2024-05-21_f4141c8b8aba8fc2d9d02ca41b1e11ce_ryuk

Sharing

Copy URL Twitter E-mail

General

Target

2024-05-21_f4141c8b8aba8fc2d9d02ca41b1e11ce_ryuk
Size

64.9MB
MD5

f4141c8b8aba8fc2d9d02ca41b1e11ce
SHA1

b6404174cae9c4dabf4a22372e484118d4111a1a
SHA256

10f08e8082016659951d42a7820c9021f65bc23dc91c2b2859279c3c0628e6b4
SHA512

0e0104b07b9c70021415aebd0b4a9cd7c9bfd6c52dc66312ad1e99016ee20a9cfaecd2fd452c2b8c9ca9332cc5fbc6b7cf820953174372df3879d12eb8153e22
SSDEEP

393216:XUAp/NkPCXUVHLCvdxyom4cE1Gpg0/95NgeJFZ3bGPkX/PFJBdxSNy0uMGyfH7nV:XPbKntX6XcRGNLA63n0T3S

Score

1^/10

Malware Config

Signatures

Files

2024-05-21_f4141c8b8aba8fc2d9d02ca41b1e11ce_ryuk
.exe windows:6 windows x64 arch:x64

88aa0caf941cb2c726be6010d8d3eed1

Code Sign

0e:03:32:99:51:38:b2:ba:de:c3:22:23:05:b5:e2:12
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

02/01/2020, 00:00

Not After

06/01/2022, 12:00

Subject

SERIALNUMBER=2256184,CN=Activision Publishing Inc,OU=Activision Publishing Inc,O=Activision Publishing Inc,L=SANTA MONICA,ST=CALIFORNIA,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bd:7e:4e:66:fe:04:bb:66:09:e8:42:31:f4:a7:04:b0:12:7e:5c:f1:3a:17:db:f2:7f:72:8a:7e:45:67:d0:29
Signer

Actual PE Digest

bd:7e:4e:66:fe:04:bb:66:09:e8:42:31:f4:a7:04:b0:12:7e:5c:f1:3a:17:db:f2:7f:72:8a:7e:45:67:d0:29

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

W:\NTC\RootBranch\Source\FDP\dist_win64\Master_Steam_WW_LTO\NTC_win64_Master_Steam_WW_LTO.pdb

Imports

steam_api64

SteamNetworking
SteamAPI_RegisterCallResult
SteamMatchmaking
SteamAPI_UnregisterCallResult
SteamAPI_RunCallbacks
SteamAPI_Init
SteamClient
SteamAPI_RestartAppIfNecessary
SteamAPI_Shutdown
SteamUserStats
SteamUser
SteamUtils
SteamAPI_UnregisterCallback
SteamAPI_RegisterCallback
SteamApps
SteamFriends

dxgi

CreateDXGIFactory

ws2_32

gethostname
WSASocketW
getaddrinfo
freeaddrinfo
inet_pton
inet_ntop
gethostbyname
bind
recvfrom
ntohs
WSAEnumNetworkEvents
inet_ntoa
getservbyport
gethostbyaddr
getsockname
connect
WSAGetLastError
accept
__WSAFDIsSet
getsockopt
WSACleanup
getnameinfo
WSASetLastError
inet_addr
WSACloseEvent
WSACreateEvent
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
WSAEventSelect
getpeername
WSAStartup
socket
shutdown
setsockopt
send
select
recv
ntohl
listen
htons
htonl
ioctlsocket
getservbyname
closesocket
sendto

