2016L[.]exe | Triage

Resubmissions

20-05-2024 18:20

240520-wy58hsbh53 8

20-05-2024 18:12

240520-ws68macd7x 6

Sharing

Copy URL

Twitter E-mail

General

Target

2016L.exe
Size

17.0MB
MD5

3b9b9b3f64c48be0c315394b64f7392a
SHA1

599ee50cb34d3a59e9fbf435bb439319da18f6da
SHA256

cc2142007242aa7219f8e94ee7c1476895394cf29570284085d9bb1aed12c2cc
SHA512

b5dc5bdaf547c09c970d2daaf1e1c17ef306ba62e1922250a0025071163e233c2c28d2a3abeea7ce4063bf89d376d14802a71aa9ab6a577a4b6fd29a90e3f6d8
SSDEEP

196608:18I3GAY+1Ed7AQT5nXI4uFV1cM7rii2RexI2JRszCoJ3mX34NDcbbz9OWM5fWlQR:1j2AY5RvHJ2cD8bzgWMCi

Score

1^/10

Malware Config

Signatures

Files

2016L.exe
.exe windows:5 windows x86 arch:x86

Password: fortnitegod69

35002fec1569a0b45c3f90e2cc3810a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

11-10-2016 00:00

Not After

11-10-2019 23:59

Subject

CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

88:41:f6:0d:02:42:d6:53:65:8f:dd:f7:ca:e4:bd:db:d6:77:ec:d7
Signer

Actual PE Digest

88:41:f6:0d:02:42:d6:53:65:8f:dd:f7:ca:e4:bd:db:d6:77:ec:d7

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\BuildAgent\work\Trunk2012\Client\RCCService\Win32\Release\RCCService.pdb

Imports

advapi32

DeregisterEventSource
RegisterEventSourceA
ReportEventA
RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ChangeServiceConfig2A
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceCtrlDispatcherA
StartServiceA
CryptImportKey
CryptEncrypt
CryptGenRandom
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CryptDestroyKey
CryptVerifySignatureA

ws2_32

__WSAFDIsSet
getpeername
bind
closesocket
connect
ioctlsocket
getaddrinfo
freeaddrinfo
getnameinfo
WSAIoctl
getsockopt
htonl
htons
inet_addr
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
gethostbyname
WSAStartup
WSACleanup
WSASetLastError
WSAGetLastError
accept

kernel32

LoadLibraryW
FindNextFileW
InitializeCriticalSectionAndSpinCount
CreateEventA
OpenEventA
CloseHandle
WaitForSingleObjectEx
GetCurrentProcessId
SetEvent
ResetEvent
GetModuleHandleA
GetLastError
CreateMutexA
GetCurrentThreadId
LockResource
LoadResource
SizeofResource
FindResourceW
FindResourceExW
DeleteFileA
MoveFileA
WideCharToMultiByte
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WriteFile
GetSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
CompareFileTime
CreateFileA
FindFirstFileA
FindNextFileA
MultiByteToWideChar
GetProcessHeap
HeapAlloc
HeapFree
GetProcAddress
VirtualProtect
GetCurrentProcess
WriteProcessMemory
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
InterlockedIncrement
InterlockedDecrement
DebugBreak
WaitForSingleObject
GetStdHandle
GetModuleFileNameA
QueueUserWorkItem
SetConsoleTextAttribute
SetConsoleCtrlHandler
GetComputerNameA
GetGeoInfoA
GetUserGeoID
GetShortPathNameW
GetModuleFileNameW
GetVersionExA
IsWow64Process
FormatMessageA
SearchPathW
FindFirstFileW
DeleteFileW
GetFileAttributesW
CreateFileW
GetFullPathNameW
RemoveDirectoryW
CreateDirectoryW
GetDiskFreeSpaceExW
GetCurrentDirectoryW
GetTempPathW
SetFileTime
GetFileTime
FindClose
DeviceIoControl
OpenEventW
CreateThread
LocalFree
GetSystemTimeAsFileTime
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetVersion
SleepEx
VerifyVersionInfoA
FreeLibrary
VerSetConditionMask
IsDebuggerPresent
IsProcessorFeaturePresent
DecodePointer
EncodePointer
HeapSize
HeapReAlloc
HeapDestroy
SetThreadPriority
GetLocalTime
GetCurrentThread
GetProcessAffinityMask
FreeConsole
GetThreadContext
CreateProcessA
SetUnhandledExceptionFilter
ReleaseMutex
HeapSetInformation
GetProcessHeaps
GlobalMemoryStatusEx
GlobalUnlock
GlobalLock
VirtualQuery
OutputDebugStringA
LoadLibraryA
OpenProcess
SetLastError
MoveFileExW
QueryPerformanceFrequency
QueryPerformanceCounter
RaiseException
DuplicateHandle
SetThreadContext
GetTempPathA
CreateSemaphoreA
SetWaitableTimer
CreateWaitableTimerA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ResumeThread
GetTickCount
Sleep
ReleaseSemaphore
WaitForMultipleObjectsEx
GetSystemInfo
ExpandEnvironmentStringsA

