7c2eb6b07e34f5307d3d5982816e2997a1d8d6b67703b128dfeb081adf0ddffc

Sharing

Copy URL Twitter E-mail

General

Target

7c2eb6b07e34f5307d3d5982816e2997a1d8d6b67703b128dfeb081adf0ddffc
Size

4.9MB
MD5

5f21076329e57ddf68d5713a0f349918
SHA1

33f8579b141e915c56e3657c403ea8391b436e79
SHA256

7c2eb6b07e34f5307d3d5982816e2997a1d8d6b67703b128dfeb081adf0ddffc
SHA512

b65245acbfaae318874af149f1df6548d276460243d9fea8e6f3d614e9d60e93a60f47f1f7cff85432ba8b9f9c997e36f2b7bd531f199d38150ef80c1e862f3f
SSDEEP

98304:H6wten8CWUICsACWo39uE2WR8iRpVmtGWdOc94kI:awtTTnCFIzVAEcvI

Score

1^/10

Malware Config

Signatures

Files

7c2eb6b07e34f5307d3d5982816e2997a1d8d6b67703b128dfeb081adf0ddffc
.exe windows:6 windows x86

1241630cb143f08dc00a53811154e380

Code Sign

24:dc:d6:9c:d6:99:50:78:bc:6c:cd:44:f3:5c:c5:2d
Certificate

Issuer

CN=MertGames

Not Before

21/10/2023, 23:50

Not After

31/12/2039, 23:59

Subject

CN=MertGames

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

f9:25:66:3e:9a:c3:3b:aa:78:d5:b4:95:67:78:c3:47:46:9a:80:da
Signer

Actual PE Digest

f9:25:66:3e:9a:c3:3b:aa:78:d5:b4:95:67:78:c3:47:46:9a:80:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFileAttributesA
GetProcAddress
GetModuleHandleA
ExitProcess
WriteConsoleW
HeapSize
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
CreateProcessW
GetExitCodeProcess
GetTimeZoneInformation
FindClose
FindNextFileA
DeviceIoControl
FindFirstFileA
SetFileAttributesA
DeleteCriticalSection
GetSystemInfo
Process32Next
SetEvent
Sleep
OpenProcess
FlushFileBuffers
ReadConsoleW
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
GetLocalTime
ExitThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
CreateFileA
InterlockedPushEntrySList
RaiseException
RtlUnwind
SetLastError
WaitNamedPipeW
PeekNamedPipe
GetModuleFileNameW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
UnhandledExceptionFilter
WaitForSingleObject
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
GetProcessHeap
HeapValidate
GetModuleHandleW
GetSystemTimeAsFileTime
QueryPerformanceFrequency
GetCPInfo
CompareStringEx
SleepConditionVariableSRW
CreateDirectoryA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Process32First
GetCurrentProcessId
ReadProcessMemory
CloseHandle
GetLastError
CreateToolhelp32Snapshot
Module32First
Module32Next
GetCurrentProcess
GetTickCount
GetCurrentDirectoryW
TerminateProcess
LoadLibraryA
GetModuleFileNameA
MoveFileA
GetCurrentDirectoryA
DeleteFileA
GlobalFree
CreateThread
GetPriorityClass
GetPrivateProfileStringA
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WaitForSingleObjectEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
GetFileInformationByHandleEx
AreFileApisANSI
SetFilePointerEx
SetEndOfFile
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
CreateFileW
CreateDirectoryW
LocalFree
GetCurrentThreadId
FormatMessageA
QueryPerformanceCounter
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
WideCharToMultiByte
lstrlenW
GlobalLock
GlobalUnlock
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetExitCodeThread
OpenThread
WriteFile
ReadFile
OutputDebugStringA
WinExec
GetCurrentThread
SetUnhandledExceptionFilter
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
GetFileSize
GlobalAlloc
MultiByteToWideChar
CreateEventW
lstrlenA

user32

PostThreadMessageA
DispatchMessageA
TranslateMessage
GetMessageA
LoadCursorA
AdjustWindowRectEx
GetMenu
RegisterClassA
SetWindowLongA
GetWindowLongA
UpdateWindow
SetFocus
MoveWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassExA
UnregisterClassA
DefWindowProcA
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
SetWindowTextA
ReleaseCapture
SetCapture
ChangeDisplaySettingsA
GetCapture
ShowWindow
MessageBoxA
GetSystemMetrics
GetClientRect
GetKeyboardLayoutNameA
GetKeyboardLayout
PeekMessageA
SetRect
InvalidateRect
ReleaseDC
ClientToScreen
OffsetRect
GetAsyncKeyState
FillRect
PostQuitMessage
GetDC
GetCursorPos
LoadStringA
FindWindowA
IsIconic
SystemParametersInfoA
LoadIconA
ScreenToClient
SetWindowPos
OpenClipboard
CloseClipboard
GetClipboardData
CharNextW
CharNextExA
CharPrevExA
GetKeyState