amd_ags_x64

agsSetDisplayMode
agsDeInit
agsInit

fmodex64

?setLevels@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PEAMH@Z
?getNumGroups@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_convertMultiChannelLevelToSpeakerLevel@System@FMOD@@QEAA?AW4FMOD_RESULT@@QEAY07MQEAY07$$CBMH@Z
?setSpeakerLevels@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKER@@PEAMH@Z
?createDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_DSP_DESCRIPTION@@PEAPEAVDSP@2@@Z
?setMix@DSPConnection@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?playDSP@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_CHANNELINDEX@@PEAVDSP@2@_NPEAPEAVChannel@2@@Z
?setVolume@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?setFrequency@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?release@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?addGroup@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@@Z
?setVolume@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?release@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getOpenState@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_OPENSTATE@@PEAIPEA_N2@Z
?getSubSound@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@@Z
?FS_GetEmulatedChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_GetSoftwareChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?FS_GetHardwareChannelsUsed@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getMasterChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?createChannelGroup@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVChannelGroup@2@@Z
?getHardwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getOutputHandle@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?setStreamBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?setCallback@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_SYSTEM@@W4FMOD_SYSTEM_CALLBACKTYPE@@PEAX2@Z@Z
?getSpeakerMode@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAW4FMOD_SPEAKERMODE@@@Z
?setSpeakerMode@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_SPEAKERMODE@@@Z
?setAdvancedSettings@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAUFMOD_ADVANCEDSETTINGS@@@Z
?setFileSystem@System@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEBDHPEAIPEAPEAX2@ZP6A?AW43@PEAX4@ZP6A?AW43@44I14@ZP6A?AW43@4I4@ZP6A?AW43@PEAUFMOD_ASYNCREADINFO@@4@Z5H@Z
?setDSPBufferSize@System@FMOD@@QEAA?AW4FMOD_RESULT@@IH@Z
?getSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAW4FMOD_SOUND_FORMAT@@00PEAW4FMOD_DSP_RESAMPLER@@0@Z
?setSoftwareFormat@System@FMOD@@QEAA?AW4FMOD_RESULT@@HW4FMOD_SOUND_FORMAT@@HHW4FMOD_DSP_RESAMPLER@@@Z
?getSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setSoftwareChannels@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getDriverCaps@System@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAIPEAHPEAW4FMOD_SPEAKERMODE@@@Z
?getNumDrivers@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?setOutput@System@FMOD@@QEAA?AW4FMOD_RESULT@@W4FMOD_OUTPUTTYPE@@@Z
FMOD_Debug_SetLevel
FMOD_Memory_Initialize
?getUserData@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAX@Z
?getOutput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAV12@PEAPEAVDSPConnection@2@@Z
?getNumInputs@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?disconnectAll@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@_N0@Z
?disconnectFrom@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@@Z
?addInput@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEAV12@PEAPEAVDSPConnection@2@@Z
?getDSPHead@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVDSP@2@@Z
?release@Sound@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?createStream@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?createSound@System@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAUFMOD_CREATESOUNDEXINFO@@PEAPEAVSound@2@@Z
?setDriver@System@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getInfo@DSP@FMOD@@QEAA?AW4FMOD_RESULT@@PEADPEAIPEAH22@Z
?getChannel@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVChannel@2@@Z
?setPosition@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@II@Z
?getCurrentSound@Channel@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSound@2@@Z
?getNumChannels@ChannelGroup@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z

