ck3[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

ck3.exe
Size

71.9MB
MD5

4cdadc00e66e3f27ceef44b9f2383b41
SHA1

e6e3018d8267c2b079ac8c8aadef3cc279c290d5
SHA256

b8c37250a1bf0b7f5f0138ff73fedf1a51ab3e53b4fa496ca1d7b8e9972e7c92
SHA512

752dd345168684ed0820efec20b7d866f51022551da650cfe70c1968b58d19ea77f6f70668e9ffcb2b718f60784b57dd1d5bfc93237a364ebff55c630cc23840
SSDEEP

393216:RLKhzHBazDiDXfcYR6A/XSzCaFmv9oc4pOC3nUbtLf0oT+Oc7tpmGe6Rxd9KtS8y:OIq8y14befQpmGe6Rxd8urp6zh5zwLf

Score

1^/10

Malware Config

Signatures

Files

ck3.exe
.exe windows:6 windows x64 arch:x64

b9a3434d7f83f6ecbd55e7510984d9b9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:32:38:6f:94:b0:b6:bf:d2:34:22:b5:6b:8a:0c:29
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

29/11/2023, 00:00

Not After

18/12/2024, 23:59

Subject

CN=Paradox Interactive AB (publ),O=Paradox Interactive AB (publ),L=Stockholm,C=SE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:6b:8d:40:2c:5a:61:12:b6:67:06:29:76:f4:36:71:21:45:10:7f:bb:32:4e:31:6e:73:1b:28:94:50:8b:81
Signer

Actual PE Digest

e8:6b:8d:40:2c:5a:61:12:b6:67:06:29:76:f4:36:71:21:45:10:7f:bb:32:4e:31:6e:73:1b:28:94:50:8b:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\mnt\builds\gsg\ck3\titus\outputdir_windows\binaries\ck3.pdb

Imports

advapi32

CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextA
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
RegGetValueA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
GetUserNameA

nvtt

??0InputOptions@nvtt@@QEAA@XZ
?errorString@nvtt@@YAPEBDW4Error@1@@Z
?setErrorHandler@OutputOptions@nvtt@@QEAAXPEAUErrorHandler@2@@Z
?setOutputHandler@OutputOptions@nvtt@@QEAAXPEAUOutputHandler@2@@Z
??1OutputOptions@nvtt@@QEAA@XZ
??0OutputOptions@nvtt@@QEAA@XZ
?estimateSize@Compressor@nvtt@@QEBAHAEBUInputOptions@2@AEBUCompressionOptions@2@@Z
?process@Compressor@nvtt@@QEBA_NAEBUInputOptions@2@AEBUCompressionOptions@2@AEBUOutputOptions@2@@Z
?enableCudaAcceleration@Compressor@nvtt@@QEAAX_N@Z
??1Compressor@nvtt@@QEAA@XZ
??0Compressor@nvtt@@QEAA@XZ
?setFormat@CompressionOptions@nvtt@@QEAAXW4Format@2@@Z
??1InputOptions@nvtt@@QEAA@XZ
?setTextureLayout@InputOptions@nvtt@@QEAAXW4TextureType@2@HHH@Z
?setMipmapData@InputOptions@nvtt@@QEAA_NPEBXHHHHH@Z
?setMipmapGeneration@InputOptions@nvtt@@QEAAX_NH@Z
??0CompressionOptions@nvtt@@QEAA@XZ
??1CompressionOptions@nvtt@@QEAA@XZ

