_base@std@@UAE@XZ
?clear@ios_base@std@@QAEXH_N@Z
??1ctype_base@std@@UAE@XZ
??0ctype_base@std@@QAE@I@Z
?_Throw_future_error@std@@YAXABVerror_code@1@@Z
??1codecvt_base@std@@UAE@XZ
??0codecvt_base@std@@QAE@I@Z
?_Getctype@_Locinfo@std@@QBE?AU_Ctypevec@@XZ
?_Init@ios_base@std@@IAEXXZ
_Toupper
_Tolower
?_Winerror_map@std@@YAHH@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?getline@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PA_W_J@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?GetNextAsyncId@platform@details@Concurrency@@YAIXZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??1?$basic_istream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@U_Mbstatet@@@2@@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??Bios_base@std@@QBE_NXZ
_Mtx_current_owns
?_Random_device@std@@YAIXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??5?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
_Cnd_timedwait
_Mtx_trylock
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??Bid@locale@std@@QAEIXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAG@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
_Thrd_join
_Cnd_signal
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
_Thrd_yield
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_function_call@std@@YAXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?setf@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?toupper@?$ctype@D@std@@QBEDD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?exceptions@ios_base@std@@QAEXH@Z
_Thrd_id
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?flags@ios_base@std@@QAEHH@Z
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Strcoll
_Strxfrm
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?id@?$collate@D@std@@2V0locale@2@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QBE?AVlocale@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z
?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ
?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ
?_IsNonBlockingThread@_Task_impl_base@details@Concurrency@@SA_NXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
_Thrd_sleep
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z

concrt140_app

??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
?done@agent@Concurrency@@IAE_NXZ
?wait@agent@Concurrency@@SA?AW4agent_status@2@PAV12@I@Z
?start@agent@Concurrency@@QAE_NXZ
??1agent@Concurrency@@UAE@XZ
??0agent@Concurrency@@QAE@XZ
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z

ws2_32

gethostbyname
gethostname
WSAStartup
WSAGetLastError
getaddrinfo
freeaddrinfo
getsockname
htonl
ntohl
ntohs
WSACleanup
setsockopt
WSAAddressToStringW
getsockopt
getnameinfo
WSASetLastError
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
WSAIoctl
WSASend
WSARecv
WSASocketW
shutdown
sendto
send
select
recvfrom
inet_pton
WSAPoll
recv
listen
inet_ntoa
inet_addr
htons
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
WSAEventSelect
socket
getpeername

bcrypt

BCryptGenRandom

vcruntime140_app

_except_handler4_common
__current_exception_context
__current_exception
wcsstr
__std_type_info_compare
__std_type_info_destroy_list
strrchr
strstr
wcsrchr
strchr
_purecall
memmove
__std_exception_destroy
__std_exception_copy
memset
longjmp
_setjmp3
__CxxLongjmpUnwind
__CxxFrameHandler3
_CxxThrowException
__std_terminate
memcpy
memchr

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
_set_new_mode
calloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_invoke_watson
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
strerror_s
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
abort
_exit
raise
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_beginthreadex
terminate
_controlfp_s
strerror
_errno
__sys_nerr
_crt_atexit
_invalid_parameter_noinfo_noreturn
exit

api-ms-win-crt-string-l1-1-0

isalpha
isspace
_stricmp
_strnicmp
strncpy
isprint
isdigit
tolower
ispunct
_isctype
strncpy_s
strncmp
strcmp
toupper
wcslen
wcscpy_s
wcsncpy_s
_strdup
strcspn
strspn
wcstok_s
towupper
wcsncmp
_wcsicmp
_wcsdup
strtok_s
isalnum
strtok
iswdigit
iscntrl
strpbrk

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__stdio_common_vswscanf
__stdio_common_vsprintf_s
__stdio_common_vswprintf_s
__acrt_iob_func
_open
_wfopen_s
putc
fsetpos
_close
fgetpos
fgetc
_get_stream_buffer_pointers
ungetwc
fputwc
puts
fflush
fgetwc
_write
_lseeki64
_fseeki64
_read
__stdio_common_vfprintf_s
fputs
_wfopen
setbuf
_setmode
_fileno
setvbuf
__stdio_common_vsscanf
fgets
ferror
feof
clearerr
__stdio_common_vsnprintf_s
__p__commode
__stdio_common_vswprintf
fopen_s
fwrite
ftell
fseek
fread
fopen
fclose
__stdio_common_vfprintf
rewind
_set_fmode
_kbhit
__stdio_common_vsnwprintf_s
ungetc
fputc

api-ms-win-crt-convert-l1-1-0

_itow_s
wcstombs
_strtoi64
_strtoui64
strtoull
atof
_wtof
mbstowcs
strtoll
strtod
atoi
atol
strtol
strtoul
_itow