fmod_event64

?getInfo@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAPEAD@Z
?set3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEBUFMOD_VECTOR@@000@Z
?set3DNumListeners@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@H@Z
?getValue@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@PEAM@Z
?getGroup@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD_NPEAPEAVEventGroup@2@@Z
?preloadFSB@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDHPEAVSound@2@_N@Z
?unloadFSB@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDH@Z
?setValue@EventParameter@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?set3DAttributes@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_VECTOR@@00@Z
?setMute@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?getPaused@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEA_N@Z
?getProperty@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAX_N@Z
?setReverbProperties@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBUFMOD_REVERB_PROPERTIES@@@Z
?getEvent@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDIPEAPEAVEvent@2@@Z
?getCategoryByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventCategory@2@@Z
?getCategory@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventCategory@2@@Z
?getNumProjects@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getProjectByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventProject@2@@Z
?getProject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventProject@2@@Z
?getEventBySystemID@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@IIPEAPEAVEvent@2@@Z
?getParameterByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAPEAVEventParameter@2@@Z
?setPaused@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z
?setPitch@Event@FMOD@@QEAA?AW4FMOD_RESULT@@MW4FMOD_EVENT_PITCHUNITS@@@Z
?setVolume@Event@FMOD@@QEAA?AW4FMOD_RESULT@@M@Z
?getReverbPreset@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_REVERB_PROPERTIES@@PEAH@Z
?getNumParameters@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAH@Z
?getCategory@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventCategory@2@@Z
?setPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?getParameter@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAPEAVEventParameter@2@@Z
?setCallback@Event@FMOD@@QEAA?AW4FMOD_RESULT@@P6A?AW43@PEAUFMOD_EVENT@@W4FMOD_EVENT_CALLBACKTYPE@@PEAX22@Z2@Z
FMOD_EventSystem_Create
?get3DListenerAttributes@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_VECTOR@@000@Z
?start@Event@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setLanguage@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?getSystemObject@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVSystem@2@@Z
?init@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HIPEAXI@Z
?release@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?update@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?setMediaPath@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBD@Z
?getChannelGroup@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVChannelGroup@2@@Z
?getState@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAI@Z
?getPropertyByIndex@Event@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAX_N@Z
?getInfo@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAHPEAPEADPEAUFMOD_EVENT_INFO@@@Z
?load@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@PEBDPEAUFMOD_EVENT_LOADINFO@@PEAPEAVEventProject@2@@Z
?getParentGroup@Event@FMOD@@QEAA?AW4FMOD_RESULT@@PEAPEAVEventGroup@2@@Z
?unload@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@XZ
?getReverbPresetByIndex@EventSystem@FMOD@@QEAA?AW4FMOD_RESULT@@HPEAUFMOD_REVERB_PROPERTIES@@PEAPEAD@Z
?stop@Event@FMOD@@QEAA?AW4FMOD_RESULT@@_N@Z

oo2core_6_win64

OodleLZ_Decompress
OodleLZ_Compress
OodleLZ_CompressOptions_GetDefault
OodleLZ_GetCompressedBufferSizeNeeded
OodleLZ_GetCompressedStepForRawStep
OodleLZDecoder_MemorySizeNeeded

wldap32

ord27
ord26
ord22
ord41
ord50
ord60
ord32
ord46
ord143
ord200
ord301
ord79
ord33
ord35
ord211
ord30

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertOpenStore
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore

advapi32

CryptHashData
CryptGetHashParam
CryptAcquireContextA
CryptGenRandom
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetUserNameW
GetUserNameA
SystemFunction036

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

bink2w64

BinkNextFrame
BinkWait
BinkClose
BinkOpen
BinkGoto
BinkShouldSkip
BinkControlBackgroundIO
BinkStartAsyncThread
BinkDoFrameAsyncMulti
BinkPause
BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkGetRealtime
BinkSetSoundTrack
BinkSetIOSize
BinkSetMemory
BinkSetVolume
BinkSetSpeakerVolumes
BinkSetSoundSystem
BinkOpenDirectSound
BinkOpenXAudio2
BinkGetFrameBuffersInfo
BinkRegisterFrameBuffers
BinkAllocateFrameBuffers
BinkDoFrameAsyncWait