nakama-cpp

NRtClient_setStreamDataCallback
NClient_linkCustom
createDefaultNakamaClient
NClient_deleteFriends
NSession_isExpired
NClient_linkGoogle
NRtClient_joinMatch
NRtClient_leaveChat
NRtClient_setChannelMessageCallback
NStringDoubleMap_create
NClient_writeStorageObjects
NRtClient_setStatusPresenceCallback
NClient_unlinkGameCenter
NClient_deleteStorageObjects
NClient_listTournamentRecordsAroundOwner
NRtClient_setDisconnectCallback
NClient_readStorageObjects
NClient_listNotifications
NSession_getVariables
NClient_writeTournamentRecord
NClient_listChannelMessages
NRtClient_writeChatMessage
NRtClient_createMatch
NClient_authenticateEmail
NClient_deleteGroup
NStringDoubleMap_getSize
NClient_listFriends
NClient_unlinkFacebook
NClient_createRtClientEx
NClient_authenticateGoogle
NClient_addGroupUsers
NStringDoubleMap_destroy
NClient_linkApple
NClient_rpc_with_http_key
NStringMap_getSize
NClient_listTournamentRecords
NClient_unlinkCustom
NClient_authenticateCustom
NRtClient_setMatchmakerMatchedCallback
NStringMap_destroy
NClient_authenticateSteam
NSession_isCreated
NClient_authenticateGameCenter
NSession_getUserId
NClient_authenticateFacebook
NStringMap_create
NSession_getUsername
NRtClient_setNotificationsCallback
NStringDoubleMap_getKeys
NClient_linkEmail
NStringMap_setValue
NRtClient_setStreamPresenceCallback
NRtClient_destroy
NClient_demoteGroupUsers
NRtClient_setMatchDataCallback
NClient_updateGroup
NRtClient_leaveMatch
NClient_deleteLeaderboardRecord
NClient_blockFriends
NRtClient_sendMatchData
NClient_leaveGroup
NClient_createGroup
NSession_getExpireTime
NRtClient_rpc
NRtClient_unfollowUsers
NStringMap_getKeys
NClient_listGroupUsers
NRtClient_setErrorCallback
NStringMap_getValue
NClient_updateAccount
NClient_linkFacebook
NRtClient_followUsers
NStringDoubleMap_setValue
NClient_listTournaments
NSession_getCreateTime
NClient_authenticateDevice
NClient_listMatches
NClient_joinTournament
NRtClient_removeMatchmaker
NClient_linkGameCenter
NClient_listUserGroups
NClient_writeLeaderboardRecord
NClient_addFriends
NRtClient_updateChatMessage
NClient_disconnect
NClient_listStorageObjects
NRtClient_tick
NClient_linkDevice
NClient_listUsersStorageObjects
NClient_tick
NClient_getAccount
NSession_isExpiredByTime
NClient_linkSteam
NClient_getUsers
NRtClient_joinChat
NRtClient_disconnect
NClient_rpc
NRtClient_removeChatMessage
NClient_unlinkSteam
NSession_getAuthToken
NClient_deleteNotifications
NClient_unlinkDevice
NClient_kickGroupUsers
NClient_setErrorCallback
NClient_authenticateApple
NRtClient_connect
NClient_getUserData
destroyNakamaClient
NRtClient_getUserData
NClient_importFacebookFriends
NClient_joinGroup
NClient_unlinkEmail
NRtClient_setChannelPresenceCallback
NRtClient_setMatchPresenceCallback
NRtClient_isConnected
NClient_setUserData
NClient_unlinkGoogle
NRtClient_addMatchmaker
NSession_destroy
NClient_promoteGroupUsers
NClient_unlinkApple
NClient_listLeaderboardRecordsAroundOwner
NClient_listLeaderboardRecords
NRtClient_setConnectCallback
NRtClient_joinMatchByToken
NStringDoubleMap_getValue
NRtClient_setUserData
NClient_listGroups

ws2_32

ntohl
gethostname
getaddrinfo
freeaddrinfo
WSACleanup
WSAStartup
accept
listen
htonl
ioctlsocket
__WSAFDIsSet
select
htons
bind
WSAIoctl
WSASetLastError
inet_pton
getpeername
getsockname
socket
ntohs
connect
WSAGetLastError
recv
send
closesocket
setsockopt
getsockopt

