D:\Mt2\Metin2009_OLD\Project\Src\Client\UserInterface\Debug\debug.pdb
Static task
static1
Behavioral task
behavioral1
Sample
6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656.exe
Resource
win10v2004-20231222-en
General
-
Target
6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656
-
Size
14.9MB
-
MD5
068cad8b7427c946b62ec4628d3e64ca
-
SHA1
f360c336ab6ad98c1bb297a89033b291b0398c52
-
SHA256
6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656
-
SHA512
2fdb4f6778176660f8482035b2e2e31003966dc042c31879c7f766b7a31ea3a73849c19b5e3fb7d80ddba8d72a3fab061e12d58de4828e75e0e35396b23f1eae
-
SSDEEP
196608:+RZLD0nimKlllc83QuM8EdhxRlHfG8JlPvqW:+RZLYvKlL3QPxe8JlXqW
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656
Files
-
6436a9f62b340f9e2e2886b5f008b3daa7888d6612a1137dcf9f1aa9b462f656.exe windows:6 windows x86 arch:x86
63ea3ad9794badb8bf3c3bc76b756f37
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
SetFileInformationByHandle
InitOnceComplete
InitOnceBeginInitialize
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SetFilePointer
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
FlsAlloc
SetThreadpoolWait
CloseThreadpoolWait
GetFileInformationByHandleEx
CreateSymbolicLinkW
MoveFileA
GetPrivateProfileStringA
lstrlenA
GlobalFree
GetModuleFileNameA
IsWow64Process
CreateMutexA
ReleaseMutex
DeleteFileA
GetCurrentDirectoryA
FindNextFileA
FindFirstFileA
FindClose
SetFileAttributesA
Process32Next
Process32First
GetSystemInfo
OpenProcess
SetThreadPriority
SetEndOfFile
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
DeleteFileW
SetFileAttributesW
GetTimeZoneInformation
SetStdHandle
CreateProcessW
GetExitCodeProcess
FlushFileBuffers
HeapQueryInformation
HeapSize
HeapReAlloc
SetFilePointerEx
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
OutputDebugStringW
GetConsoleOutputCP
Sleep
GetConsoleMode
DuplicateHandle
GetFileAttributesExW
CreateDirectoryW
SetCurrentDirectoryW
SetEnvironmentVariableW
FlsGetValue
ExitProcess
GetFullPathNameW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
HeapValidate
ReadFile
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
LoadLibraryExW
GetModuleFileNameW
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
SetLastError
FindNextFileW
FindFirstFileW
WakeAllConditionVariable
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
GetThreadTimes
GetCurrentThread
GetSystemTimeAsFileTime
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
GetStartupInfoW
GetCurrentThreadId
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
IsDebuggerPresent
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
InitializeSListHead
GetCPInfo
CompareStringEx
GetStringTypeW
GetLocaleInfoEx
LCMapStringEx
DecodePointer
EncodePointer
LocalFree
CreateEventA
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
Module32Next
Module32First
CreateToolhelp32Snapshot
ReadProcessMemory
GetCurrentProcessId
GetCurrentProcess
GetLastError
CloseHandle
FlsSetValue
FlsFree
InitOnceExecuteOnce
SleepConditionVariableSRW
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
WriteFile
SubmitThreadpoolWork
InitializeCriticalSectionEx
FormatMessageA
CopyFileA
CreateSemaphoreA
ReleaseSemaphore
GetLocaleInfoA
CompareStringA
lstrlenW
GlobalLock
GlobalUnlock
LoadLibraryA
GetProcAddress
FreeLibrary
GetVersionExA
GetSystemDirectoryA
GetModuleHandleA
WideCharToMultiByte
GetFileSize
GetTempFileNameA
GetTempPathA
RemoveDirectoryA
QueryPerformanceFrequency
QueryPerformanceCounter
AllocConsole
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CreateFileA
CreateDirectoryA
GlobalAlloc
MultiByteToWideChar
GetTickCount
GetCurrentDirectoryW
ReadConsoleW
OutputDebugStringA
user32
SetWindowPos
PostQuitMessage
OffsetRect
SetRect
FillRect
ClientToScreen
GetClientRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
GetAsyncKeyState
PeekMessageA
GetCursorPos
FindWindowA
LoadIconA
SystemParametersInfoA
GetKeyState
ShowCursor
SetCursor
DestroyCursor
LoadImageA
SetCursorPos
ShowWindow
GetCapture
SetCapture
ReleaseCapture
ChangeDisplaySettingsA
LoadStringA
MessageBoxA
CharPrevExA
CharNextExA
CharNextW
GetClipboardData
CloseClipboard
OpenClipboard
GetKeyboardLayout
GetKeyboardLayoutNameA
DispatchMessageA
TranslateMessage
LoadCursorA
AdjustWindowRectEx
GetWindowRect
SetWindowTextA
GetMenu
DefWindowProcA
UnregisterClassA
RegisterClassExA
CreateWindowExA
IsWindow
DestroyWindow
MoveWindow
SetFocus
UpdateWindow
GetWindowLongA
SetWindowLongA
RegisterClassA
ScreenToClient
GetSystemMetrics
gdi32
CreateCompatibleDC
SetTextColor
SetBkMode
SetDIBitsToDevice
CreateDIBSection
TextOutA
SetBkColor
SelectObject
GetCharABCWidthsFloatW
CreateFontIndirectA
EnumFontFamiliesExA
GetStockObject
GetTextExtentPoint32A
TextOutW
StretchBlt
PatBlt
DeleteObject
CreateSolidBrush
DeleteDC
GetTextExtentPoint32W
advapi32
CryptGenRandom
CryptReleaseContext
RegGetValueA
RegSetValueExA
RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegQueryValueExA
CryptAcquireContextA
shell32
SHGetSpecialFolderPathA
ShellExecuteA
ole32
OleSetContainedObject
OleUninitialize
OleInitialize
CoGetClassObject
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
winmm
timeBeginPeriod
timeEndPeriod
timeGetTime
timeGetDevCaps
d3d9
Direct3DCreate9
d3dx9_42
D3DXVec3Normalize
D3DXVec3TransformCoord
D3DXMatrixRotationQuaternion
D3DXMatrixTranspose
D3DXVec3Transform
D3DXQuaternionRotationYawPitchRoll
D3DXPlaneNormalize
D3DXMatrixRotationY
D3DXGetFVFVertexSize
D3DXCreateTextureFromFileInMemoryEx
D3DXCreateTexture
D3DXLoadSurfaceFromSurface
D3DXCreateSphere
D3DXCreateCylinder
D3DXCreateMatrixStack
D3DXMatrixOrthoOffCenterRH
D3DXMatrixOrthoRH
D3DXMatrixPerspectiveFovRH
D3DXVec3Unproject
D3DXVec3Project
D3DXMatrixLookAtRH
D3DXMatrixDeterminant
D3DXVec2Normalize
D3DXMatrixScaling
D3DXVec4Transform
D3DXMatrixRotationAxis
D3DXVec3TransformNormal
D3DXMatrixRotationX
D3DXMatrixInverse
D3DXMatrixRotationYawPitchRoll
D3DXQuaternionMultiply
D3DXQuaternionRotationAxis
D3DXMatrixRotationZ
D3DXMatrixTranslation
D3DXMatrixMultiply
python27
PyModule_AddIntConstant
Py_InitModule4
PyLong_AsLong
PyTuple_Size
PyDict_GetItemString
PyLong_FromLongLong
PyLong_FromUnsignedLong
PyInt_FromLong
PyTuple_New
PyList_New
PyLong_AsLongLong
PyModule_AddStringConstant
PyImport_ImportModule
PyString_InternFromString
PyObject_GetAttrString
PyList_Append
PyTuple_GetItem
PyString_FromString
PyInt_AsLong
PyObject_GetAttr
PyCallable_Check
PyLong_AsUnsignedLong
PyLong_AsUnsignedLongLong
PyFloat_AsDouble
PyExc_RuntimeError
PyErr_Print
PyErr_Occurred
PyErr_SetString
PyTuple_SetItem
PyString_AsString
PyErr_Clear
PyErr_BadArgument
PyObject_CallObject
PyNumber_Check
_Py_NoneStruct
PyDict_SetItemString
PyModule_GetDict
PyErr_Fetch
Py_SetProgramName
Py_Initialize
Py_Finalize
PyRun_StringFlags
PyEval_SetTrace
Py_FlushLine
PyImport_GetMagicNumber
PyImport_AddModule
PyObject_AsCharBuffer