kernel32

GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SwitchToThread
SignalObjectAndWait
CreateTimerQueue
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
RegisterWaitForSingleObject
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
DuplicateHandle
GetStringTypeW
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
GetVersionExW
InterlockedPopEntrySList
TerminateProcess
UnregisterWait
GetTimeFormatW
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlPcToFileHeader
RtlUnwindEx
ExitProcess
GetACP
VirtualProtect
GetSystemDirectoryA
CreateSemaphoreA
CreateEventA
CreateMutexA
GetTimeZoneInformation
ExpandEnvironmentStringsA
WaitForMultipleObjects
PeekNamedPipe
FormatMessageA
SetUnhandledExceptionFilter
IsValidLocale
GlobalLock
GlobalAlloc
SetConsoleMode
ReadConsoleW
ReadConsoleA
GetConsoleMode
GetEnvironmentVariableW
GlobalMemoryStatus
GetTickCount
RtlVirtualUnwind
ExitThread
ConvertFiberToThread
WideCharToMultiByte
DeleteFiber
MultiByteToWideChar
GetFileType
GetStdHandle
GetModuleHandleExW
GetDiskFreeSpaceExW
CreateProcessA
LoadLibraryExW
GetSystemDirectoryW
LocalAlloc
GetDiskFreeSpaceW
CreateFileA
MoveFileW
FormatMessageW
GetOverlappedResult
SetErrorMode
SetEndOfFile
ReadFile
GetFileInformationByHandle
GetModuleFileNameW
GetDriveTypeW
OutputDebugStringW
GetUserDefaultLangID
GetTempPathW
GetTempFileNameW
ResumeThread
SuspendThread
TerminateThread
RaiseException
CreateEventW
ResetEvent
SetEvent
OpenThread
GetModuleHandleW
SetLastError
SetProcessAffinityMask
GetProcessAffinityMask
SystemTimeToFileTime
FileTimeToSystemTime
GetLocalTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
ReleaseMutex
GetSystemDefaultLCID
GetSystemDefaultLangID
WriteFile
SetFilePointer
FlushFileBuffers
VerifyVersionInfoW
SetHandleInformation
VerSetConditionMask
ReadDirectoryChangesW
CopyFileW
GetSystemTimeAsFileTime
QueueUserAPC
WaitForSingleObjectEx
SleepEx
CancelIo
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
SetConsoleCtrlHandler
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
HeapReAlloc
GetConsoleCP
HeapSize
HeapQueryInformation
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
GetFileAttributesExW
CreatePipe
MoveFileExW
IsValidCodePage
GetOEMCP
SetStdHandle
FindFirstFileExW
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
WriteConsoleW
PulseEvent
GetDateFormatW
GlobalUnlock
InitializeCriticalSection
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetExitCodeThread
CreateThread
LoadLibraryW
GetModuleFileNameA
GetCurrentProcess
VirtualQuery
VirtualFree
CreateSemaphoreW
WaitForSingleObject
ReleaseSemaphore
SetThreadIdealProcessor
SetThreadAffinityMask
FreeLibrary
TlsFree
TlsSetValue
TlsAlloc
LoadLibraryA
GetProcAddress
GetSystemInfo
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
TlsGetValue
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
Sleep
VirtualAlloc
GetCurrentDirectoryW
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
GetSystemDefaultLocaleName
CloseHandle
GetLastError
GetCommandLineW
CreateMutexW
GetCurrentThread
SetThreadPriority
LocalFree

user32

LoadCursorW
SetCursor
GetWindowRect
GetClientRect
SetWindowTextW
SetForegroundWindow
UpdateWindow
KillTimer
SetTimer
SendInput
IsZoomed
ShowWindow
CreateWindowExW
RegisterClassExW
DefWindowProcW
PostMessageW
SendMessageW
GetMessageExtraInfo
SetWindowLongW
GetWindowLongW
AdjustWindowRect
SetActiveWindow
GetSystemMetrics
SetFocus
LoadIconW
GetDC
GetKeyboardState
GetKeyState
GetKeyboardLayout
ScreenToClient
FindWindowW
GetActiveWindow
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CloseClipboard
OpenClipboard
EmptyClipboard
SetClipboardData
GetForegroundWindow
PostQuitMessage
GetClipboardData
GetAsyncKeyState
ShowCursor
GetCursorPos
SetCursorPos
ClipCursor
SetWindowPos
GetDesktopWindow
ClientToScreen

gdi32

GetGlyphOutlineW
CreateFontW
GetTextMetricsW
GetKerningPairsW
SelectObject
EnumFontFamiliesExW
DeleteObject
CreateBitmap

shell32

SHGetFolderPathW
CommandLineToArgvW

ole32

CoCreateInstance
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateGuid
CoInitialize

