2024-01-18_56e7001ed6c507c536396ffe7ebe7dee_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-01-18_56e7001ed6c507c536396ffe7ebe7dee_ryuk
Size

36.3MB
MD5

56e7001ed6c507c536396ffe7ebe7dee
SHA1

381ef35e97b06d8b97c9ce6edff55068b061c6c5
SHA256

1f66bf5944941c0f766b09cf3294c6808774b894fc66d8c280f47dde79c2d139
SHA512

65a36608f944fb71823963d06bc585b5bc89e93ec7af198b5a2ec1a1e890303302be10e18cf26c59cd3aa40ef4b863446a709c08dd17ebb0381213edfbd6850e
SSDEEP

393216:QQjnwx6gQ99MAyT7Fk1D9kNQcJ9PLnhxtgeaAtws:zknHCCtgetws

Score

1^/10

Malware Config

Signatures

Files

2024-01-18_56e7001ed6c507c536396ffe7ebe7dee_ryuk
.exe windows:6 windows x64 arch:x64

88a9691203a89ff136410f2e7e049445

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:92:61:fa:48:6b:16:10:71:3a:4c:b9:ec:7e:6c:42
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/03/2022, 00:00

Not After

23/04/2025, 23:59

Subject

CN=STARDOCK SYSTEMS\, INC.,O=STARDOCK SYSTEMS\, INC.,L=Plymouth,ST=Michigan,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7f:a6:f8:74:08:72:10:d2:74:80:9e:b4:f2:e3:d2:d5:13:f2:ab:2d
Signer

Actual PE Digest

7f:a6:f8:74:08:72:10:d2:74:80:9e:b4:f2:e3:d2:d5:13:f2:ab:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveBackslashW
PathFindExtensionW
PathStripPathW
AssocQueryStringW
PathFindNextComponentW
PathAppendA
PathGetDriveNumberW
PathAppendW
PathRemoveFileSpecW
PathRemoveExtensionW

comctl32

InitCommonControlsEx

shell32

ord165
SHGetSpecialFolderPathW
SHGetKnownFolderPath
SHCreateDirectoryExW
ShellExecuteW
CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW

winmm

timeBeginPeriod
timeSetEvent

steam_api64

SteamAPI_RegisterCallback
SteamAPI_Init
SteamAPI_RegisterCallResult
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamAPI_GetHSteamUser
SteamAPI_Shutdown
SteamInternal_ContextInit
SteamAPI_UnregisterCallback
SteamAPI_WriteMiniDump
SteamAPI_UnregisterCallResult