PyCode_Addr2Line
PyEval_EvalCode
Py_OptimizeFlag
PyCode_Type
PyUnicodeUCS2_DecodeUTF8
_PyLong_FromByteArray
PyFloat_FromDouble
PyComplex_FromCComplex
PyString_FromStringAndSize
PyList_SetItem
PyDict_New
PyDict_SetItem
PyErr_NoMemory
PyEval_GetRestricted
PyCode_New
PyMarshal_ReadObjectFromString
_Py_EllipsisObject
PyExc_StopIteration
PyExc_EOFError
PyExc_ValueError
Py_BuildValue
_PyLong_New
devil
ilEnable
ilDeleteImages
ilCopyPixels
ilConvertImage
ilBindImage
ilInit
ilTexImage
ilSetPixels
ilSave
ilShutDown
ilGetInteger
ilOriginFunc
ilLoad
ilGenImages
imm32
ImmGetOpenStatus
ImmSetConversionStatus
ImmGetConversionStatus
ImmGetCandidateListW
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmIsIME
ImmGetIMEFileNameA
ImmNotifyIME
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
granny2
_GrannySetControlEaseIn@8
_GrannySetControlEaseInCurve@28
_GrannySetControlEaseOut@8
_GrannySetControlEaseOutCurve@28
_GrannySetControlSpeed@8
_GrannyGetControlSpeed@4
_GrannySetControlLoopCount@8
_GrannyGetControlLoopCount@4
_GrannyFreeControlIfComplete@4
_GrannyControlIsComplete@4
_GrannyCompleteControlAt@8
_GrannySetLogCallback@4
_GrannyGetMaterialTextureByType@8
_GrannyFindMatchingMember@16
_GrannyConvertSingleObject@20
_GrannyReadEntireFileFromMemory@8
_GrannyFreeControl@4
_GrannyFreeFileSection@8
_GrannyFreeFile@4
_GrannyGetFileInfo@4
_GrannyGetSourceSkeleton@4
_GrannySetModelClock@8
_GrannyFreeCompletedModelControls@4
_GrannySampleModelAnimationsAcceleratedLOD@24
_GrannyUpdateModelMatrix@20
_GrannyNewLocalPose@4
_GrannyFreeLocalPose@4
_GrannyGetWorldPoseComposite4x4Array@4
_GrannyInstantiateModel@4
_GrannyFreeModelInstance@4
_GrannyNewMeshBinding@12
_GrannyFreeMeshBinding@4
_GrannyGetMeshBindingToBoneIndices@4
_GrannyFindBoneByName@12
_GrannyNewWorldPose@4
_GrannyFreeWorldPose@4
_GrannyFreeControlOnceUnused@4
_GrannyGetWorldPose4x4@8
_GrannyGetControlLocalDuration@4
_GrannyGetControlRawLocalClock@4
_GrannySetControlRawLocalClock@8
_GrannyPlayControlledAnimation@12
_GrannyGetMeshTriangleGroupCount@4
_GrannyGetMeshTriangleGroups@4
_GrannyGetMeshVertexType@4
_GrannyCopyMeshVertices@12
_GrannyGetWorldPoseComposite4x4@8
_GrannyGetTotalTypeSize@4
_GrannyGetMeshVertexCount@4
_GrannyGetMeshIndexCount@4
_GrannyMeshIsRigid@4
_GrannyGetMeshVertices@4
_GrannyCopyMeshIndices@12
GrannyPNT332VertexType
_GrannyDeformVertices@24
_GrannyFreeMeshDeformer@4
_GrannyNewMeshDeformer@16
mss32
_AIL_mem_free_lock@4
_AIL_file_read@8
_AIL_set_file_callbacks@16
_AIL_WAV_info@8
_AIL_decompress_ASI@24
_AIL_decompress_ADPCM@12
_AIL_file_type@8
_AIL_open_digital_driver@16
_AIL_open_stream@12
_AIL_close_digital_driver@4
_AIL_open_3D_provider@4
_AIL_close_3D_provider@4
_AIL_open_3D_listener@4
_AIL_close_3D_listener@4
_AIL_set_3D_position@16
_AIL_set_3D_velocity@20
_AIL_set_3D_orientation@28
_AIL_startup@0
_AIL_shutdown@0
_AIL_set_redist_directory@4
_AIL_close_stream@4
_AIL_start_stream@4
_AIL_pause_stream@8
_AIL_set_stream_volume_levels@12
_AIL_stream_volume_levels@12
_AIL_set_stream_loop_count@8
_AIL_stream_status@4
_AIL_last_error@0
_AIL_allocate_sample_handle@4
_AIL_init_sample@4
_AIL_set_sample_file@12
_AIL_start_sample@4
_AIL_stop_sample@4
_AIL_resume_sample@4
_AIL_end_sample@4
_AIL_set_sample_volume_pan@12
_AIL_set_sample_loop_count@8
_AIL_sample_status@4
_AIL_sample_volume_pan@12
_AIL_allocate_3D_sample_handle@4
_AIL_release_3D_sample_handle@4
_AIL_start_3D_sample@4