oleaut32

SysAllocString
SysFreeString

imm32

ImmDisableIME

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToFileW

d3d9

D3DPERF_GetStatus

xinput1_3

ord3
ord2

dinput8

DirectInput8Create

d3dcompiler_43

D3DGetBlobPart

Exports

Exports

??0BufferedFile@Scaleform@@IEAA@XZ
??0BufferedFile@Scaleform@@QEAA@PEAVFile@1@@Z
??0Event@Scaleform@@QEAA@_N0@Z
??0Mutex@Scaleform@@QEAA@_N0@Z
??0Semaphore@Scaleform@@QEAA@H_N@Z
??0SysAllocPagedMalloc@Scaleform@@QEAA@_K@Z
??0SysAllocStatic@Scaleform@@QEAA@PEAX_K010101@Z
??0SysAllocStatic@Scaleform@@QEAA@_K@Z
??0SysAllocWinAPI@Scaleform@@QEAA@_K0@Z
??0SysFile@Scaleform@@QEAA@AEBVString@1@HH@Z
??0SysFile@Scaleform@@QEAA@XZ
??0System@Scaleform@@QEAA@AEBUHeapDesc@MemoryHeap@1@PEAVSysAllocBase@1@@Z
??0System@Scaleform@@QEAA@PEAVSysAllocBase@1@@Z
??0Thread@Scaleform@@QEAA@AEBUCreateParams@01@@Z
??0Thread@Scaleform@@QEAA@P6AHPEAV01@PEAX@Z1_KHW4ThreadState@01@@Z
??0Thread@Scaleform@@QEAA@_KH@Z
??0WaitCondition@Scaleform@@QEAA@XZ
??1AcquireInterface@Scaleform@@UEAA@XZ
??1BufferedFile@Scaleform@@UEAA@XZ
??1DefaultAcquireInterface@Scaleform@@UEAA@XZ
??1Event@Scaleform@@UEAA@XZ
??1Loader@GFx@Scaleform@@UEAA@XZ
??1Mutex@Scaleform@@UEAA@XZ
??1RefCountImplCore@Scaleform@@UEAA@XZ
??1RefCountNTSImplCore@Scaleform@@UEAA@XZ
??1RefCountWeakSupportImpl@Scaleform@@UEAA@XZ
??1Semaphore@Scaleform@@UEAA@XZ
??1System@Scaleform@@QEAA@XZ
??1Thread@Scaleform@@UEAA@XZ
??1WaitCondition@Scaleform@@QEAA@XZ
??ESemaphore@Scaleform@@QEAAHH@Z
??FSemaphore@Scaleform@@QEAAHH@Z
??YSemaphore@Scaleform@@QEAAHH@Z
??ZSemaphore@Scaleform@@QEAAHH@Z
??_FEvent@Scaleform@@QEAAXXZ
??_FMutex@Scaleform@@QEAAXXZ
??_FSemaphore@Scaleform@@QEAAXXZ
??_FSysAllocPagedMalloc@Scaleform@@QEAAXXZ
??_FSysAllocStatic@Scaleform@@QEAAXXZ
??_FSysAllocWinAPI@Scaleform@@QEAAXXZ
??_FSystem@Scaleform@@QEAAXXZ
??_FThread@Scaleform@@QEAAXXZ
?Acquire@Waitable@Scaleform@@QEAA_NI@Z
?AcquireMultipleObjects@AcquireInterface@Scaleform@@SA_NPEAPEAVWaitable@2@II@Z
?AcquireOneOfMultipleObjects@AcquireInterface@Scaleform@@SAHPEAPEAVWaitable@2@II@Z
?AddMemSegment@SysAllocStatic@Scaleform@@QEAAXPEAX_K@Z
?AddRef@RefCountImpl@Scaleform@@QEAAXXZ
?AddWaitHandler@Waitable@Scaleform@@QEAA_NP6AXPEAX@Z0@Z
?Append@?$Matrix2x4@M@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Append@?$Matrix2x4@N@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Append_NonOpt@?$Matrix2x4@N@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?Blend@Color@Render@Scaleform@@SA?AV123@V123@0M@Z
?BytesAvailable@BufferedFile@Scaleform@@UEAAHXZ
?CallWaitHandlers@HandlerArray@Waitable@Scaleform@@QEAAXXZ
?CallWaitHandlers@Waitable@Scaleform@@QEAAXXZ
?CanAcquire@AcquireInterface@Scaleform@@UEAA_NXZ
?CanAcquire@Event@Scaleform@@UEAA_NXZ
?CanAcquire@Mutex@Scaleform@@UEAA_NXZ
?CanAcquire@Semaphore@Scaleform@@UEAA_NXZ
?ChangeSize@BufferedFile@Scaleform@@UEAA_NH@Z
?Close@BufferedFile@Scaleform@@UEAA_NXZ
?Close@SysFile@Scaleform@@UEAA_NXZ
?ConvertHSIToRGB@Color@Render@Scaleform@@SAXNNNPEAN00@Z
?ConvertRGBToHSI@Color@Render@Scaleform@@SAXNNNPEAN00@Z
?CopyFromStream@BufferedFile@Scaleform@@UEAAHPEAVFile@2@H@Z
?CreateWaitableIncrement@Semaphore@Scaleform@@QEAAPEAVWaitable@2@H@Z
?Destroy@System@GFx@Scaleform@@SAXXZ
?Destroy@System@Scaleform@@SAXXZ
?DoLock@Mutex@Scaleform@@QEAAXXZ
?EncloseTransform@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?EncloseTransform@?$Matrix3x4@M@Render@Scaleform@@QEBA?AV?$Rect@M@23@AEBV423@@Z
?EncloseTransform@?$Matrix3x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?EncloseTransformHomogeneous@?$Matrix4x4@M@Render@Scaleform@@QEBAXPEAV?$Rect@M@23@AEBV423@@Z
?Exit@Thread@Scaleform@@UEAAXH@Z
?FinishAllThreads@Thread@Scaleform@@SAXXZ
?Flush@BufferedFile@Scaleform@@UEAA_NXZ
?FlushBuffer@BufferedFile@Scaleform@@IEAAXXZ
?GetAcquireInterface@Event@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Mutex@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Semaphore@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetAcquireInterface@Waitable@Scaleform@@UEAAPEAVAcquireInterface@2@XZ
?GetBitSet@SysAllocWinAPI@Scaleform@@QEBAPEBK_K@Z
?GetCPUCount@Thread@Scaleform@@SAHXZ
?GetDefaultAcquireInterface@DefaultAcquireInterface@Scaleform@@SAPEAV12@XZ
?GetDeterminant@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetErrorCode@SysFile@Scaleform@@UEAAHXZ
?GetExitFlag@Thread@Scaleform@@QEBA_NXZ
?GetFileStat@SysFile@Scaleform@@SA_NPEAUFileStat@2@AEBVString@2@@Z
?GetHSI@Color@Render@Scaleform@@QEBAXPEAH00@Z
?GetHSI@Color@Render@Scaleform@@QEBAXPEAM00@Z
?GetHSV@Color@Render@Scaleform@@QEBAXPEAH00@Z
?GetHSV@Color@Render@Scaleform@@QEBAXPEAM00@Z
?GetLength@BufferedFile@Scaleform@@UEAAHXZ
?GetMaxScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetRotation@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetRotationDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?GetScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetThreadState@Thread@Scaleform@@QEBA?AW4ThreadState@12@XZ
?GetXScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetXScaleDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?GetYScale@?$Matrix2x4@M@Render@Scaleform@@QEBAMXZ
?GetYScaleDouble@?$Matrix2x4@M@Render@Scaleform@@QEBANXZ
?HasMemoryLeaks@System@Scaleform@@2_NA
?Init@System@GFx@Scaleform@@SAXAEBUHeapDesc@MemoryHeap@3@PEAVSysAllocBase@3@@Z
?Init@System@GFx@Scaleform@@SAXPEAVSysAllocBase@3@@Z
?Init@System@Scaleform@@SAXAEBUHeapDesc@MemoryHeap@2@PEAVSysAllocBase@2@@Z
?Init@System@Scaleform@@SAXPEAVSysAllocBase@2@@Z
?IsFinished@Thread@Scaleform@@QEBA_NXZ
?IsLockedByAnotherThread@Mutex@Scaleform@@QEAA_NXZ
?IsSignaled@Event@Scaleform@@UEBA_NXZ
?IsSignaled@Mutex@Scaleform@@UEBA_NXZ
?IsSignaled@Semaphore@Scaleform@@UEBA_NXZ
?IsSignaled@Waitable@Scaleform@@UEBA_NXZ