eossdk-win64-shipping

EOS_Connect_GetExternalAccountMapping
EOS_Friends_GetFriendsCount
EOS_EpicAccountId_ToString
EOS_Platform_GetConnectInterface
EOS_Presence_QueryPresence
EOS_Lobby_RemoveNotifyLobbyUpdateReceived
EOS_LobbyDetails_GetLobbyOwner
EOS_LobbySearch_Release
EOS_Presence_AddNotifyOnPresenceChanged
EOS_LobbyModification_SetMaxMembers
EOS_P2P_CloseConnection
EOS_Lobby_CopyLobbyDetailsHandle
EOS_Lobby_RemoveNotifyLobbyMemberStatusReceived
EOS_Presence_Info_Release
EOS_Connect_CreateUser
EOS_UI_ShowFriends
EOS_Lobby_AddNotifyLobbyInviteReceived
EOS_Auth_Token_Release
EOS_P2P_GetNATType
EOS_Achievements_CopyPlayerAchievementByIndex
EOS_Friends_QueryFriends
EOS_Logging_SetCallback
EOS_UserInfo_QueryUserInfo
EOS_Platform_Tick
EOS_Lobby_AddNotifyLobbyUpdateReceived
EOS_Lobby_CreateLobbySearch
EOS_Friends_GetFriendAtIndex
EOS_ProductUserId_IsValid
EOS_Platform_GetEcomInterface
EOS_Connect_AddNotifyAuthExpiration
EOS_P2P_ReceivePacket
EOS_UI_AddNotifyDisplaySettingsUpdated
EOS_UI_RemoveNotifyDisplaySettingsUpdated
EOS_LobbyDetails_CopyMemberAttributeByIndex
EOS_Friends_AddNotifyFriendsUpdate
EOS_Lobby_AddNotifyLobbyMemberUpdateReceived
EOS_LobbyDetails_GetAttributeCount
EOS_LobbyModification_SetPermissionLevel
EOS_LobbyDetails_GetMemberAttributeCount
EOS_Lobby_KickMember
EOS_Lobby_Attribute_Release
EOS_P2P_QueryNATType
EOS_Ecom_QueryOwnership
EOS_LobbyDetails_CopyAttributeByIndex
EOS_LobbyDetails_Release
EOS_Platform_GetLobbyInterface
EOS_Connect_QueryExternalAccountMappings
EOS_Presence_CopyPresence
EOS_EpicAccountId_IsValid
EOS_Auth_Login
EOS_Connect_LinkAccount
EOS_Connect_RemoveNotifyLoginStatusChanged
EOS_Achievements_AddNotifyAchievementsUnlockedV2
EOS_Lobby_RemoveNotifyJoinLobbyAccepted
EOS_Connect_RemoveNotifyAuthExpiration
EOS_Auth_GetLoggedInAccountByIndex
EOS_Lobby_AddNotifyJoinLobbyAccepted
EOS_Auth_GetLoggedInAccountsCount
EOS_LobbyDetails_GetMemberCount
EOS_Friends_GetStatus
EOS_Lobby_UpdateLobbyModification
EOS_Lobby_CopyLobbyDetailsHandleByInviteId
EOS_LobbyDetails_Info_Release
EOS_Presence_RemoveNotifyOnPresenceChanged
EOS_LobbyModification_AddMemberAttribute
EOS_P2P_SendPacket
EOS_Lobby_AddNotifyLobbyInviteAccepted
EOS_Connect_Login
EOS_Lobby_UpdateLobby
EOS_LobbyModification_AddAttribute
EOS_ByteArray_ToString
EOS_Auth_CopyUserAuthToken
EOS_Stats_IngestStat
EOS_Platform_GetUserInfoInterface
EOS_LobbySearch_SetParameter
EOS_LobbySearch_GetSearchResultCount
EOS_Platform_Create
EOS_Stats_Stat_Release
EOS_Shutdown
EOS_Platform_GetStatsInterface
EOS_LobbySearch_CopySearchResultByIndex
EOS_Stats_GetStatsCount
EOS_Lobby_JoinLobby
EOS_ProductUserId_ToString
EOS_LobbyModification_RemoveAttribute
EOS_Auth_Logout
EOS_Achievements_QueryPlayerAchievements
EOS_Lobby_CreateLobby
EOS_Connect_AddNotifyLoginStatusChanged
EOS_Auth_DeletePersistentAuth
EOS_Platform_Release
EOS_Platform_GetUIInterface
EOS_Platform_GetPresenceInterface
EOS_P2P_AcceptConnection
EOS_Friends_RemoveNotifyFriendsUpdate
EOS_Achievements_GetPlayerAchievementCount
EOS_LobbyModification_RemoveMemberAttribute
EOS_UserInfo_Release
EOS_UserInfo_CopyUserInfo
EOS_Achievements_RemoveNotifyAchievementsUnlocked
EOS_Achievements_PlayerAchievement_Release
EOS_Achievements_UnlockAchievements
EOS_LobbySearch_Find
EOS_Lobby_RemoveNotifyLobbyInviteAccepted
EOS_Lobby_AddNotifyLobbyMemberStatusReceived
EOS_EpicAccountId_FromString
EOS_P2P_AddNotifyPeerConnectionRequest
EOS_Lobby_CopyLobbyDetailsHandleByUiEventId
EOS_Lobby_SendInvite
EOS_Lobby_LeaveLobby
EOS_Platform_GetP2PInterface
EOS_Initialize
EOS_Platform_GetAchievementsInterface
EOS_LobbyDetails_GetMemberByIndex
EOS_Connect_GetProductUserIdMapping
EOS_Lobby_DestroyLobby
EOS_Stats_QueryStats
EOS_Platform_GetFriendsInterface
EOS_LobbyModification_Release
EOS_LobbyDetails_CopyInfo
EOS_EResult_ToString
EOS_P2P_RemoveNotifyPeerConnectionRequest
EOS_Lobby_RemoveNotifyLobbyInviteReceived
EOS_Platform_CheckForLauncherAndRestart
EOS_ProductUserId_FromString
EOS_Connect_QueryProductUserIdMappings
EOS_Auth_GetLoginStatus
EOS_Lobby_RejectInvite
EOS_P2P_GetNextReceivedPacketSize
EOS_Lobby_RemoveNotifyLobbyMemberUpdateReceived
EOS_Stats_CopyStatByIndex
EOS_Platform_GetAuthInterface

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeA
GetFileVersionInfoA

d3dx10_43

D3DXVec3CatmullRom
D3DXVec2Normalize
D3DXQuaternionRotationMatrix
D3DXQuaternionNormalize
D3DXQuaternionRotationYawPitchRoll
D3DXVec3Normalize
D3DXMatrixTranslation
D3DXMatrixTransformation
D3DXMatrixOrthoLH
D3DXVec3Unproject
D3DXVec3Project
D3DXPlaneFromPoints
D3DXMatrixLookAtLH
D3DXVec3Transform
D3DXMatrixPerspectiveFovLH
D3DXMatrixTranspose
D3DXQuaternionSlerp
D3DXPlaneIntersectLine
D3DXCreateMatrixStack
D3DXQuaternionInverse
D3DXQuaternionMultiply
D3DXVec3TransformNormal
D3DXMatrixRotationY
D3DXMatrixMultiply
D3DXMatrixScaling
D3DXMatrixRotationZ
D3DXMatrixDecompose
D3DXMatrixInverse
D3DXVec3TransformCoord
D3DXMatrixRotationQuaternion
D3DXVec4Normalize
D3DXMatrixRotationYawPitchRoll
D3DXMatrixRotationAxis
D3DXMatrixRotationX
D3DXIntersectTri

mss64

AIL_sample_stage_property
MilesBeginEventQueueProcessing
MilesEnumerateSoundInstances
AIL_get_soundbank_mem_usage
AIL_enqueue_event_end_named
AIL_last_error
AIL_enqueue_event_position
AIL_close_stream
AIL_open_filter
AIL_enqueue_event_buffer
AIL_set_sample_is_3D
AIL_start_stream
AIL_set_listener_3D_orientation
MilesSetVarF
AIL_enqueue_event_cancel
AIL_set_file_callbacks
MilesCompleteEventQueueProcessing
AIL_sample_user_data
AIL_end_sample
AIL_set_sample_user_data
AIL_pause_stream
AIL_enqueue_event_start
AIL_startup
MilesSetEventErrorCallback
AIL_set_sample_3D_distances
AIL_set_sample_3D_position
AIL_register_falloff_function_callback
AIL_stream_sample_handle
MilesStopSoundInstances
AIL_stream_status
AIL_open_digital_driver
MilesEnqueueEventByName
AIL_sample_status
AIL_listener_3D_position
AIL_find_filter
AIL_set_preference
AIL_set_sample_processor
AIL_set_stream_loop_count
AIL_set_stream_position
MilesAddSoundBank
AIL_set_redist_directory
AIL_set_listener_3D_position
AIL_stream_position
MilesStartupEventSystem
AIL_set_sample_volume_pan
AIL_open_stream

icuuc73

?GetAppendBuffer@ByteSink@icu_73@@UEAAPEADHHPEADHPEAH@Z
??1ByteSink@icu_73@@UEAA@XZ
?length@UnicodeString@icu_73@@QEBAHXZ
?Flush@ByteSink@icu_73@@UEAAXXZ
??1UnicodeString@icu_73@@UEAA@XZ
??3UMemory@icu_73@@SAXPEAX@Z
??0UnicodeString@icu_73@@QEAA@PEB_S@Z
?toUTF8@UnicodeString@icu_73@@QEBAXAEAVByteSink@2@@Z