_AIL_stop_3D_sample@4
_AIL_release_sample_handle@4
_AIL_resume_3D_sample@4
_AIL_end_3D_sample@4
_AIL_set_3D_sample_file@8
_AIL_set_3D_sample_volume@8
_AIL_set_3D_sample_loop_count@8
_AIL_3D_sample_status@4
_AIL_3D_sample_volume@4
_AIL_update_3D_position@8
_AIL_auto_update_3D_position@8
_AIL_enumerate_3D_providers@12
speedtreert
?GetLeafLightingAdjustment@CSpeedTreeRT@@QBEMXZ
?SetFrondLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetLeafLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetBranchLightingMethod@CSpeedTreeRT@@QAEXW4ELightingMethod@1@@Z
?SetTreePosition@CSpeedTreeRT@@QAEXMMM@Z
?GetTreePosition@CSpeedTreeRT@@QBEPBMXZ
?SetTreeSize@CSpeedTreeRT@@QAEXMM@Z
?GetTreeSize@CSpeedTreeRT@@QBEXAAM0@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBEI@Z
?LoadTree@CSpeedTreeRT@@QAE_NPBD@Z
?GetLeafMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetLeafRockingState@CSpeedTreeRT@@QAEX_N@Z
?Compute@CSpeedTreeRT@@QAE_NPBMI_N@Z
??3CSpeedTreeRT@@SAXPAX@Z
??2CSpeedTreeRT@@SAPAXI@Z
??1CSpeedTreeRT@@QAE@XZ
?GetCollisionObject@CSpeedTreeRT@@QAEXIAAW4ECollisionObjectType@1@PAM1@Z
?GetCollisionObjectCount@CSpeedTreeRT@@QAEIXZ
?GetBoundingBox@CSpeedTreeRT@@QBEXPAM@Z
?GetCurrentError@CSpeedTreeRT@@SAPBDXZ
?SetTextureFlip@CSpeedTreeRT@@SAX_N@Z
?GetBranchMaterial@CSpeedTreeRT@@QBEPBMXZ
?DeleteTransientData@CSpeedTreeRT@@QAEXXZ
?GetTextures@CSpeedTreeRT@@QBEXAAUSTextures@1@@Z
??0CSpeedTreeRT@@QAE@XZ
?GetFrondMaterial@CSpeedTreeRT@@QBEPBMXZ
?SetNumLeafRockingGroups@CSpeedTreeRT@@QAEXI@Z
?SetLeafWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetBranchWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetFrondWindMethod@CSpeedTreeRT@@QAEXW4EWindMethod@1@@Z
?SetLocalMatrices@CSpeedTreeRT@@QAEXII@Z
?ComputeLodLevel@CSpeedTreeRT@@QAEXXZ
?SetLodLevel@CSpeedTreeRT@@QAEXM@Z
?MakeInstance@CSpeedTreeRT@@QAEPAV1@XZ
??1STextures@CSpeedTreeRT@@QAE@XZ
??0STextures@CSpeedTreeRT@@QAE@XZ
??1SGeometry@CSpeedTreeRT@@QAE@XZ
??0SGeometry@CSpeedTreeRT@@QAE@XZ
?SetCamera@CSpeedTreeRT@@SAXPBM0@Z
?SetLightAttributes@CSpeedTreeRT@@SAXIPBM@Z
?SetLightState@CSpeedTreeRT@@SAXI_N@Z
?SetLodLimits@CSpeedTreeRT@@QAEXMM@Z
?SetNumWindMatrices@CSpeedTreeRT@@SAXI@Z
?SetWindStrength@CSpeedTreeRT@@QAEMMMM@Z
?SetTime@CSpeedTreeRT@@SAXM@Z
?SetDropToBillboard@CSpeedTreeRT@@SAX_N@Z
?GetNumBranchLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumLeafLodLevels@CSpeedTreeRT@@QBEGXZ
?GetNumFrondLodLevels@CSpeedTreeRT@@QBEGXZ
?GetGeometry@CSpeedTreeRT@@QAEXAAUSGeometry@1@KFFF@Z
dinput8
DirectInput8Create
ws2_32
gethostname
gethostbyname
__WSAFDIsSet
closesocket
connect
ioctlsocket
recv
select
send
socket
WSAGetLastError
WSAStartup
WSACleanup
htonl
htons
inet_addr
ntohl
ntohs
ddraw
DirectDrawCreate
oleaut32
VariantClear
VariantInit
SafeArrayAccessData
SafeArrayDestroy
SafeArrayCreate
SysAllocString
SysFreeString
Exports
Exports
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
Sections
.textbss Size: - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 11.9MB - Virtual size: 11.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 186KB - Virtual size: 623KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msvcjmc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 1024B - Virtual size: 987B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 265B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 273KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