user32

EnumDisplayDevicesA
GetClientRect
MessageBoxA
PostMessageA
GetAsyncKeyState
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
GetWindowTextA
GetDC
EnumWindows
GetClassNameA
GetWindowThreadProcessId
GetWindowInfo
GetClipboardData
OpenClipboard
CloseClipboard

ole32

CoUninitialize
CoInitialize
StringFromGUID2
CoCreateGuid
CoCreateInstance

oleaut32

SysFreeString
SysAllocStringLen

shlwapi

PathAppendA
PathIsRelativeA
PathAddBackslashA
PathStripPathA
PathRemoveFileSpecA
PathFileExistsA

dbghelp

MiniDumpWriteDump

msvcp110

?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?_Locimp_Addfac@_Locimp@locale@std@@CAXPAV123@PAVfacet@23@I@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??_7_Facet_base@std@@6B@
??_7facet@locale@std@@6B@
??_7codecvt_base@std@@6B@
?id@?$codecvt@_WDH@std@@2V0locale@2@A
??_7?$codecvt@_WDH@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
_Mtx_init
_Mtx_destroy
_Mtx_lock
_Mtx_unlock
?_Throw_C_error@std@@YAXH@Z
_Inf
_Nan
_FInf
_FNan
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
??7ios_base@std@@QBE_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z
?fail@ios_base@std@@QBE_NXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??Bios_base@std@@QBEPAXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??0_Locinfo@std@@QAE@PBD@Z
??1_Locinfo@std@@QAE@XZ
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0facet@locale@std@@IAE@I@Z
??1facet@locale@std@@MAE@XZ
?classic@locale@std@@SAABV12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?is@?$ctype@D@std@@QBE_NFD@Z
?widen@?$ctype@D@std@@QBEDD@Z
?narrow@?$ctype@D@std@@QBEDDD@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?exceptions@ios_base@std@@QAEXH@Z
?flags@ios_base@std@@QAEHH@Z
?setf@ios_base@std@@QAEHHH@Z
?precision@ios_base@std@@QAE_J_J@Z
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?id@?$ctype@D@std@@2V0locale@2@A
?toupper@?$ctype@D@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPAD_J@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?setf@ios_base@std@@QAEHH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_N@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PAV32@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
_FDtest
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?eof@ios_base@std@@QBE_NXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??Bid@locale@std@@QAEIXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JXZ
?uncaught_exception@std@@YA_NXZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z