api-ms-win-crt-time-l1-1-0

_difftime64
asctime
_gmtime64_s
_ftime64
strftime
_localtime64
_time64
_mktime64
_gmtime64
clock
_mkgmtime64

api-ms-win-crt-filesystem-l1-1-0

_findnext64i32
_wrename
_findclose
_wrmdir
_lock_file
_waccess
_stat64
_wstat64
_access
_unlock_file
_wremove
_fstat64
_fstat64i32
_stat64i32
_unlink
_wstat64i32
_findfirst64i32

api-ms-win-crt-utility-l1-1-0

bsearch
qsort
rand
srand

api-ms-win-crt-math-l1-1-0

_libm_sse2_tan_precise
roundf
modf
_CIfmod
_libm_sse2_sqrt_precise
_libm_sse2_cos_precise
_libm_sse2_log10_precise
ceil
floor
_CIsinh
_libm_sse2_exp_precise
_libm_sse2_log_precise
_libm_sse2_asin_precise
log2
ldexp
_libm_sse2_acos_precise
_libm_sse2_atan_precise
frexp
_libm_sse2_pow_precise
_libm_sse2_sin_precise
__setusermatherr
_CIatan2

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getch

xinputuap

XInputSetState
XInputGetState

api-ms-win-core-file-l1-1-0

DeleteFileW
CreateDirectoryW
FindClose
RemoveDirectoryW
ReadFile
WriteFile
FindFirstFileExW
GetFileAttributesExW
FindNextFileW
GetDiskFreeSpaceExW
FlushFileBuffers
SetFilePointerEx

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileExA

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-io-l1-1-1

GetOverlappedResultEx

api-ms-win-core-localization-l1-2-0

FormatMessageA
FormatMessageW

api-ms-win-core-file-l2-1-0

MoveFileExW
GetFileInformationByHandleEx

api-ms-win-core-memory-l1-1-3

OpenFileMappingFromApp

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetSystemTimeAsFileTime
GetSystemInfo
GlobalMemoryStatusEx
GetSystemTime
GetTickCount

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary
DisableThreadLibraryCalls

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-winrt-l1-1-0

RoInitialize
RoGetActivationFactory

api-ms-win-core-winrt-string-l1-1-0

WindowsConcatString
WindowsGetStringLen
WindowsDeleteString
WindowsIsStringEmpty
WindowsCreateStringReference
WindowsDuplicateString
WindowsCreateString
WindowsCompareStringOrdinal
WindowsGetStringRawBuffer

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

d3d11

D3D11CreateDevice

d3d12

ord101

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
RoFailFastWithErrorContext

api-ms-win-core-winrt-error-l1-1-1

RoReportUnhandledError

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

api-ms-win-core-memory-l1-1-1

CreateFileMappingFromApp
MapViewOfFileFromApp

mmdevapi

ord17

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

Exports

Exports

?IapComponent_CloseXAML@@YAXXZ
?IapComponent_GetListingInformationPath@@YA?AV?$shared_ptr@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@XZ
?IapComponent_GetSimOperator@@YA?AV?$shared_ptr@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@XZ
?IapComponent_GetUIPanel@@YAP$AAVUIElement@Xaml@UI@Windows@@XZ
?IapComponent_LoadSetting@@YA?AV?$shared_ptr@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
?IapComponent_SaveSetting@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?IapComponent_SendSMS@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?IapComponent_ShowIapDialog@@YAXHH@Z
?IapComponent_UpdateXAML@@YAXXZ
AmdPowerXpressRequestHighPerformance
DllCanUnloadNow
DllGetActivationFactory
NvOptimusEnablement
VSDesignerDllMain

Sections

.text
Size: 27.3MB - Virtual size: 27.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 734KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

446fe6117375896128c011f6d5189650

Headers

DLL Characteristics

File Characteristics

Imports

dxgi

api-ms-win-core-profile-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

vccorlib140_app

msvcp140_app

concrt140_app

ws2_32

bcrypt

vcruntime140_app

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

xinputuap

api-ms-win-core-file-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-memory-l1-1-3

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

d3d11

d3d12

api-ms-win-core-util-l1-1-0

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-memory-l1-1-1

mmdevapi

api-ms-win-core-timezone-l1-1-0

Exports

Exports

Sections

.text Size: 27.3MB - Virtual size: 27.3MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 734KB - Virtual size: 1.2MB

.rsrc Size: 32KB - Virtual size: 31KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 27.3MB - Virtual size: 27.3MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 734KB - Virtual size: 1.2MB

.rsrc
Size: 32KB - Virtual size: 31KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB