hoi4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

hoi4.exe
Size

46.2MB
MD5

ae2401521c8477543b2167c0bc2934bc
SHA1

fb585644f757b7256284954d0f2fe1fe2928fb49
SHA256

ed48116ce9786831ce538d6089ef8cd719028419bb76e217e1f25cf5eb6c6ec1
SHA512

5af0e04b043e921a9f58fee1a74ec14a7304e495a81843fe6b0c110e60ae1c2d96567c3fc4f0ca66b3d51aff0f02daac638d21bb0b82c7c5615489935f66ab32
SSDEEP

393216:O7GmB+CE9xVhwol+ZwTyaaqgq9F4n5/VlqPmThWWRmKLOSDY:dPmZwTyaaqgq9sW+mUOSDY

Score

1^/10

Malware Config

Signatures

Files

hoi4.exe
.exe windows:6 windows x64 arch:x64

1c3c76ce6583616716a4c0373465efd7

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

16/11/2022, 00:00

Not After

15/12/2023, 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:ed:45:32:85:46:ed:f4:fb:49:61:5f:f6:ef:fe:69:80:a3:55:b8
Signer

Actual PE Digest

c5:ed:45:32:85:46:ed:f4:fb:49:61:5f:f6:ef:fe:69:80:a3:55:b8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

steam_api64

SteamInternal_ContextInit
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallResult
SteamAPI_IsSteamRunning
SteamAPI_Init
SteamInternal_GameServer_Init
SteamGameServer_Shutdown
SteamGameServer_RunCallbacks
SteamInternal_FindOrCreateGameServerInterface
SteamGameServer_GetHSteamUser
SteamInternal_CreateInterface
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamAPI_RunCallbacks
SteamInternal_FindOrCreateUserInterface
SteamAPI_GetHSteamUser

pops_api

POPS_SocialJoinRoom
POPS_SocialListenMessages
POPS_SocialListenFriendListUpdates
POPS_SocialListenPresence
POPS_SocialListenRichPresence
POPS_SocialListenMultiplayerAction
POPS_FileStorageSave
POPS_FileStorageList
POPS_FileStorageRead
POPS_FileStorageDelete
POPS_SocialConnect
POPS_NewsletterSubscribe
POPS_SocialProfileCreate
POPS_SocialProfileRetrieve
POPS_SocialProfileQuery
POPS_AccountConnectAccountSteam
POPS_AccountConnections
POPS_AccountIsOnline
POPS_AccountLogInSteamTicket
POPS_AccountLogInWithAuthToken
POPS_AccountLogIn
POPS_AccountGetDetails
POPS_SetRootPath
POPS_SocialGetOpenFriendRequests
POPS_AppGetChildren
POPS_GenerateGUID
POPS_SocialSendMultiplayerActionToAccountID
POPS_SocialSendMessageToAccountID
POPS_SocialSendPrivateMessageToRoom
POPS_SocialSendMessageToRoom
POPS_SocialSetRichPresence
POPS_SocialGetFriendsList
POPS_SocialRespondToFriendRequest
POPS_SocialDisconnect
POPS_AchievementsSend
POPS_AchievementsStoreToDisk
POPS_AchievementsGet
POPS_Initialize
POPS_Shutdown
POPS_RunCallbacks
POPS_AutoStandardTelemetryEnable
POPS_TelemetrySendMulti
POPS_AchievementsList
POPS_AccountCreate
POPS_AccountGetCountries
POPS_AccountGetGuid
POPS_SocialRemoveFriend
POPS_SocialAddFriend
POPS_SocialListenStatus
POPS_SocialSetXMPPLogLevel
POPS_SetFileIO
POPS_SocialSetPresence
POPS_TokenRetrieveCurrent

setupapi

CM_Get_Device_IDA
SetupDiGetDeviceInterfaceDetailA
CM_Locate_DevNodeA
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
CM_Get_Parent
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces

imm32

ImmGetIMEFileNameA
ImmGetContext
ImmReleaseContext
ImmAssociateContext
ImmGetCompositionStringW
ImmSetCompositionStringW
ImmGetCandidateListW
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmNotifyIME

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

winmm

waveInGetDevCapsW
waveInGetNumDevs
waveOutReset
waveOutWrite
waveOutUnprepareHeader
waveInAddBuffer
waveOutClose
waveOutOpen
waveOutGetErrorTextW
waveOutGetDevCapsW
waveInStart
waveInReset
waveInUnprepareHeader
waveInPrepareHeader
waveInClose
waveOutPrepareHeader
timeBeginPeriod
timeEndPeriod
waveOutGetNumDevs
timeGetTime
waveInOpen

tbb

?destroy@task_base@internal@interface5@tbb@@SAXAEAVtask@4@@Z
?allocate@allocate_root_with_context_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?free@allocate_root_with_context_proxy@internal@tbb@@QEBAXAEAVtask@3@@Z
?allocate@allocate_continuation_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
?allocate@allocate_child_proxy@internal@tbb@@QEBAAEAVtask@3@_K@Z
??1task_group_context@tbb@@QEAA@XZ
?init@task_group_context@tbb@@IEAAXXZ
?note_affinity@task@tbb@@UEAAXG@Z
?deallocate_via_handler_v3@internal@tbb@@YAXPEAX@Z
?allocate_via_handler_v3@internal@tbb@@YAPEAX_K@Z
?internal_max_concurrency@task_arena_base@internal@interface7@tbb@@KAHPEBVtask_arena@34@@Z
?isolate_within_arena@internal@interface7@tbb@@YAXAEAVdelegate_base@123@_J@Z
?get_initial_auto_partitioner_divisor@internal@tbb@@YA_KXZ
?NFS_Allocate@internal@tbb@@YAPEAX_K0PEAX@Z
?NFS_Free@internal@tbb@@YAXPEAX@Z
?observe@task_scheduler_observer_v3@internal@tbb@@QEAAX_N@Z
??1concurrent_vector_base_v3@internal@tbb@@IEAA@XZ
?internal_grow_by@concurrent_vector_base_v3@internal@tbb@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?internal_clear@concurrent_vector_base_v3@internal@tbb@@IEAA_KP6AXPEAX_K@Z@Z
?thread_get_id_v3@internal@tbb@@YA?AVid@tbb_thread_v3@12@XZ
?throw_exception_v4@internal@tbb@@YAXW4exception_id@12@@Z
?is_group_execution_cancelled@task_group_context@tbb@@QEBA_NXZ

ws2_32

htonl
getaddrinfo
WSAStartup
freeaddrinfo
getnameinfo
gethostname
ntohl

opengl32

glDepthMask
glDepthFunc
glDeleteTextures
glCullFace
glDisable
glColorMask
glColor4f
glClearColor
glClear
glBlendFunc
glDrawArrays
glCopyTexSubImage2D
glBindTexture
wglGetProcAddress
wglGetCurrentDC
glViewport
glVertex2f
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glTexEnvf
glStencilOp
glStencilMask
glStencilFunc
glScissor
glReadPixels
glPolygonMode
glPixelStorei
glOrtho
glMatrixMode
glLoadIdentity
glLineWidth
glGetTexImage
glDrawElements
glGetIntegerv
glGetFloatv
glGetError
glGetBooleanv
glGenTextures
glFrontFace
glEnd
glEnable
glGetString
glBegin
glAlphaFunc

d3dx9_43

D3DXCreateCubeTexture
D3DXLoadSurfaceFromSurface
D3DXCompileShader
D3DXCreateLine
D3DXSaveSurfaceToFileInMemory
D3DXLoadSurfaceFromMemory
D3DXCreateTexture
D3DXSaveTextureToFileInMemory

d3d9

Direct3DCreate9Ex
Direct3DCreate9

xinput1_3

ord4
ord2

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

shlwapi

PathFileExistsW
PathAppendW

kernel32

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileExW
GetTempPathW
DuplicateHandle
GetFileType
LoadLibraryExW
TlsFree
RtlUnwind
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
GetCPInfo
CompareStringEx
GetLocaleInfoEx
GetLocaleInfoW
LCMapStringEx
EncodePointer
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetExitCodeThread
GetStringTypeW
GetStartupInfoW
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
IsValidLocale
FreeLibraryAndExitThread
GetDriveTypeW
GetFileInformationByHandle
LCMapStringW
PeekNamedPipe
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleOutputCP
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
MoveFileExW
SetStdHandle
HeapSize
IsValidCodePage
GetACP
GetOEMCP
CreateEventA
SetEvent
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
GetVolumeInformationA
RemoveDirectoryW
GetFileSize
GetFileAttributesExW
GetDriveTypeA
FlushFileBuffers
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
VirtualProtect
CreatePipe
QueryFullProcessImageNameW
GetSystemDefaultUILanguage
GetComputerNameA
GetNativeSystemInfo
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetModuleHandleA
InitializeCriticalSectionEx
DecodePointer
LocalAlloc
SetUnhandledExceptionFilter
GetCommandLineA
CreateProcessW
ReadProcessMemory
GetVersionExA
GetThreadContext
GetThreadId
ResumeThread
SuspendThread
SetLastError
GetFileAttributesA
GetCurrentDirectoryA
RtlCaptureContext
SwitchToThread
ExitThread
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetEndOfFile
SetFileAttributesA
CreateDirectoryA
GetCurrentProcessId
InitializeCriticalSection
DeleteCriticalSection
CloseHandle
GetLastError
CreateProcessA
LocalFree
FormatMessageA
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
FatalExit
WinExec
GetExitCodeProcess
FreeLibrary
GetProcAddress
LoadLibraryA
GetStdHandle
WriteFile
OutputDebugStringW
AttachConsole
GetConsoleMode
WriteConsoleW
CreateFileW
GetFileSizeEx
ReadFile
SetFilePointer
SetFilePointerEx
SetErrorMode
GetTickCount
GetModuleFileNameW
GetModuleHandleW
SetThreadExecutionState
GetCurrentProcess
ExitProcess
TerminateProcess
GlobalMemoryStatusEx
GetSystemInfo
CreateDirectoryW
LoadLibraryW
CreateToolhelp32Snapshot
Process32First
Process32Next
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetCurrentThreadId
ReleaseSemaphore
WaitForSingleObjectEx
CreateSemaphoreW
Sleep
VirtualAlloc
VirtualFree
VirtualQuery
GetEnvironmentVariableA
SetEnvironmentVariableA
IsDebuggerPresent
RaiseException
CreateThread
GetCurrentThread
SetThreadPriority
QueryPerformanceCounter
QueryPerformanceFrequency
VerSetConditionMask
CreateFileA
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
WaitForSingleObject
CreateEventW
FormatMessageW
VerifyVersionInfoW
TlsAlloc
TlsGetValue
TlsSetValue
GlobalAlloc
GlobalUnlock
GlobalLock
CompareStringA
MulDiv
GetModuleHandleExW
WideCharToMultiByte
GetSystemPowerStatus
GetLocaleInfoA
GetModuleFileNameA
GlobalFree
MultiByteToWideChar
GetProcessAffinityMask
SetThreadAffinityMask
SleepEx
ReadDirectoryChangesW
K32GetProcessMemoryInfo

