repatch[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

repatch.exe
Size

16.9MB
MD5

2289edcc2d3518e2c4eb4a0579237dac
SHA1

0b5f84159fd167df591dd7d3fcd40e08f648aa50
SHA256

eb447ed70aa5f20a8ce454f2f35802e972ecffe0f59712ad1de54b1460fc61a5
SHA512

87f8e23acd718af1e0e1c1c87a5cf105270c71a96afa9f6ccbfb5e909de2c7e8800f63dcf6c679117587d3e4de7f86d5f152e5db9ae6c15e2a74311b91a2f2f9
SSDEEP

196608:C3AuLdTv6AnYmjzBQpdUxtAQ7Lbu+JpKKUuq3+xV6thxVWryyrwjgVApBCXvaY4K:CQodTCjKUuG9jyXv+Ju

Score

1^/10

Malware Config

Signatures

Files

repatch.exe
.exe windows:5 windows x86 arch:x86

c204e8cb9b513301ba2cae5a24ebbdc3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

11/10/2016, 00:00

Not After

11/10/2019, 23:59

Subject

CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c0:9a:bc:97:a7:01:0a:bc:81:f3:e7:33:aa:82:96:0d:83:1f:1e:e9
Signer

Actual PE Digest

c0:9a:bc:97:a7:01:0a:bc:81:f3:e7:33:aa:82:96:0d:83:1f:1e:e9

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Work\Trunk2012\Client\RCCService\Win32\Release\RCCService.pdb

Imports

kernel32

GetModuleFileNameA
QueueUserWorkItem
SetConsoleTextAttribute
SetConsoleCtrlHandler
GetComputerNameA
GetGeoInfoA
GetUserGeoID
GetShortPathNameW
GetModuleFileNameW
GetVersionExA
IsWow64Process
SetLastError
FormatMessageA
GetProcessHeap
GetStdHandle
WaitForSingleObject
DebugBreak
InterlockedDecrement
InterlockedIncrement
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
MultiByteToWideChar
FindNextFileA
FindFirstFileA
CreateFileA
CompareFileTime
FileTimeToSystemTime
SystemTimeToFileTime
GetSystemTime
WriteFile
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
WideCharToMultiByte
MoveFileA
DeleteFileA
FindResourceExW
FindResourceW
SizeofResource
LoadResource
LockResource
GetCurrentThreadId
CreateMutexA
WriteProcessMemory
GetCurrentProcess
VirtualProtect
GetProcAddress
HeapFree
SetThreadContext
CreateThread
ReplaceFileW
SetEnvironmentVariableA
GetEnvironmentVariableA
GetModuleHandleExA
LoadLibraryExA
CreateSemaphoreA
ReleaseSemaphore
DuplicateHandle
Sleep
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetTickCount
OpenProcess
LoadLibraryA
OutputDebugStringA
LocalFree
GetSystemInfo
WaitForMultipleObjectsEx
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
SetWaitableTimer
VirtualQuery
GlobalMemoryStatusEx
GetProcessHeaps
HeapSetInformation
GlobalLock
GlobalUnlock
ReleaseMutex
VerSetConditionMask
FreeLibrary
GetVersion
SleepEx
ExpandEnvironmentStringsA
VerifyVersionInfoA
SetUnhandledExceptionFilter
CreateProcessA
GetThreadContext
FreeConsole
GetProcessAffinityMask
GetCurrentThread
GetLocalTime
SetThreadPriority
HeapDestroy
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
GetLastError
GetModuleHandleA
ResetEvent
SetEvent
GetCurrentProcessId
WaitForSingleObjectEx
CloseHandle
GetTempPathA
HeapAlloc
OpenEventA
CreateEventA
InitializeCriticalSectionAndSpinCount
DeviceIoControl
FindClose
GetFileTime
SetFileTime
GetTempPathW
GetCurrentDirectoryW
GetDiskFreeSpaceExW
CreateDirectoryW
RemoveDirectoryW
GetFullPathNameW
CreateFileW
GetFileAttributesW
DeleteFileW
FindFirstFileW
FindNextFileW
MoveFileExW
OpenEventW
LoadLibraryW
SearchPathW
RaiseException

user32

GetWindowTextA
GetAsyncKeyState
PostMessageA
GetDC
GetClientRect
EnumDisplayDevicesA
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetWindowInfo
OpenClipboard
CloseClipboard
GetClipboardData
DefWindowProcA
PostQuitMessage
MessageBoxA
DestroyWindow
CreateWindowExA
RegisterClassA

advapi32

RegisterServiceCtrlHandlerA
CryptImportKey
CryptGenRandom
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
StartServiceA
StartServiceCtrlDispatcherA
SetServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
ChangeServiceConfig2A
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
RegCloseKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptVerifySignatureA

ole32

CoUninitialize
CoInitialize
CoCreateGuid
StringFromGUID2
CoCreateInstance

shlwapi

PathIsRelativeA
PathAddBackslashA
PathStripPathA
PathRemoveFileSpecA
PathFileExistsA
PathAppendA

dbghelp

MiniDumpWriteDump

msvcp110

?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
_Inf
_Nan
_FInf
_FNan
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??7ios_base@std@@QBE_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?fail@ios_base@std@@QBE_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??Bios_base@std@@QBEPAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?id@?$ctype@D@std@@2V0locale@2@A
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?classic@locale@std@@SAABV12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?widen@?$ctype@D@std@@QBEDD@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
?exceptions@ios_base@std@@QAEXH@Z
?flags@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?precision@ios_base@std@@QAE_J_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?toupper@?$ctype@D@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?setf@ios_base@std@@QAEHH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?eof@ios_base@std@@QBE_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_FDtest
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?uncaught_exception@std@@YA_NXZ
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?_Xbad_alloc@std@@YAXXZ

msvcr110

?_GetConcurrency@details@Concurrency@@YAIXZ
_stricmp
ferror
fread
fseek
ftell
vsprintf
getenv
?terminate@@YAXXZ
__libm_sse2_log10f
__libm_sse2_powf
strerror
_beginthreadex
_wassert
calloc
realloc
__libm_sse2_log
_vsnprintf
__libm_sse2_logf
toupper
iswspace
exit
__iob_func
abort
__RTtypeid
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
clock
__libm_sse2_tan
__libm_sse2_tanf
_CIfmod
isupper
isalnum
_wfopen
__libm_sse2_cosf
__libm_sse2_acosf
__libm_sse2_cos
__libm_sse2_sin
__libm_sse2_sinf
qsort
fputs
isalpha
_errno
frexp
ldexp
modf
strcoll
strcspn
strpbrk
feof
freopen
getc
islower
isxdigit
iscntrl
localeconv
_CIcosh
_CIsinh
_CItanh
__libm_sse2_acos
__libm_sse2_asin
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_exp
__libm_sse2_log10
_HUGE
_wcsnicmp
__libm_sse2_atanf
?before@type_info@@QBE_NABV1@@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??1bad_typeid@std@@UAE@XZ
strtok
atof
__libm_sse2_asinf
_difftime64
_aligned_free
_aligned_malloc
__libm_sse2_expf
_mbschr
_mbsnbcpy
fgets
_stat64
__sys_nerr
_strtoi64
_exit
_strtoui64
_strnicmp
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_vsnprintf_s
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_setmode
_mktime64
_localtime64
_gmtime64
strftime
_ftime64
_isnan
strstr
strrchr
strncat
strchr
sprintf
_snprintf
sscanf
fprintf
fopen
wctomb
strtoul
strtol
strtod
rand
mbtowc
atol
___mb_cur_max_func
ispunct
ceil
_setjmp3
_wstat64i32
_wchdir
_wgetcwd
_finite
_wfopen_s
_wfsopen
_vswprintf_c_l
_CIatan2
_libm_sse2_sin_precise
_libm_sse2_cos_precise
_libm_sse2_sqrt_precise
_strdup
_write
_read
longjmp
tolower
isspace
isdigit
srand
_kbhit
_getch
??0exception@std@@QAE@XZ
sprintf_s
_mbsnicmp
_mbsicmp
strncpy_s
atoi
strncmp
_except_handler3
_vscprintf
vsprintf_s
strncpy
malloc
_set_purecall_handler
_mkdir
memmove_s
strnlen
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
_unlock_file
_lock_file
ungetc
setvbuf
printf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
memcpy_s
__RTDynamicCast
_time64
memchr
memset
memcpy
__libm_sse2_pow
_CxxThrowException
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
memmove
??_V@YAXPAX@Z
free
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
__CxxLongjmpUnwind
__CxxFrameHandler3

version

GetFileVersionInfoW
VerQueryValueA
GetFileVersionInfoSizeW

wsock32

gethostname
getsockname
getpeername
WSAGetLastError
WSACleanup
WSASetLastError
inet_addr
WSAStartup
gethostbyname
shutdown
setsockopt
sendto
send
select
recvfrom
recv
ntohs
ntohl
listen
ioctlsocket
htons
htonl
getsockopt
inet_ntoa
connect
closesocket
bind
socket
__WSAFDIsSet
accept

winmm

timeSetEvent
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeGetTime

psapi

GetModuleInformation
GetProcessMemoryInfo
GetModuleBaseNameA

vmprotectsdk32

VMProtectEnd
VMProtectIsDebuggerPresent
VMProtectBeginVirtualization
VMProtectBeginMutation