fmod

?isPlaying@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?setPaused@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?setCallback@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_CHANNELCONTROL@@W4FMOD_CHANNELCONTROL_TYPE@@W4FMOD_CHANNELCONTROL_CALLBACK_TYPE@@PEAX3@Z@Z
?playSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAVSound@2@PEAVChannelGroup@2@_NPEAPEAVChannel@2@@Z
?getUserData@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?getUserData@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getFileUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_J00@Z
?getChannelsPlaying@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH0@Z
?getSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getCPUUsage@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_CPU_USAGE@@@Z
?stop@ChannelControl@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SPEAKERMODE@@0@Z
?setAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?getAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
FMOD_Debug_Initialize
FMOD_Memory_GetStats
?getName@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEADH@Z
?getLength@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?getPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAII@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ

fmodstudio

?getEventList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@HPEAH@Z
?getVCACount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getVCAList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVVCA@23@HPEAH@Z
?getBusCount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getBusList@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVBus@23@HPEAH@Z
?getInstanceCount@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getInstanceList@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@HPEAH@Z
?getPath@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?getPath@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEADHPEAH@Z
?create@System@Studio@FMOD@@SA?AW4FMOD_RESULT@@PEAPEAV123@I@Z
?getCoreSystem@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAV13@@Z
?initialize@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HIIPEAX@Z
?release@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?update@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getNumListeners@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setNumListeners@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getListenerAttributes@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_3D_ATTRIBUTES@@PEAUFMOD_VECTOR@@@Z
?setListenerAttributes@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_3D_ATTRIBUTES@@PEBUFMOD_VECTOR@@@Z
?getListenerWeight@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAM@Z
?setListenerWeight@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@HM@Z
?loadBankFile@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVBank@23@@Z
?getEvent@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVEventDescription@23@@Z
?getEventCount@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getDescription@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventDescription@23@@Z
?unload@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unloadSampleData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?loadSampleData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getParameterDescriptionByName@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameterDescriptionByIndex@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@HPEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameterDescriptionCount@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getParameterDescriptionList@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@HPEAH@Z
?getParameterDescriptionByName@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?getParameterByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEAM1@Z
?setParameterByID@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@M_N@Z
?setParameterByIDWithLabel@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEBD_N@Z
?getParameterDescriptionByID@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?setParameterByName@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDM_N@Z
?setParameterByNameWithLabel@System@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD0_N@Z
?getBank@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVBank@23@@Z
?getBus@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVBus@23@@Z
?getVCA@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAPEAVVCA@23@@Z
?getBankCount@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getBankList@System@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVBank@23@HPEAH@Z
?getUserData@Bank@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@Bank@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?getUserData@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?getVolume@VCA@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?setVolume@VCA@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?lockChannelGroup@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?unlockChannelGroup@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getPaused@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?setPaused@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getMute@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?setMute@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getVolume@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?setVolume@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?stopAllEvents@Bus@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?start@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?stop@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_STUDIO_STOP_MODE@@@Z
?release@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setParameterByID@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@M_N@Z
?setParameterByIDWithLabel@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEBD_N@Z
?getParameterDescriptionByID@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEAUFMOD_STUDIO_PARAMETER_DESCRIPTION@@@Z
?setParameterByName@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDM_N@Z
?setParameterByNameWithLabel@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD0_N@Z
?getParameterByID@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@UFMOD_STUDIO_PARAMETER_ID@@PEAM1@Z
?getParameterByName@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEBDPEAM1@Z
?getPaused@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?setPaused@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?isVirtual@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getVolume@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?setVolume@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getListenerMask@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAI@Z
?setListenerMask@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@I@Z
?getPlaybackState@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAW4FMOD_STUDIO_PLAYBACK_STATE@@@Z
?get3DAttributes@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAUFMOD_3D_ATTRIBUTES@@@Z
?set3DAttributes@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_3D_ATTRIBUTES@@@Z
?getLength@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?getTimelinePosition@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?setTimelinePosition@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getParameterDescriptionCount@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAH@Z
?unloadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?loadSampleData@EventDescription@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getMinMaxDistance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAM0@Z
?is3D@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEA_N@Z
?getUserData@EventInstance@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAX@Z
?setUserData@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@PEAX@Z
?createInstance@EventDescription@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVEventInstance@23@@Z
?getChannelGroup@Bus@Studio@FMOD@@QEBA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@3@@Z
?setCallback@EventInstance@Studio@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW44@IPEAUFMOD_STUDIO_EVENTINSTANCE@@PEAX@ZI@Z
?isValid@EventInstance@Studio@FMOD@@QEBA_NXZ