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11SaveTextureToFileW
D3DX11CreateTextureFromMemory
D3DX11CreateShaderResourceViewFromFileW
D3DX11CreateShaderResourceViewFromMemory
D3DX11CompileFromFileW
D3DX11GetImageInfoFromMemory
D3DX11GetImageInfoFromFileW
D3DX11CreateTextureFromFileW

d3dcompiler_46

D3DGetInputSignatureBlob
D3DReflect

tachyon_api64

ord13
ord215
ord14
ord223
ord271
ord270
ord290
ord21
ord28
ord225
ord230
ord220
ord218
ord29
ord20
ord26
ord25
ord22
ord31
ord24
ord280
ord4
ord77
ord80
ord30
ord222
ord217
ord228
ord229
ord221
ord71
ord64
ord246
ord245
ord214
ord1
ord11
ord12
ord3
ord110
ord2
ord5
ord6
ord226

neutrino

GetDefaultParams
CreateContext
FreeContext
FreeParams

kernel32

SetEnvironmentVariableW
SetEnvironmentVariableA
GetDriveTypeW
GetTimeZoneInformation
GetACP
SetConsoleCtrlHandler
ExitProcess
GetModuleHandleExW
ExitThread
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
VirtualProtect
VirtualFree
VirtualAlloc
LoadLibraryExW
FreeLibraryAndExitThread
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
InitializeSListHead
GetCPInfo
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
QueueUserWorkItem
IsProcessorFeaturePresent
DecodePointer
EncodePointer
RtlPcToFileHeader
GetStringTypeW
GetNativeSystemInfo
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetStdHandle
SetFilePointerEx
FlushFileBuffers
HeapAlloc
HeapFree
HeapReAlloc
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetOEMCP
WriteConsoleW
GetProcessHeap
FindFirstFileExA
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
CreateProcessA
CreatePipe
SetEndOfFile
GetFileInformationByHandle
LoadLibraryExA
FindNextFileA
FindFirstFileA
GetSystemTimeAsFileTime
CreateMutexA
CreateSemaphoreA
CreateEventA
TryEnterCriticalSection
GetThreadPriority
CreateThread
IsDBCSLeadByteEx
IsValidCodePage
DuplicateHandle
GetFullPathNameW
GetFullPathNameA
GetFileSize
CreateFileA
GetCurrentThreadId
FindFirstFileW
FindNextFileW
FindClose
WaitForSingleObject
GetFileAttributesW
Sleep
SetEvent
DeleteFileW
ResetEvent
CopyFileW
IsDebuggerPresent
SetLastError
SetFileAttributesW
CreateEventW
CloseHandle
MoveFileExW
CreateProcessW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateDirectoryW
lstrlenW
RemoveDirectoryW
WritePrivateProfileStringW
RtlCaptureContext
WriteFile
GetPrivateProfileIntW
GetModuleFileNameW
GetUserDefaultUILanguage
SetErrorMode
GetEnvironmentVariableW
GetTempPathW
CreateFileW
GetPrivateProfileStringW
GetLastError
OutputDebugStringW
LoadLibraryW
GetCurrentDirectoryW
GetCurrentProcessId
GetModuleHandleW
WideCharToMultiByte
GetSystemTime
MoveFileW
SetUnhandledExceptionFilter
LocalFree
GetComputerNameW
CancelIo
GetLongPathNameW
ReleaseSemaphore
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
WaitForSingleObjectEx
QueueUserAPC
ReadDirectoryChangesW
CreateSemaphoreW
SleepEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GlobalAlloc
GlobalLock
DeleteCriticalSection
GlobalUnlock
GetExitCodeProcess
ReadFile
SetFilePointer
SetPriorityClass
GetCurrentProcess
GetVersionExW
GetFileAttributesExW
GetSystemInfo
SetCurrentDirectoryW
GetProcAddress
GlobalMemoryStatusEx
FreeLibrary
CreateDirectoryExW
FreeEnvironmentStringsW
GetModuleHandleA
LoadLibraryA
GetLocaleInfoW
SetThreadAffinityMask
SetThreadPriority
CreateMutexW
ReleaseMutex
SuspendThread
ResumeThread
GetExitCodeThread
TerminateThread
RaiseException
GetTickCount
LocalAlloc
MultiByteToWideChar
FormatMessageW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
GetFileTime
GetModuleFileNameA
OutputDebugStringA
GetEnvironmentVariableA
GetCurrentDirectoryA
RtlCaptureStackBackTrace
GetCurrentThread
GetVersionExA
GetThreadContext
ReadProcessMemory
GetTempFileNameW
GetStdHandle