gdi32

CreateSolidBrush
CreateCompatibleDC
DeleteDC
SelectObject
SetBkColor
SetBkMode
SetTextColor
CreateDIBSection
TextOutA
CreateFontIndirectA
GetCharABCWidthsFloatW
GetTextExtentPoint32W
TextOutW
DeleteObject
GetStockObject
StretchBlt
GetTextExtentPoint32A
EnumFontFamiliesExA

advapi32

RegSetValueExA
RegSetValueExW
RegCreateKeyExW
RegOpenKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
GetCurrentHwProfileA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

shell32

ShellExecuteA
SHGetSpecialFolderPathA

ole32

CoUninitialize
CoInitialize
CoInitializeEx
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance

winmm

timeGetDevCaps
timeEndPeriod
timeBeginPeriod
timeGetTime

d3d8

Direct3DCreate8

python27

PyList_Append
PyLong_AsLong
PyTuple_Size
PyDict_GetItemString
PyDict_SetItemString
PyDict_New
PyInt_FromLong
PyTuple_New
PyLong_FromLongLong
PyTuple_SetItem
Py_IncRef
PyDict_Size
PyDict_Next
PyImport_ImportModule
PyModule_AddStringConstant
PyString_InternFromString
PyObject_GetAttrString
PyObject_GetAttr
PyCallable_Check
PyLong_AsLongLong
PyFloat_AsDouble
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyErr_Print
PyObject_CallObject
PyModule_AddIntConstant
_Py_NoneStruct
PyModule_GetDict
PyErr_Fetch
PyList_New
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyImport_AddModule
PyInt_AsLong
Py_InitModule4
PyErr_SetString
PyExc_RuntimeError
Py_BuildValue
PyTuple_GetItem
Py_SetProgramName
PyString_FromString
PyNumber_Check

iphlpapi

GetAdaptersInfo

devil

ilEnable
ilDeleteImages
ilBindImage
ilConvertImage
ilCopyPixels
ilLoad
ilGenImages
ilTexImage
ilSetPixels
ilSave
ilOriginFunc
ilGetInteger
ilInit
ilShutDown

imm32

ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

imagehlp

StackWalk
EnumerateLoadedModules
GetTimestampForLoadedLibrary

granny2

_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertexCount@4
_GrannyGetTotalTypeSize@4
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetWorldPose4x4@8
_GrannyFreeWorldPose@4
_GrannyNewWorldPose@4
_GrannyFindBoneByName@12
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFreeMeshBinding@4
_GrannyNewMeshBinding@12
_GrannyFreeModelInstance@4
_GrannyInstantiateModel@4
_GrannyFreeControlOnceUnused@4
_GrannyFreeLocalPose@4
_GrannyNewLocalPose@4
_GrannyUpdateModelMatrix@20
_GrannySampleModelAnimationsAccelerated@20
_GrannyFreeCompletedModelControls@4
_GrannySetModelClock@8
_GrannyGetSourceSkeleton@4
GrannyPNT332VertexType
_GrannyFreeFile@4
_GrannyFreeFileSection@8
_GrannyGetSourceModel@4
_GrannyConvertSingleObject@20
_GrannyFindMatchingMember@16
_GrannyGetMaterialTextureByType@8
_GrannyFindTrackGroupForModel@12
_GrannyCompleteControlAt@8
_GrannyControlIsComplete@4
_GrannyFreeControlIfComplete@4
_GrannyGetControlLoopCount@4
_GrannySetControlLoopCount@8
_GrannyGetControlSpeed@4
_GrannySetControlSpeed@8
_GrannyGetControlLocalDuration@4
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyBeginControlledAnimation@8
_GrannyEndControlledAnimation@4
_GrannySetTrackGroupTarget@12
_GrannySetTrackGroupLOD@16
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyReadEntireFileFromMemory@8
_GrannyFreeControl@4
_GrannyCopyMeshVertices@12
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
_GrannyNewMeshDeformer@16
_GrannyFreeMeshDeformer@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyDeformVertices@24
_GrannyGetFileInfo@4