d3dcompiler_47

D3DCompile
D3DReflect

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

dxcompiler

DxcCreateInstance

shlwapi

PathFileExistsW
PathAppendW

bink2w64

BinkSetOSFileCallbacks
BinkStartAsyncThread
BinkOpen
BinkGetError
BinkSetSoundOnOff
BinkDoFrameAsync
BinkDoFrameAsyncWait
BinkGoto
BinkClose
BinkWaitStopAsyncThread
BinkFreeGlobals
BinkGetFrameBuffersInfo
BinkAllocateFrameBuffers
BinkRegisterFrameBuffers
BinkWait
BinkShouldSkip
BinkNextFrame
BinkRequestStopAsyncThread

pops_api

POPS_AccountCreate
POPS_AccountGetLanguages
POPS_AccountGetCountries
POPS_TelemetrySendMulti
POPS_AutoStandardTelemetryEnable
POPS_AccountGetGuid
POPS_TokenRetrieveCurrent
POPS_InventoryList
POPS_SetFileIO
POPS_SetRootPath
POPS_RunCallbacks
POPS_Shutdown
POPS_AccountLogIn
POPS_AccountLogInWithAuthToken
POPS_AccountLogInSteamTicket
POPS_AccountConnections
POPS_AccountConnectAccountSteam
POPS_AccountDisconnectAccountSteam
POPS_SocialProfileCreate
POPS_SocialProfileUpdate
POPS_SocialProfileRetrieve
POPS_AccountGetDetails
POPS_Initialize
POPS_AccountResetPassword

setupapi

SetupDiGetDeviceInterfaceDetailA
SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
CM_Locate_DevNodeA
SetupDiGetDeviceRegistryPropertyA
CM_Get_Device_IDA
CM_Get_Parent
SetupDiDestroyDeviceInfoList

winmm

waveInClose
waveInPrepareHeader
waveOutWrite
waveOutGetErrorTextW
waveOutGetNumDevs
waveInGetNumDevs
waveOutGetDevCapsW
waveInReset
waveInUnprepareHeader
waveOutUnprepareHeader
timeGetTime
waveInGetDevCapsW
waveOutReset
waveInOpen
waveOutOpen
waveOutPrepareHeader
waveInStart
waveInAddBuffer
timeBeginPeriod
timeEndPeriod
waveOutClose

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

imm32

ImmNotifyIME
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmGetCompositionStringW
ImmGetIMEFileNameA
ImmAssociateContext
ImmSetCompositionStringW
ImmSetCandidateWindow
ImmGetCandidateListW

steam_api64

SteamInternal_FindOrCreateUserInterface
SteamAPI_GetHSteamUser
SteamInternal_ContextInit
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamAPI_RegisterCallback
SteamInternal_FindOrCreateGameServerInterface
SteamGameServer_GetHSteamUser
SteamInternal_GameServer_Init
SteamGameServer_Shutdown
SteamAPI_IsSteamRunning
SteamGameServer_RunCallbacks
SteamAPI_Shutdown
SteamAPI_Init
SteamAPI_RunCallbacks
SteamAPI_RegisterCallResult