user32

LoadIconW
ShowWindow
RegisterClassExW
SetWindowTextW
GetSystemMetrics
EndDialog
CreateWindowExW
MessageBoxW
DefWindowProcW
IsClipboardFormatAvailable
SetRectEmpty
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OffsetRect
OpenClipboard
InflateRect
ShowCursor
SetForegroundWindow
ReleaseCapture
PostQuitMessage
GetKeyNameTextW
SetRect
GetClientRect
SetWindowLongW
SetCursor
SetCapture
ClipCursor
LoadCursorW
TranslateMessage
DisableProcessWindowsGhosting
ValidateRect
PeekMessageW
ClientToScreen
GetMonitorInfoW
DispatchMessageW
ScreenToClient
SetWindowPos
GetDC
DestroyWindow
GetMenu
MonitorFromPoint
MapVirtualKeyW
PostMessageW
GetKeyState
AdjustWindowRectEx
GetMessageW
GetWindowLongW
GetKeyboardLayout
SetDlgItemTextW
GetWindowDC
wsprintfW
GetDlgItem
DialogBoxParamW
UpdateWindow
LoadImageW
IsIconic
FlashWindowEx
PtInRect
ReleaseDC

gdi32

GetStockObject
CreatePolygonRgn
PtInRegion
DeleteObject
CreatePatternBrush
GetDeviceCaps

advapi32

RegSetValueExW
GetNamedSecurityInfoA
LookupAccountSidA
RegConnectRegistryA
RegEnumKeyExA
GetUserNameA
RegQueryValueExA
RegCreateKeyExW
RegOpenKeyExA
RegOpenKeyA
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoTaskMemFree
CoCreateGuid

dbghelp

SymSetOptions
SymInitialize
SymGetLineFromAddr64
MiniDumpWriteDump
SymFromAddr

wininet

InternetAttemptConnect
InternetReadFile
InternetCrackUrlW
InternetCheckConnectionW
InternetSetOptionW
HttpOpenRequestW
InternetQueryDataAvailable
InternetOpenW
InternetConnectW
HttpSendRequestW
HttpAddRequestHeadersW
InternetCloseHandle
HttpQueryInfoW

psapi

GetProcessMemoryInfo

dxgi

CreateDXGIFactory1

bink2w64

BinkGetError
BinkOpen
BinkGetFrameBuffersInfo
BinkNextFrame
BinkWaitStopAsyncThread
BinkDoFrameAsync
BinkOpenXAudio2
BinkGetRects
BinkClose
BinkShouldSkip
BinkSetSoundTrack
BinkStartAsyncThread
BinkSetSoundSystem2
BinkCurrentSubtitle
BinkLoadSubtitles
BinkWait
BinkDoFrameAsyncWait
BinkSetVolume
BinkPause
BinkRequestStopAsyncThread
BinkDoFrame