mss32

_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_auto_update_3D_position@8
_AIL_3D_sample_volume@4
_AIL_3D_sample_status@4
_AIL_set_3D_sample_loop_count@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_file@8
_AIL_end_3D_sample@4
_AIL_resume_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_start_3D_sample@4
_AIL_release_3D_sample_handle@4
_AIL_allocate_3D_sample_handle@4
_AIL_sample_volume_pan@12
_AIL_open_digital_driver@16
_AIL_set_sample_loop_count@8
_AIL_open_stream@12
_AIL_end_sample@4
_AIL_resume_sample@4
_AIL_stop_sample@4
_AIL_start_sample@4
_AIL_set_sample_file@12
_AIL_init_sample@4
_AIL_release_sample_handle@4
_AIL_allocate_sample_handle@4
_AIL_last_error@0
_AIL_stream_status@4
_AIL_set_stream_loop_count@8
_AIL_stream_volume_levels@12
_AIL_set_stream_volume_levels@12
_AIL_pause_stream@8
_AIL_start_stream@4
_AIL_close_stream@4
_AIL_set_redist_directory@4
_AIL_shutdown@0
_AIL_startup@0
_AIL_set_3D_orientation@28
_AIL_set_3D_velocity@20
_AIL_set_3D_position@16
_AIL_close_3D_listener@4
_AIL_open_3D_listener@4
_AIL_close_3D_provider@4
_AIL_open_3D_provider@4
_AIL_enumerate_3D_providers@12
_AIL_close_digital_driver@4
_AIL_set_sample_volume_pan@12
_AIL_sample_status@4

speedtreert

?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
??1CSpeedTreeRT@@QAE@XZ
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
??0SGeometry@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0CSpeedTreeRT@@QAE@XZ
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
??2CSpeedTreeRT@@SAPAXI@Z
??3CSpeedTreeRT@@SAXPAX@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z

dinput8

DirectInput8Create

ws2_32

recv
select
ioctlsocket
socket
connect
WSAStartup
htons
inet_addr
closesocket
__WSAFDIsSet
WSAGetLastError
send
gethostbyname
sendto
WSACleanup