msvcr110

_setjmp3
ceil
ispunct
___mb_cur_max_func
atol
mbtowc
strtod
strtol
strtoul
wctomb
fopen
fprintf
sscanf
_snprintf
sprintf
strchr
strncat
strrchr
strstr
_isnan
_ftime64
strftime
_gmtime64
_localtime64
_mktime64
_setmode
strerror
_beginthreadex
_wassert
?_GetConcurrency@details@Concurrency@@YAIXZ
_stricmp
ferror
fread
fseek
ftell
vsprintf
getenv
?terminate@@YAXXZ
__libm_sse2_log10f
__libm_sse2_powf
calloc
realloc
__libm_sse2_log
_vsnprintf
__libm_sse2_logf
toupper
iswspace
__CxxLongjmpUnwind
exit
__iob_func
abort
__RTtypeid
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
clock
__RTDynamicCast
__libm_sse2_tan
__libm_sse2_tanf
_CIfmod
isupper
isalnum
_wfopen
__libm_sse2_cosf
__libm_sse2_acosf
__libm_sse2_cos
__libm_sse2_sin
__libm_sse2_sinf
qsort
fputs
isalpha
_errno
frexp
ldexp
modf
strcoll
strcspn
strpbrk
feof
freopen
getc
islower
isxdigit
iscntrl
localeconv
_CIcosh
_CIsinh
_CItanh
__libm_sse2_acos
__libm_sse2_asin
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_exp
__libm_sse2_log10
_HUGE
_wcsnicmp
__libm_sse2_atanf
_mbscmp
_mbslwr_s
_mbsnbcpy_s
_mbsstr
?before@type_info@@QBE_NABV1@@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??1bad_typeid@std@@UAE@XZ
strtok
atof
__libm_sse2_asinf
_difftime64
_aligned_free
_aligned_malloc
__libm_sse2_expf
_exit
_strnicmp
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__initenv
_fmode
_commode
_vsnprintf_s
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_CIatan2
_libm_sse2_sin_precise
_libm_sse2_cos_precise
_libm_sse2_sqrt_precise
isgraph
isprint
_stat64
wprintf
_getpid
_fstat64
_lseeki64
_strtoi64
fgets
__sys_nerr
_strdup
_write
_read
longjmp
tolower
isspace
isdigit
srand
rand
_kbhit
_getch
sprintf_s
_mbsnicmp
_mbsicmp
strncpy_s
atoi
strncmp
_except_handler3
_vscprintf
vsprintf_s
strncpy
malloc
_set_purecall_handler
_mkdir
memmove_s
strnlen
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
_unlock_file
_lock_file
ungetc
setvbuf
printf
fwrite
_fseeki64
fsetpos
fputc
fgetpos
fgetc
fflush
fclose
memcpy_s
_time64
??0exception@std@@QAE@XZ
memchr
memset
memcpy
__libm_sse2_pow
__CxxFrameHandler3
_CxxThrowException
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABQBD@Z
memmove
??_V@YAXPAX@Z
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_vswprintf_c_l
_close
_purecall
_open

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

wsock32

getsockname
gethostname
inet_addr

winmm

timeSetEvent
timeEndPeriod
timeBeginPeriod
timeGetTime
timeGetDevCaps

psapi

GetModuleInformation
GetProcessMemoryInfo
GetModuleBaseNameA

vmprotectsdk32

VMProtectIsDebuggerPresent
VMProtectBeginVirtualization
VMProtectBeginMutation
VMProtectEnd

wininet

InternetSetStatusCallback
InternetOpenA
InternetCloseHandle
HttpQueryInfoA
HttpEndRequestA
HttpSendRequestExA
HttpSendRequestA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
InternetSetOptionA
InternetQueryOptionA
InternetQueryDataAvailable
InternetWriteFile
InternetReadFile

winhttp

WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpQueryDataAvailable
WinHttpReadData

wldap32

ord200
ord301
ord22
ord26
ord27
ord32
ord143
ord46
ord33
ord35
ord79
ord30
ord211
ord60
ord50
ord41

normaliz

IdnToAscii

fmop

?addInput@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAPAVDSPConnection@2@W4FMOD_DSPCONNECTION_TYPE@@@Z
?setParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HM@Z
?setBypass@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?disconnectFrom@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@PAVDSPConnection@2@@Z
?setParameterData@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAXI@Z
?setMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@_N0@Z
?getMeteringEnabled@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PA_N0@Z
?getMeteringInfo@DSP@FMOD@@QAG?AW4FMOD_RESULT@@PAUFMOD_DSP_METERING_INFO@@0@Z
?getRecordNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH0@Z
?getRecordDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2PAI@Z
?getRecordPosition@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAI@Z
?recordStart@System@FMOD@@QAG?AW4FMOD_RESULT@@HPAVSound@2@_N@Z
?isRecording@System@FMOD@@QAG?AW4FMOD_RESULT@@HPA_N@Z
?set3DAttributes@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PBUFMOD_VECTOR@@00@Z
?release@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?removeDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAVDSP@2@@Z
?getDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAPAVDSP@2@@Z
?getMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?setMode@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@I@Z
?getPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setPaused@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?stop@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?getOpenState@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAW4FMOD_OPENSTATE@@PAIPA_N2@Z
?getLength@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?getDefaults@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAMPAH@Z
?release@Sound@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?lock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@IIPAPAX0PAI1@Z
?unlock@Sound@FMOD@@QAG?AW4FMOD_RESULT@@PAX0II@Z
?setUserData@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAX@Z
?setFrequency@Channel@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?set3DMinMaxDistance@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@MM@Z
?setPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@II@Z
?getPosition@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAII@Z
?setChannelGroup@Channel@FMOD@@QAG?AW4FMOD_RESULT@@PAVChannelGroup@2@@Z
?getNumDSPs@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setLoopCount@Channel@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getParameterFloat@DSP@FMOD@@QAG?AW4FMOD_RESULT@@HPAMPADH@Z
FMOD_Memory_GetStats
FMOD_System_Create
?playSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PAVSound@2@PAVChannelGroup@2@_NPAPAVChannel@2@@Z
?createStream@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
?createSound@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDIPAUFMOD_CREATESOUNDEXINFO@@PAPAVSound@2@@Z
FMOD_Sound_GetUserData
?release@DSP@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?addGroup@ChannelGroup@FMOD@@QAG?AW4FMOD_RESULT@@PAV12@_NPAPAVDSPConnection@2@@Z
?addDSP@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@HPAVDSP@2@@Z
?getMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PA_N@Z
?setMute@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@_N@Z
?getVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAM@Z
?setVolume@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@M@Z
?getSystemObject@ChannelControl@FMOD@@QAG?AW4FMOD_RESULT@@PAPAVSystem@2@@Z
?setReverbProperties@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_REVERB_PROPERTIES@@@Z
?createChannelGroup@System@FMOD@@QAG?AW4FMOD_RESULT@@PBDPAPAVChannelGroup@2@@Z
?createDSPByType@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_DSP_TYPE@@PAPAVDSP@2@@Z
?getCPUUsage@System@FMOD@@QAG?AW4FMOD_RESULT@@PAM0000@Z
?getChannelsPlaying@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?getVersion@System@FMOD@@QAG?AW4FMOD_RESULT@@PAI@Z
?set3DListenerAttributes@System@FMOD@@QAG?AW4FMOD_RESULT@@HPBUFMOD_VECTOR@@000@Z
?set3DSettings@System@FMOD@@QAG?AW4FMOD_RESULT@@MMM@Z
?update@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ
?init@System@FMOD@@QAG?AW4FMOD_RESULT@@HIPAX@Z
?setSoftwareFormat@System@FMOD@@QAG?AW4FMOD_RESULT@@HW4FMOD_SPEAKERMODE@@H@Z
?getDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
?getDriverInfo@System@FMOD@@QAG?AW4FMOD_RESULT@@HPADHPAUFMOD_GUID@@PAHPAW4FMOD_SPEAKERMODE@@2@Z
?getNumDrivers@System@FMOD@@QAG?AW4FMOD_RESULT@@PAH@Z
?setOutput@System@FMOD@@QAG?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
?release@System@FMOD@@QAG?AW4FMOD_RESULT@@XZ