Exports

Exports

??0CThread@@QEAA@P6AIPEAX@Z0KHHPEBD@Z
??0EventSem@@QEAA@XZ
??0MemManager@@QEAA@H@Z
??0MemManager@@QEAA@PEB_WH@Z
??0MemManager@@QEAA@XZ
??0MutexSem@@QEAA@XZ
??1CThread@@UEAA@XZ
??1EventSem@@QEAA@XZ
??1MemManager@@QEAA@XZ
??1MutexSem@@QEAA@XZ
?Allocate@MemManager@@QEAAJPEAPEAX_KPEB_WK@Z
?AutoResetWaitForEvent@CThread@@QEBAHXZ
?CancelTickRateSetCountdown@TickCounter@@QEAAXXZ
?CheckMemoryIntegrity@MemManager@@QEAAHXZ
?CheckTickCountdown@TickCounter@@QEAAXK@Z
?DebugErrorA@@YAXPEBDZZ
?DebugErrorW@@YAXPEB_WZZ
?DebugMessageA@@YAXPEBDZZ
?DebugMessageW@@YAXPEB_WZZ
?DebugSpewToFileA@@YAXPEBD0AEAPEAD@Z
?DebugSpewToFileA@@YAXPEBD0ZZ
?DebugSpewToFileA@@YAXPEBD0_K0ZZ
?DebugSpewToFileW@@YAXPEB_W0AEAPEAD@Z
?DebugSpewToFileW@@YAXPEB_W0ZZ
?DebugSpewToFileW@@YAXPEB_W0_K0ZZ
?Duplicate@MemManager@@QEAAJPEAPEAX0@Z
?EchoDebugMessageA@@YAXPEBDZZ
?EchoDebugMessageW@@YAXPEB_WZZ
?FilterDebugOutputA@@YAXW4Enum@DebugMsgLevel@@W41DebugMsgCategory@@HPEBDAEAPEAD@Z
?FilterDebugOutputA@@YAXW4Enum@DebugMsgLevel@@W41DebugMsgCategory@@HPEBDZZ
?FilterDebugOutputW@@YAXW4Enum@DebugMsgLevel@@W41DebugMsgCategory@@HPEB_WAEAPEAD@Z
?FilterDebugOutputW@@YAXW4Enum@DebugMsgLevel@@W41DebugMsgCategory@@HPEB_WZZ
?FilterOutputLastError@@YAHW4Enum@DebugMsgLevel@@W41DebugMsgCategory@@H@Z
?FormattedTextWinCallback@@YAKPEAXKKKK@Z
?Free@MemManager@@QEAAXPEAPEAX@Z
?GenerateDebugSpewFilenameA@@YAHPEBD0_KPEAD@Z
?GenerateDebugSpewFilenameW@@YAHPEB_W0_KPEA_W@Z
?GetName@CThread@@QEBAPEB_WXZ
?GetThreadID@CThread@@QEBAKXZ
?GiveupThreadTime@@YAXXZ
?IsOwned@MutexSem@@QEAAHXZ
?IsPosted@EventSem@@QEAAHXZ
?IsRunning@CThread@@QEBAHK@Z
?IsSuspended@CThread@@QEAAHXZ
?Kill@CThread@@QEAAXXZ
?MemManPrintCurrentMemoryUsage@MemManager@@QEAAXXZ
?Pause@CThread@@QEAAHXZ
?Post@EventSem@@QEAAXXZ
?QuerySystemTick@TickCounter@@QEAAKXZ
?RawDebugMessageA@@YAXPEBDZZ
?RawDebugMessageW@@YAXPEB_WZZ
?RawDebugStringA@@YAXPEBDZZ
?RawDebugStringW@@YAXPEB_WZZ
?Release@MutexSem@@QEAAXXZ
?Request@MutexSem@@QEAAXXZ
?RequestIfFree@MutexSem@@QEAAHXZ
?Reset@EventSem@@QEAAXXZ
?ResetWaitForEvent@CThread@@QEAAHXZ
?Resize@MemManager@@QEAAJPEAPEAX_K@Z
?Resume@CThread@@QEAAXXZ
?SetAutoResetWaitForEvent@CThread@@QEAAXH@Z
?SetDebugMemoryCheckEnabled@MemManager@@QEAAXH@Z
?SetIsReadyToPause@CThread@@QEAAXH@Z
?SetName@CThread@@QEAAXPEB_W@Z
?SetPriority@CThread@@QEAAXH@Z
?SetSecondsPerTick@TickCounter@@QEAAXM@Z
?SetTickRate@TickCounter@@QEAAXK@Z
?SetWaitForEvent@CThread@@QEAAHXZ
?StartTickRateSetCountdown@TickCounter@@QEAAXXZ
?Stop@CThread@@QEAAHH@Z
?Suspend@CThread@@QEAAXXZ
?ValidPointer@MemManager@@QEAAHPEAE@Z
?Wait@CThread@@QEAAXXZ
?WaitForEvent@CThread@@QEAAKK@Z
?WaitOn@EventSem@@QEAAHK@Z
?WaitOn@EventSem@@QEAAXXZ
?_AssertMsg@@YAHPEB_WK00PEAH@Z
?_RunMark@@YAXPEB_WK@Z
?getExitCode@CThread@@QEAAKXZ
?isPauseEventSignaled@CThread@@QEBAHK@Z
?isStopEventSignaled@CThread@@QEBAHK@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 23.7MB - Virtual size: 23.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.0MB - Virtual size: 9.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.6MB - Virtual size: 356.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 173KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 331KB - Virtual size: 331KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 202KB - Virtual size: 202KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88a9691203a89ff136410f2e7e049445