user32

SetCursor
GetCursorPos
GetClipCursor
ClientToScreen
ScreenToClient
ClipCursor
IsRectEmpty
GetWindowLongW
CallNextHookEx
LoadIconW
DestroyIcon
GetRawInputData
RegisterWindowMessageA
GetDoubleClickTime
RegisterDeviceNotificationW
UnregisterDeviceNotification
UnregisterClassA
RegisterClassExA
CreateWindowExA
DestroyWindow
OpenClipboard
CloseClipboard
GetClipboardSequenceNumber
AdjustWindowRectEx
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
GetKeyboardLayout
GetKeyboardState
ToUnicode
MapVirtualKeyW
GetDC
ReleaseDC
ChangeDisplaySettingsExW
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
SetCapture
ReleaseCapture
SetCursorPos
LoadCursorW
CopyImage
CreateIconIndirect
RegisterRawInputDevices
SendMessageW
RegisterClassW
CreateWindowExW
ShowWindow
SetLayeredWindowAttributes
FlashWindowEx
SetWindowPos
GetFocus
SetForegroundWindow
SetPropW
RemovePropW
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IntersectRect
PtInRect
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
GetParent
SetWindowsHookExW
UnhookWindowsHookEx
CreateIconFromResource
SetWindowRgn
GetDesktopWindow
GetRawInputDeviceInfoA
GetRawInputDeviceList
PostThreadMessageW
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetFocus
DrawTextW
SystemParametersInfoA
SystemParametersInfoW
IsChild
LoadCursorA
UpdateWindow
FindWindowExA
LoadCursorFromFileA
DefWindowProcA
SetWindowTextA
MessageBoxIndirectA
GetClassNameA
SetWindowsHookExA
GetWindowRect
GetClientRect
GetPropW
ValidateRect
InvalidateRect
GetUpdateRect
GetForegroundWindow
GetMenu
GetSystemMetrics
KillTimer
SetTimer
GetAsyncKeyState
GetKeyState
IsIconic
GetClassInfoExW
RegisterClassExW
UnregisterClassW
CallWindowProcW
DefWindowProcW
PostMessageW
GetMessageExtraInfo
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
TrackMouseEvent
MessageBoxA
GetActiveWindow
SetClipboardData

gdi32

DeleteDC
GetICMProfileW
CreateCompatibleDC
DeleteObject
SelectObject
GetObjectA
CreateDCW
GetPixelFormat
DescribePixelFormat
ChoosePixelFormat
CreateRectRgn
CombineRgn
SetDeviceGammaRamp
GetDeviceGammaRamp
CreateBitmap
GetDIBits
CreateDIBSection
SetPixelFormat
BitBlt
SetPixel
GetTextMetricsW
GetTextExtentPoint32A
SwapBuffers
CreateCompatibleBitmap
GetDeviceCaps
CreateFontIndirectW

shell32

CommandLineToArgvW
SHCreateDirectoryExW
ShellExecuteW
DragAcceptFiles
SHGetFolderPathW
ExtractIconExW
DragFinish
DragQueryFileW
ShellExecuteExA
ShellExecuteA

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoTaskMemFree
StringFromGUID2
PropVariantClear

oleaut32

SysFreeString

advapi32

GetUserNameA
RegQueryValueExW
RegOpenKeyExW
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenRandom

nakama-cpp

NRtClient_leaveChat
NRtClient_writeChatMessage
NRtClient_updateChatMessage
NRtClient_removeChatMessage
NRtClient_createMatch
NRtClient_joinMatch
NRtClient_joinMatchByToken
NRtClient_leaveMatch
NRtClient_addMatchmaker
NRtClient_removeMatchmaker
NRtClient_sendMatchData
NRtClient_followUsers
NRtClient_unfollowUsers
NRtClient_rpc
NRtClient_setConnectCallback
NRtClient_setDisconnectCallback
NRtClient_setErrorCallback
NRtClient_setChannelMessageCallback
NRtClient_setChannelPresenceCallback
NRtClient_setMatchmakerMatchedCallback
NRtClient_setMatchDataCallback
NRtClient_setMatchPresenceCallback
NRtClient_setNotificationsCallback
NRtClient_setStatusPresenceCallback
NRtClient_setStreamPresenceCallback
NRtClient_setStreamDataCallback
NRtClient_destroy
NClient_setErrorCallback
NClient_setUserData
NStringMap_destroy
NClient_disconnect
NClient_tick
NClient_createRtClientEx
NClient_authenticateDevice
NClient_authenticateEmail
NClient_authenticateFacebook
NClient_authenticateGoogle
NClient_authenticateGameCenter
NClient_authenticateApple
NClient_authenticateCustom
NClient_authenticateSteam
NClient_linkFacebook
NClient_linkEmail
NClient_linkDevice
NClient_linkGoogle
NClient_linkGameCenter
NClient_linkApple
NClient_linkSteam
NClient_linkCustom
NClient_unlinkFacebook
NClient_unlinkEmail
NClient_unlinkGoogle
NClient_unlinkGameCenter
NClient_unlinkApple
NClient_unlinkSteam
NRtClient_joinChat
NClient_unlinkCustom
NClient_importFacebookFriends
NClient_getAccount
NClient_updateAccount
NClient_getUsers
NClient_addFriends
NClient_deleteFriends
NClient_blockFriends
NClient_listFriends
NClient_createGroup
NClient_deleteGroup
NClient_addGroupUsers
NClient_listGroupUsers
NClient_kickGroupUsers
NClient_joinGroup
NClient_leaveGroup
NClient_listGroups
NClient_listUserGroups
NClient_promoteGroupUsers
NClient_demoteGroupUsers
NClient_updateGroup
NClient_listLeaderboardRecords
NClient_listLeaderboardRecordsAroundOwner
NClient_writeLeaderboardRecord
NClient_writeTournamentRecord
NClient_deleteLeaderboardRecord
NClient_listMatches
NClient_listNotifications
NClient_deleteNotifications
NClient_listChannelMessages
NClient_listTournaments
NClient_listTournamentRecords
NClient_listTournamentRecordsAroundOwner
NClient_joinTournament
NClient_listStorageObjects
NClient_listUsersStorageObjects
NClient_writeStorageObjects
NClient_readStorageObjects
NClient_deleteStorageObjects
NClient_rpc
NClient_rpc_with_http_key
createDefaultNakamaClient
destroyNakamaClient
NStringMap_getSize
NStringMap_getKeys
NStringMap_getValue
NStringMap_setValue
NStringMap_create
NRtClient_disconnect
NRtClient_isConnected
NRtClient_connect
NRtClient_getUserData
NRtClient_setUserData
NRtClient_tick
NStringDoubleMap_destroy
NStringDoubleMap_getSize
NStringDoubleMap_getKeys
NStringDoubleMap_getValue
NStringDoubleMap_setValue
NStringDoubleMap_create
NSession_destroy
NSession_getVariables
NSession_isExpiredByTime
NSession_isExpired
NSession_getExpireTime
NSession_getCreateTime
NSession_getUserId
NSession_getUsername
NSession_isCreated
NClient_unlinkDevice
NSession_getAuthToken
NClient_getUserData