shell32

SHGetFolderPathAndSubDirW

gdi32

SwapBuffers
SetPixelFormat
ChoosePixelFormat

opengl32

wglGetCurrentContext
wglDeleteContext
wglCreateContext
glReadPixels
glTexSubImage2D
glTexParameteri
glTexParameterf
glTexImage2D
glPixelStorei
glGetTexImage
glGenTextures
glDeleteTextures
glDrawElements
glDrawArrays
glViewport
glStencilOp
glStencilMask
wglMakeCurrent
glReadBuffer
glPolygonOffset
glEnable
glDisable
glDepthMask
glDepthFunc
glCullFace
glCopyTexSubImage2D
glColorMask
glClearStencil
glClearDepth
glClearColor
glClear
glBlendFunc
glBindTexture
glGetString
glGetIntegerv
wglGetCurrentDC
wglGetProcAddress
glStencilFunc

Exports

Exports

?FastLog@FLog@@YAXEPBDPBX1111@Z
?FastLog@FLog@@YAXEPBDPBX11@Z
?FastLog@FLog@@YAXEPBDPBX@Z
?FastLogF@FLog@@YAXEPBDMMMM@Z
?FastLogFormatted@FLog@@YAXEPBDZZ
?FastLogS@FLog@@YAXEPBD0@Z
?FastLogS@FLog@@YAXEPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ForEachVariable@FLog@@YAXP6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAX@Z1W4FastVarType@@@Z
?GetFastLogCounter@FLog@@YAHE@Z
?GetNumSynchronizedVariable@FLog@@YAGXZ
?GetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@_N@Z
?Init@FLog@@YAXP6ANXZ@Z
?NowFast@FLog@@YANXZ
?RegisterFlag@FLog@@YAHPBDPA_NPAPA_NW4FastVarType@@@Z
?RegisterInt@FLog@@YAHPBDPAHPAPA_NW4FastVarType@@@Z
?RegisterLogGroup@FLog@@YAHPBDPAEPAPA_NW4FastVarType@@@Z
?RegisterString@FLog@@YAHPBDPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAPA_NW4FastVarType@@@Z
?ResetSynchronizedVariablesState@FLog@@YAXXZ
?SetExternalLogFunc@FLog@@YAXP6AXEPBD@Z@Z
?SetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4FastVarType@@_N@Z
?SetValueFromServer@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?WriteFastLogDump@FLog@@YAXPBDH@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 11.4MB - Virtual size: 11.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lua
Size: 151KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: fortnitegod69

35002fec1569a0b45c3f90e2cc3810a2

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cbCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6Certificate

Extended Key Usages

Key Usages

88:41:f6:0d:02:42:d6:53:65:8f:dd:f7:ca:e4:bd:db:d6:77:ec:d7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

kernel32

user32

ole32

oleaut32

shlwapi

dbghelp

msvcp110

msvcr110

version

wsock32

winmm

psapi

vmprotectsdk32

wininet

winhttp

wldap32

normaliz

fmop

shell32

gdi32

opengl32

Exports

Exports

Sections

.text Size: 11.4MB - Virtual size: 11.4MB

.rdata Size: 2.8MB - Virtual size: 2.8MB

.data Size: 1.2MB - Virtual size: 6.2MB

.lua Size: 151KB - Virtual size: 151KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 1.5MB - Virtual size: 1.5MB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

69:4e:21:5b:8d:f6:f1:77:f5:00:12:fe:bd:09:bd:a6
Certificate

88:41:f6:0d:02:42:d6:53:65:8f:dd:f7:ca:e4:bd:db:d6:77:ec:d7
Signer

.text
Size: 11.4MB - Virtual size: 11.4MB

.rdata
Size: 2.8MB - Virtual size: 2.8MB

.data
Size: 1.2MB - Virtual size: 6.2MB

.lua
Size: 151KB - Virtual size: 151KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 1.5MB - Virtual size: 1.5MB