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:92:61:fa:48:6b:16:10:71:3a:4c:b9:ec:7e:6c:42Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

7f:a6:f8:74:08:72:10:d2:74:80:9e:b4:f2:e3:d2:d5:13:f2:ab:2dSigner

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

comctl32

shell32

winmm

steam_api64

eossdk-win64-shipping

version

d3dx10_43

mss64

icuuc73

d3d11

d3dx11_43

d3dcompiler_46

tachyon_api64

neutrino

kernel32

user32

gdi32

advapi32

ole32

dbghelp

wininet

psapi

dxgi

bink2w64

Exports

Exports

Sections

.text Size: 23.7MB - Virtual size: 23.7MB

.rdata Size: 9.0MB - Virtual size: 9.0MB

.data Size: 1.6MB - Virtual size: 356.0MB

.pdata Size: 1.3MB - Virtual size: 1.3MB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 7KB - Virtual size: 6KB

_RDATA Size: 512B - Virtual size: 32B

.rsrc Size: 173KB - Virtual size: 173KB

.reloc Size: 331KB - Virtual size: 331KB

.bind Size: 202KB - Virtual size: 202KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:92:61:fa:48:6b:16:10:71:3a:4c:b9:ec:7e:6c:42
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

7f:a6:f8:74:08:72:10:d2:74:80:9e:b4:f2:e3:d2:d5:13:f2:ab:2d
Signer

.text
Size: 23.7MB - Virtual size: 23.7MB

.rdata
Size: 9.0MB - Virtual size: 9.0MB

.data
Size: 1.6MB - Virtual size: 356.0MB

.pdata
Size: 1.3MB - Virtual size: 1.3MB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 7KB - Virtual size: 6KB

_RDATA
Size: 512B - Virtual size: 32B

.rsrc
Size: 173KB - Virtual size: 173KB

.reloc
Size: 331KB - Virtual size: 331KB

.bind
Size: 202KB - Virtual size: 202KB