kernel32

GetSystemTimeAsFileTime
LCMapStringEx
EncodePointer
GetStringTypeW
AcquireSRWLockShared
ReleaseSRWLockShared
CloseThreadpoolWork
WaitForThreadpoolWorkCallbacks
SubmitThreadpoolWork
CreateThreadpoolWork
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetExitCodeThread
SwitchToThread
UnhandledExceptionFilter
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwind
TlsFree
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
FreeLibraryAndExitThread
MoveFileExW
GetConsoleCP
FindFirstFileExW
SetStdHandle
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetTimeZoneInformation
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
HeapSize
SetConsoleMode
ReadConsoleInputW
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetEndOfFile
GetFileAttributesW
GetDynamicTimeZoneInformation
WriteConsoleW
ReadProcessMemory
GetThreadContext
GetVersionExA
GetFileAttributesA
ResumeThread
GetCurrentDirectoryA
SuspendThread
RtlCaptureContext
GetModuleFileNameA
GetSystemPowerStatus
GlobalUnlock
GlobalLock
GlobalAlloc
CompareStringA
GetModuleHandleExW
TlsGetValue
TlsAlloc
InitializeSListHead
LoadLibraryExW
SetThreadPriority
SetThreadExecutionState
VerifyVersionInfoW
GetOverlappedResult
ResetEvent
LoadLibraryW
CreateFileA
FormatMessageW
CreateEventW
DeviceIoControl
SetEnvironmentVariableA
GetEnvironmentVariableA
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
CreateSemaphoreW
ReleaseSemaphore
MulDiv
OutputDebugStringW
SetFilePointerEx
GetFileSizeEx
ExitProcess
SetCurrentDirectoryW
GetCurrentDirectoryW
DeleteFileW
RemoveDirectoryW
GetFileAttributesExW
FlushFileBuffers
FindNextFileW
GetCurrentThreadId
GetModuleFileNameW
CreateThread
SetEvent
SetErrorMode
FindClose
GetFileSize
SetFilePointer
FindFirstFileW
GetConsoleWindow
SetConsoleScreenBufferSize
GetConsoleScreenBufferInfo
GlobalMemoryStatusEx
GetNativeSystemInfo
GetSystemDefaultUILanguage
GetLocaleInfoA
GetModuleHandleW
CancelIo
GetFinalPathNameByHandleA
ReadDirectoryChangesW
GetSystemInfo
VirtualProtect
VirtualFree
VirtualAlloc
ReleaseSRWLockExclusive
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
InitializeSRWLock
IsDebuggerPresent
AllocConsole
FreeConsole
GetFileType
GetStdHandle
ReadFile
WaitForSingleObject
CreateProcessA
WideCharToMultiByte
GetFullPathNameW
CreateDirectoryW
LocalFree
DecodePointer
RaiseException
CreateDirectoryA
SetFileAttributesA
K32GetProcessMemoryInfo
FatalExit
SetConsoleCtrlHandler
AttachConsole
HeapFree
WriteFile
CreateFileW
GetProcessHeap
HeapAlloc
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentThread
GetThreadId
GetCurrentProcessId
GetCurrentProcess
OutputDebugStringA
WaitForSingleObjectEx
ExpandEnvironmentStringsA
FormatMessageA
GetLastError
SetLastError
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
VerifyVersionInfoA
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
Sleep
SleepEx
CloseHandle
CreateProcessW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryA
RtlLookupFunctionEntry
TlsSetValue
RtlVirtualUnwind