ws2_32

WSAIoctl
freeaddrinfo
getaddrinfo
getnameinfo

fmod

?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?setMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?getParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAMPADH@Z
FMOD_Memory_GetStats
FMOD_System_Create
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@_NPAPAVDSPConnection@2@@Z
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2@Z
?setDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
FMOD_Sound_GetUserData
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getCurrentSound@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSound@2@@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?setReverbProperties@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_REVERB_PROPERTIES@@@Z
?getSystemObject@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?addInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAPAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?disconnectFrom@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAVDSPConnection@2@@Z
?setParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAXI@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?getDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVDSP@2@@Z
?removeDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@@Z
?getNumDSPs@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?set3DMinMaxDistance@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?setUserData@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?unlock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAX0II@Z
?lock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIPAPAX0PAI1@Z
?isRecording@System@FMOD@@QAG?AW4FMOD_RESULT@@HPA_N@Z
?recordStart@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAVSound@2@_N@Z
?getRecordPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAI@Z
?getRecordDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2PAI@Z
?getRecordNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getMeteringInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_DSP_METERING_INFO@@0@Z
?getMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N0@Z
?setMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z

shell32

SHGetFolderPathAndSubDirW
SHGetFolderPathW

gdi32

ChoosePixelFormat
SetPixelFormat
SwapBuffers

opengl32

wglDeleteContext
wglCreateContext
glReadPixels
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glPixelStorei
glGetTexImage
glGenTextures
glDeleteTextures
glDrawElements
glDrawArrays
glViewport
glStencilOp
glStencilMask
wglGetCurrentContext
glReadBuffer
glPolygonOffset
glEnable
glDisable
glDepthMask
glDepthFunc
glCullFace
glCopyTexSubImage2D
glColorMask
glClearStencil
glClearDepth
glClearColor
glClear
glBlendFunc
glBindTexture
glGetString
glGetIntegerv
wglMakeCurrent
wglGetCurrentDC
wglGetProcAddress
glStencilFunc

Exports

Exports

?FastLog@FLog@@YAXEPBDPBX1111@Z
?FastLog@FLog@@YAXEPBDPBX11@Z
?FastLog@FLog@@YAXEPBDPBX@Z
?FastLogF@FLog@@YAXEPBDMMMM@Z
?FastLogFormatted@FLog@@YAXEPBDZZ
?FastLogS@FLog@@YAXEPBD0@Z
?FastLogS@FLog@@YAXEPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ForEachVariable@FLog@@YAXP6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAX@Z1W4FastVarType@@@Z
?GetFastLogCounter@FLog@@YAHE@Z
?GetNumSynchronizedVariable@FLog@@YAGXZ
?GetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@_N@Z
?Init@FLog@@YAXP6ANXZ@Z
?NowFast@FLog@@YANXZ
?RegisterFlag@FLog@@YAHPBDPA_NPAPA_NW4FastVarType@@@Z
?RegisterInt@FLog@@YAHPBDPAHPAPA_NW4FastVarType@@@Z
?RegisterLogGroup@FLog@@YAHPBDPAEPAPA_NW4FastVarType@@@Z
?RegisterString@FLog@@YAHPBDPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAPA_NW4FastVarType@@@Z
?ResetSynchronizedVariablesState@FLog@@YAXXZ
?SetExternalLogFunc@FLog@@YAXP6AXEPBD@Z@Z
?SetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4FastVarType@@_N@Z
?SetValueFromServer@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?WriteFastLogDump@FLog@@YAXPBDH@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 11.3MB - Virtual size: 11.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lua
Size: 154KB - Virtual size: 153KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c204e8cb9b513301ba2cae5a24ebbdc3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6Certificate

Extended Key Usages

Key Usages

c0:9a:bc:97:a7:01:0a:bc:81:f3:e7:33:aa:82:96:0d:83:1f:1e:e9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

ole32

shlwapi

dbghelp

msvcp110

msvcr110

version

wsock32

winmm

psapi

vmprotectsdk32

ws2_32

fmod

shell32

gdi32

opengl32

Exports

Exports

Sections

.text Size: 11.3MB - Virtual size: 11.3MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 1.2MB - Virtual size: 6.2MB

.lua Size: 154KB - Virtual size: 153KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1.5MB - Virtual size: 1.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

c0:9a:bc:97:a7:01:0a:bc:81:f3:e7:33:aa:82:96:0d:83:1f:1e:e9
Signer

.text
Size: 11.3MB - Virtual size: 11.3MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 1.2MB - Virtual size: 6.2MB

.lua
Size: 154KB - Virtual size: 153KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1.5MB - Virtual size: 1.5MB