pdxbrowser_ipc

GetPDXModule

Exports

Exports

?PHYSFS_addToSearchPath@@YAHPEBDH@Z
?PHYSFS_caseFold@@YAHIPEAI@Z
?PHYSFS_close@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_deinit@@YAHXZ
?PHYSFS_delete@@YAHPEBD@Z
?PHYSFS_deregisterArchiver@@YAHPEBD@Z
?PHYSFS_enumerate@@YAHPEBDP6A?AW4PHYSFS_EnumerateCallbackResult@@PEAX00W4PHYSFS_FileType@@@Z1@Z
?PHYSFS_enumerateFiles@@YAPEAPEADPEBD@Z
?PHYSFS_enumerateFilesCallback@@YAXPEBDP6AXPEAX00@Z1@Z
?PHYSFS_eof@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_exists@@YAHPEBD@Z
?PHYSFS_fileLength@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_flush@@YAHPEAUPHYSFS_File@@@Z
?PHYSFS_freeList@@YAXPEAX@Z
?PHYSFS_freezeConfig@@YAX_N@Z
?PHYSFS_getAllocator@@YAPEBUPHYSFS_Allocator@@XZ
?PHYSFS_getBaseDir@@YAPEBDXZ
?PHYSFS_getCdRomDirs@@YAPEAPEADXZ
?PHYSFS_getCdRomDirsCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getDirSeparator@@YAPEBDXZ
?PHYSFS_getErrorByCode@@YAPEBDW4PHYSFS_ErrorCode@@@Z
?PHYSFS_getLastError@@YAPEBDXZ
?PHYSFS_getLastErrorCode@@YA?AW4PHYSFS_ErrorCode@@XZ
?PHYSFS_getLastModTime@@YA_JPEBD@Z
?PHYSFS_getLinkedVersion@@YAXPEAUPHYSFS_Version@@@Z
?PHYSFS_getMountPoint@@YAPEBDPEBD@Z
?PHYSFS_getPrefDir@@YAPEBDPEBD0@Z
?PHYSFS_getRealDir@@YAPEBDPEBD@Z
?PHYSFS_getSearchPath@@YAPEAPEADXZ
?PHYSFS_getSearchPathCallback@@YAXP6AXPEAXPEBD@Z0@Z
?PHYSFS_getUserDir@@YAPEBDXZ
?PHYSFS_getWriteDir@@YAPEBDXZ
?PHYSFS_init@@YAHPEBD@Z
?PHYSFS_isDirectory@@YAHPEBD@Z
?PHYSFS_isInit@@YAHXZ
?PHYSFS_isSymbolicLink@@YAHPEBD@Z
?PHYSFS_mkdir@@YAHPEBD@Z
?PHYSFS_mount@@YAHPEBD0H@Z
?PHYSFS_mountHandle@@YAHPEAUPHYSFS_File@@PEBD1H@Z
?PHYSFS_mountIo@@YAHPEAUPHYSFS_Io@@PEBD1H@Z
?PHYSFS_mountMemory@@YAHPEBX_KP6AXPEAX@ZPEBD4H@Z
?PHYSFS_openAppend@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openRead@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_openWrite@@YAPEAUPHYSFS_File@@PEBD@Z
?PHYSFS_permitSymbolicLinks@@YAXH@Z
?PHYSFS_read@@YA_JPEAUPHYSFS_File@@PEAXII@Z
?PHYSFS_readBytes@@YA_JPEAUPHYSFS_File@@PEAX_K@Z
?PHYSFS_readSBE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSBE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSBE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readSLE16@@YAHPEAUPHYSFS_File@@PEAF@Z
?PHYSFS_readSLE32@@YAHPEAUPHYSFS_File@@PEAH@Z
?PHYSFS_readSLE64@@YAHPEAUPHYSFS_File@@PEA_J@Z
?PHYSFS_readUBE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readUBE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readUBE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_readULE16@@YAHPEAUPHYSFS_File@@PEAG@Z
?PHYSFS_readULE32@@YAHPEAUPHYSFS_File@@PEAI@Z
?PHYSFS_readULE64@@YAHPEAUPHYSFS_File@@PEA_K@Z
?PHYSFS_registerArchiver@@YAHPEBUPHYSFS_Archiver@@@Z
?PHYSFS_removeFromSearchPath@@YAHPEBD@Z
?PHYSFS_seek@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setAllocator@@YAHPEBUPHYSFS_Allocator@@@Z
?PHYSFS_setBuffer@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_setRoot@@YAHPEBD0@Z
?PHYSFS_setSaneConfig@@YAHPEBD00HH@Z
?PHYSFS_setWriteDir@@YAHPEBD@Z
?PHYSFS_stat@@YAHPEBDPEAUPHYSFS_Stat@@@Z
?PHYSFS_supportedArchiveTypes@@YAPEAPEBUPHYSFS_ArchiveInfo@@XZ
?PHYSFS_swapSBE16@@YAFF@Z
?PHYSFS_swapSBE32@@YAHH@Z
?PHYSFS_swapSBE64@@YA_J_J@Z
?PHYSFS_swapSLE16@@YAFF@Z
?PHYSFS_swapSLE32@@YAHH@Z
?PHYSFS_swapSLE64@@YA_J_J@Z
?PHYSFS_swapUBE16@@YAGG@Z
?PHYSFS_swapUBE32@@YAII@Z
?PHYSFS_swapUBE64@@YA_K_K@Z
?PHYSFS_swapULE16@@YAGG@Z
?PHYSFS_swapULE32@@YAII@Z
?PHYSFS_swapULE64@@YA_K_K@Z
?PHYSFS_symbolicLinksPermitted@@YAHXZ
?PHYSFS_tell@@YA_JPEAUPHYSFS_File@@@Z
?PHYSFS_ucs4stricmp@@YAHPEBI0@Z
?PHYSFS_unmount@@YAHPEBD@Z
?PHYSFS_utf16stricmp@@YAHPEBG0@Z
?PHYSFS_utf8FromLatin1@@YAXPEBDPEAD_K@Z
?PHYSFS_utf8FromUcs2@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8FromUcs4@@YAXPEBIPEAD_K@Z
?PHYSFS_utf8FromUtf16@@YAXPEBGPEAD_K@Z
?PHYSFS_utf8ToUcs2@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8ToUcs4@@YAXPEBDPEAI_K@Z
?PHYSFS_utf8ToUtf16@@YAXPEBDPEAG_K@Z
?PHYSFS_utf8stricmp@@YAHPEBD0@Z
?PHYSFS_write@@YA_JPEAUPHYSFS_File@@PEBXII@Z
?PHYSFS_writeBytes@@YA_JPEAUPHYSFS_File@@PEBX_K@Z
?PHYSFS_writeSBE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSBE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSBE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeSLE16@@YAHPEAUPHYSFS_File@@F@Z
?PHYSFS_writeSLE32@@YAHPEAUPHYSFS_File@@H@Z
?PHYSFS_writeSLE64@@YAHPEAUPHYSFS_File@@_J@Z
?PHYSFS_writeUBE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeUBE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeUBE64@@YAHPEAUPHYSFS_File@@_K@Z
?PHYSFS_writeULE16@@YAHPEAUPHYSFS_File@@G@Z
?PHYSFS_writeULE32@@YAHPEAUPHYSFS_File@@I@Z
?PHYSFS_writeULE64@@YAHPEAUPHYSFS_File@@_K@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 34.7MB - Virtual size: 34.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7.9MB - Virtual size: 7.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.9MB - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 316KB - Virtual size: 316KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1c3c76ce6583616716a4c0373465efd7