user32

SetProcessDPIAware
MessageBoxA
GetCursorPos
ScreenToClient
GetDC
ReleaseDC
GetDesktopWindow
LoadCursorA
ShowCursor
SetCursor
UnregisterClassA
IsWindowVisible
ShowWindow
DefWindowProcW
RegisterClassExA
CreateWindowExA
GetMessageW
TranslateMessage
DispatchMessageW
LoadCursorFromFileW
DestroyWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
GetClipboardSequenceNumber
SetClipboardData
IsClipboardFormatAvailable
ChangeDisplaySettingsExW
MonitorFromPoint
EnumDisplayMonitors
EnumDisplayDevicesW
EnumDisplaySettingsW
MapVirtualKeyW
GetKeyboardLayout
ToUnicode
SetWindowRgn
GetWindowThreadProcessId
GetWindowTextLengthW
GetFocus
MonitorFromRect
MonitorFromWindow
SetActiveWindow
SendMessageW
RemovePropW
SetWindowTextW
GetKeyboardState
GetMonitorInfoW
RegisterClassW
AttachThreadInput
CreateIconFromResource
UnhookWindowsHookEx
SetLayeredWindowAttributes
IntersectRect
PostMessageW
GetDoubleClickTime
IsIconic
SetPropW
SetWindowsHookExW
FlashWindowEx
SetWindowLongW
GetParent
PtInRect
SetForegroundWindow
InvalidateRect
GetClassInfoExW
KillTimer
GetClientRect
ClipCursor
LoadIconW
GetUpdateRect
IsRectEmpty
GetForegroundWindow
GetClipCursor
TrackMouseEvent
ValidateRect
GetRawInputData
PeekMessageW
ClientToScreen
DestroyIcon
SetTimer
GetAsyncKeyState
RegisterClassExW
UnregisterClassW
GetSystemMetrics
CallNextHookEx
FillRect
GetPropW
SetWindowPos
GetMenu
GetWindowTextW
CopyImage
CreateIconIndirect
LoadCursorW
SetCapture
ReleaseCapture
SetCursorPos
RegisterRawInputDevices
CreateWindowExW
PostThreadMessageW
GetRawInputDeviceInfoA
GetRawInputDeviceList
SetWindowLongPtrW
EndDialog
GetWindowLongPtrW
DialogBoxIndirectParamW
SetFocus
SystemParametersInfoA
GetDlgItem
DrawTextW
SystemParametersInfoW
RegisterWindowMessageA
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetWindowLongW
AdjustWindowRectEx
GetKeyState
GetMessageExtraInfo
CallWindowProcW
GetWindowRect

gdi32

DeleteDC
GetTextMetricsW
GetDeviceCaps
GetTextExtentPoint32A
CreateBitmap
CreateDIBSection
GetDeviceGammaRamp
CreateDCW
SetDeviceGammaRamp
SetPixel
CombineRgn
CreateRectRgn
CreateFontIndirectW
SetPixelFormat
GetPixelFormat
SwapBuffers
ChoosePixelFormat
DescribePixelFormat
CreateSolidBrush
GetPixel
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetDIBits
GetObjectA
DeleteObject
GetICMProfileW

shell32

DragAcceptFiles
ShellExecuteW
ExtractIconExW
DragFinish
DragQueryFileW
ShellExecuteA
SHCreateDirectoryExW
SHGetFolderPathW
CommandLineToArgvW

ole32

PropVariantClear
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoInitializeEx
CLSIDFromString

oleaut32

SysFreeString

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 50.3MB - Virtual size: 50.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12.3MB - Virtual size: 12.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6.1MB - Virtual size: 9.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 822KB - Virtual size: 821KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9a3434d7f83f6ecbd55e7510984d9b9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

03:32:38:6f:94:b0:b6:bf:d2:34:22:b5:6b:8a:0c:29Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

e8:6b:8d:40:2c:5a:61:12:b6:67:06:29:76:f4:36:71:21:45:10:7f:bb:32:4e:31:6e:73:1b:28:94:50:8b:81Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

nvtt

nakama-cpp

ws2_32

fmod

fmodstudio

d3dcompiler_47

dxgi

d3d11

dxcompiler

shlwapi

bink2w64

pops_api

setupapi

winmm

version

imm32

steam_api64

kernel32

user32

gdi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 50.3MB - Virtual size: 50.3MB

.rdata Size: 12.3MB - Virtual size: 12.3MB

.data Size: 6.1MB - Virtual size: 9.4MB

.pdata Size: 2.2MB - Virtual size: 2.2MB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 78KB - Virtual size: 77KB

.reloc Size: 822KB - Virtual size: 821KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

03:32:38:6f:94:b0:b6:bf:d2:34:22:b5:6b:8a:0c:29
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

e8:6b:8d:40:2c:5a:61:12:b6:67:06:29:76:f4:36:71:21:45:10:7f:bb:32:4e:31:6e:73:1b:28:94:50:8b:81
Signer

.text
Size: 50.3MB - Virtual size: 50.3MB

.rdata
Size: 12.3MB - Virtual size: 12.3MB

.data
Size: 6.1MB - Virtual size: 9.4MB

.pdata
Size: 2.2MB - Virtual size: 2.2MB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 78KB - Virtual size: 77KB

.reloc
Size: 822KB - Virtual size: 821KB