ddraw

DirectDrawCreate

oleaut32

SysFreeString
VariantClear
VariantInit
SysAllocString

Exports

Exports

??0Config@libconfig@@QAE@XZ
??0ConfigException@libconfig@@QAE@$$QAV01@@Z
??0ConfigException@libconfig@@QAE@ABV01@@Z
??0ConfigException@libconfig@@QAE@XZ
??0FileIOException@libconfig@@QAE@$$QAV01@@Z
??0FileIOException@libconfig@@QAE@ABV01@@Z
??0FileIOException@libconfig@@QAE@XZ
??0ParseException@libconfig@@AAE@PBDH0@Z
??0ParseException@libconfig@@QAE@ABV01@@Z
??0Setting@libconfig@@AAE@PAUconfig_setting_t@@@Z
??0SettingException@libconfig@@IAE@ABVSetting@1@@Z
??0SettingException@libconfig@@IAE@ABVSetting@1@H@Z
??0SettingException@libconfig@@IAE@ABVSetting@1@PBD@Z
??0SettingException@libconfig@@IAE@PBD@Z
??0SettingException@libconfig@@QAE@ABV01@@Z
??0SettingNameException@libconfig@@AAE@ABVSetting@1@PBD@Z
??0SettingNameException@libconfig@@QAE@$$QAV01@@Z
??0SettingNameException@libconfig@@QAE@ABV01@@Z
??0SettingNotFoundException@libconfig@@AAE@ABVSetting@1@H@Z
??0SettingNotFoundException@libconfig@@AAE@ABVSetting@1@PBD@Z
??0SettingNotFoundException@libconfig@@AAE@PBD@Z
??0SettingNotFoundException@libconfig@@QAE@$$QAV01@@Z
??0SettingNotFoundException@libconfig@@QAE@ABV01@@Z
??0SettingTypeException@libconfig@@AAE@ABVSetting@1@@Z
??0SettingTypeException@libconfig@@AAE@ABVSetting@1@H@Z
??0SettingTypeException@libconfig@@AAE@ABVSetting@1@PBD@Z
??0SettingTypeException@libconfig@@QAE@$$QAV01@@Z
??0SettingTypeException@libconfig@@QAE@ABV01@@Z
??1Config@libconfig@@UAE@XZ
??1ConfigException@libconfig@@UAE@XZ
??1FileIOException@libconfig@@UAE@XZ
??1ParseException@libconfig@@UAE@XZ
??1Setting@libconfig@@UAE@XZ
??1SettingException@libconfig@@UAE@XZ
??1SettingNameException@libconfig@@UAE@XZ
??1SettingNotFoundException@libconfig@@UAE@XZ
??1SettingTypeException@libconfig@@UAE@XZ
??4ConfigException@libconfig@@QAEAAV01@$$QAV01@@Z
??4ConfigException@libconfig@@QAEAAV01@ABV01@@Z
??4FileIOException@libconfig@@QAEAAV01@$$QAV01@@Z
??4FileIOException@libconfig@@QAEAAV01@ABV01@@Z
??4ParseException@libconfig@@QAEAAV01@ABV01@@Z
??4Setting@libconfig@@QAEAAV01@ABN@Z
??4Setting@libconfig@@QAEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4Setting@libconfig@@QAEAAV01@AB_J@Z
??4Setting@libconfig@@QAEAAV01@H@Z
??4Setting@libconfig@@QAEAAV01@J@Z
??4Setting@libconfig@@QAEAAV01@M@Z
??4Setting@libconfig@@QAEAAV01@PBD@Z
??4Setting@libconfig@@QAEAAV01@_N@Z
??4SettingException@libconfig@@QAEAAV01@ABV01@@Z
??4SettingNameException@libconfig@@QAEAAV01@$$QAV01@@Z
??4SettingNameException@libconfig@@QAEAAV01@ABV01@@Z
??4SettingNotFoundException@libconfig@@QAEAAV01@$$QAV01@@Z
??4SettingNotFoundException@libconfig@@QAEAAV01@ABV01@@Z
??4SettingTypeException@libconfig@@QAEAAV01@$$QAV01@@Z
??4SettingTypeException@libconfig@@QAEAAV01@ABV01@@Z
??ASetting@libconfig@@QBEAAV01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??ASetting@libconfig@@QBEAAV01@H@Z
??ASetting@libconfig@@QBEAAV01@PBD@Z
??BSetting@libconfig@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
??BSetting@libconfig@@QBEHXZ
??BSetting@libconfig@@QBEIXZ
??BSetting@libconfig@@QBEJXZ
??BSetting@libconfig@@QBEKXZ
??BSetting@libconfig@@QBEMXZ
??BSetting@libconfig@@QBENXZ
??BSetting@libconfig@@QBEPBDXZ
??BSetting@libconfig@@QBE_JXZ
??BSetting@libconfig@@QBE_KXZ
??BSetting@libconfig@@QBE_NXZ
??_7Config@libconfig@@6B@
??_7ConfigException@libconfig@@6B@
??_7FileIOException@libconfig@@6B@
??_7ParseException@libconfig@@6B@
??_7Setting@libconfig@@6B@
??_7SettingException@libconfig@@6B@
??_7SettingNameException@libconfig@@6B@
??_7SettingNotFoundException@libconfig@@6B@
??_7SettingTypeException@libconfig@@6B@
?ConfigDestructor@Config@libconfig@@CAXPAX@Z
?add@Setting@libconfig@@QAEAAV12@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@W4Type@12@@Z
?add@Setting@libconfig@@QAEAAV12@PBDW4Type@12@@Z
?add@Setting@libconfig@@QAEAAV12@W4Type@12@@Z
?assertType@Setting@libconfig@@ABEXW4Type@12@@Z
?c_str@Setting@libconfig@@QBEPBDXZ
?exists@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?exists@Config@libconfig@@QBE_NPBD@Z
?exists@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?exists@Setting@libconfig@@QBE_NPBD@Z
?getAutoConvert@Config@libconfig@@QBE_NXZ
?getDefaultFormat@Config@libconfig@@QBE?AW4Format@Setting@2@XZ
?getError@ParseException@libconfig@@QBEPBDXZ
?getFile@ParseException@libconfig@@QBEPBDXZ
?getFormat@Setting@libconfig@@QBE?AW4Format@12@XZ
?getIncludeDir@Config@libconfig@@QBEPBDXZ
?getIndex@Setting@libconfig@@QBEHXZ
?getLength@Setting@libconfig@@QBEHXZ
?getLine@ParseException@libconfig@@QBEHXZ
?getName@Setting@libconfig@@QBEPBDXZ
?getParent@Setting@libconfig@@QAEAAV12@XZ
?getParent@Setting@libconfig@@QBEABV12@XZ
?getPath@Setting@libconfig@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?getPath@SettingException@libconfig@@QBEPBDXZ
?getRoot@Config@libconfig@@QBEAAVSetting@2@XZ