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cdCertificate

Extended Key Usages

Key Usages

c5:ed:45:32:85:46:ed:f4:fb:49:61:5f:f6:ef:fe:69:80:a3:55:b8Signer

Headers

DLL Characteristics

File Characteristics

Imports

steam_api64

pops_api

setupapi

imm32

version

winmm

tbb

ws2_32

opengl32

d3dx9_43

d3d9

xinput1_3

d3dcompiler_47

d3d11

dxgi

shlwapi

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

bcrypt

nakama-cpp

pdxbrowser_ipc

Exports

Exports

Sections

.text Size: 34.7MB - Virtual size: 34.7MB

.rdata Size: 7.9MB - Virtual size: 7.9MB

.data Size: 1.9MB - Virtual size: 6.7MB

.pdata Size: 1.4MB - Virtual size: 1.4MB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 13KB - Virtual size: 12KB

.reloc Size: 316KB - Virtual size: 316KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0b:27:bf:d3:30:8e:6f:a0:b7:f9:29:b1:fb:9f:b4:cd
Certificate

c5:ed:45:32:85:46:ed:f4:fb:49:61:5f:f6:ef:fe:69:80:a3:55:b8
Signer

.text
Size: 34.7MB - Virtual size: 34.7MB

.rdata
Size: 7.9MB - Virtual size: 7.9MB

.data
Size: 1.9MB - Virtual size: 6.7MB

.pdata
Size: 1.4MB - Virtual size: 1.4MB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 13KB - Virtual size: 12KB

.reloc
Size: 316KB - Virtual size: 316KB