?getSourceFile@Setting@libconfig@@QBEPBDXZ
?getSourceLine@Setting@libconfig@@QBEIXZ
?getTabWidth@Config@libconfig@@QBEGXZ
?getType@Setting@libconfig@@QBE?AW4Type@12@XZ
?handleError@Config@libconfig@@ABEXXZ
?isAggregate@Setting@libconfig@@QBE_NXZ
?isArray@Setting@libconfig@@QBE_NXZ
?isGroup@Setting@libconfig@@QBE_NXZ
?isList@Setting@libconfig@@QBE_NXZ
?isNumber@Setting@libconfig@@QBE_NXZ
?isRoot@Setting@libconfig@@QBE_NXZ
?isScalar@Setting@libconfig@@QBE_NXZ
?lookup@Config@libconfig@@QBEAAVSetting@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?lookup@Config@libconfig@@QBEAAVSetting@2@PBD@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAI@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAM@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAN@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAPBD@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_J@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_K@Z
?lookupValue@Config@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_N@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAH@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAI@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAM@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAN@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAPBD@Z
?lookupValue@Config@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?lookupValue@Config@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Config@libconfig@@QBE_NPBDAA_K@Z
?lookupValue@Config@libconfig@@QBE_NPBDAA_N@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAH@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAI@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAM@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAN@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAPBD@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV34@@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_J@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_K@Z
?lookupValue@Setting@libconfig@@QBE_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AA_N@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAH@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAI@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAM@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAN@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAPBD@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_J@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_K@Z
?lookupValue@Setting@libconfig@@QBE_NPBDAA_N@Z
?read@Config@libconfig@@QAEXPAU_iobuf@@@Z
?readFile@Config@libconfig@@QAEXPBD@Z
?readString@Config@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?readString@Config@libconfig@@QAEXPBD@Z
?remove@Setting@libconfig@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?remove@Setting@libconfig@@QAEXI@Z
?remove@Setting@libconfig@@QAEXPBD@Z
?setAutoConvert@Config@libconfig@@QAEX_N@Z
?setDefaultFormat@Config@libconfig@@QAEXW4Format@Setting@2@@Z
?setFormat@Setting@libconfig@@QAEXW4Format@12@@Z
?setIncludeDir@Config@libconfig@@QAEXPBD@Z
?setTabWidth@Config@libconfig@@QAEXG@Z
?what@FileIOException@libconfig@@UBEPBDXZ
?what@ParseException@libconfig@@UBEPBDXZ
?what@SettingException@libconfig@@UBEPBDXZ
?what@SettingNameException@libconfig@@UBEPBDXZ
?what@SettingNotFoundException@libconfig@@UBEPBDXZ
?what@SettingTypeException@libconfig@@UBEPBDXZ
?wrapSetting@Setting@libconfig@@CAAAV12@PAUconfig_setting_t@@@Z
?write@Config@libconfig@@QBEXPAU_iobuf@@@Z
?writeFile@Config@libconfig@@QAEXPBD@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 465KB - Virtual size: 465KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 169KB - Virtual size: 658KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1241630cb143f08dc00a53811154e380

Code Sign

24:dc:d6:9c:d6:99:50:78:bc:6c:cd:44:f3:5c:c5:2dCertificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

f9:25:66:3e:9a:c3:3b:aa:78:d5:b4:95:67:78:c3:47:46:9a:80:daSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

d3d8

python27

iphlpapi

devil

imm32

version

imagehlp

granny2

mss32

speedtreert

dinput8

ws2_32

ddraw

oleaut32

Exports

Exports

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 465KB - Virtual size: 465KB

.data Size: 169KB - Virtual size: 658KB

.data1 Size: 2KB - Virtual size: 2KB

.vmp0 Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 148KB - Virtual size: 148KB

24:dc:d6:9c:d6:99:50:78:bc:6c:cd:44:f3:5c:c5:2d
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

f9:25:66:3e:9a:c3:3b:aa:78:d5:b4:95:67:78:c3:47:46:9a:80:da
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 465KB - Virtual size: 465KB

.data
Size: 169KB - Virtual size: 658KB

.data1
Size: 2KB - Virtual size: 2KB

.vmp0
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 148KB - Virtual size: 148KB