?IsSuspended@Thread@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix2x4@M@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix3x4@M@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix3x4@N@Render@Scaleform@@QEBA_NXZ
?IsValid@?$Matrix4x4@N@Render@Scaleform@@QEBA_NXZ
?IsValid@SysFile@Scaleform@@UEBA_NXZ
?LGetLength@BufferedFile@Scaleform@@UEAA_JXZ
?LSeek@BufferedFile@Scaleform@@UEAA_J_JH@Z
?LTell@BufferedFile@Scaleform@@UEAA_JXZ
?LoadBuffer@BufferedFile@Scaleform@@IEAAXXZ
?MSleep@Thread@Scaleform@@SA_NI@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix2x4@M@23@@Z
?MultiplyMatrix@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix2x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix3x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix2x4@M@23@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV123@AEBV?$Matrix3x4@M@23@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix2x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix4x4@M@Render@Scaleform@@QEAAXAEBV?$Matrix3x4@M@23@AEBV123@@Z
?MultiplyMatrix@?$Matrix4x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix_NonOpt@?$Matrix3x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?MultiplyMatrix_NonOpt@?$Matrix4x4@N@Render@Scaleform@@QEAAXAEBV123@0@Z
?Notify@WaitCondition@Scaleform@@QEAAXXZ
?NotifyAll@WaitCondition@Scaleform@@QEAAXXZ
?ObtainSemaphore@Semaphore@Scaleform@@QEAA_NHI@Z
?OnExit@Thread@Scaleform@@UEAAXXZ
?Open@SysFile@Scaleform@@QEAA_NAEBVString@2@HH@Z
?OrthoOffCenterLH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMM@Z
?OrthoOffCenterRH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMM@Z
?PerspectiveOffCenterLH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMMM@Z
?PerspectiveOffCenterRH@?$Matrix4x4@M@Render@Scaleform@@QEAAXMMMMMMM@Z
?Prepend@?$Matrix2x4@M@Render@Scaleform@@QEAAAEAV123@AEBV123@@Z
?PulseEvent@Event@Scaleform@@QEAAXXZ
?Read@BufferedFile@Scaleform@@UEAAHPEAEH@Z
?Release@HandlerArray@Waitable@Scaleform@@QEAAXXZ
?Release@RefCountImpl@Scaleform@@QEAAXXZ
?Release@RefCountNTSImpl@Scaleform@@QEBAXXZ
?ReleaseSemaphore@Semaphore@Scaleform@@QEAA_NH@Z
?RemoveWaitHandler@Waitable@Scaleform@@QEAA_NP6AXPEAX@Z0@Z
?ResetEvent@Event@Scaleform@@QEAAXXZ
?Resume@Thread@Scaleform@@QEAA_NXZ
?Run@Thread@Scaleform@@UEAAHXZ
?Seek@BufferedFile@Scaleform@@UEAAHHH@Z
?SetBufferMode@BufferedFile@Scaleform@@IEAA_NW4BufferModeType@12@@Z
?SetEvent@Event@Scaleform@@QEAAXXZ
?SetExitFlag@Thread@Scaleform@@QEAAX_N@Z
?SetHSI@Color@Render@Scaleform@@QEAAXHHH@Z
?SetHSI@Color@Render@Scaleform@@QEAAXMMM@Z
?SetHSV@Color@Render@Scaleform@@QEAAXHHH@Z
?SetHSV@Color@Render@Scaleform@@QEAAXMMM@Z
?SetIdentity@?$Matrix2x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix2x4@N@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix3x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix3x4@N@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix4x4@M@Render@Scaleform@@QEAAXXZ
?SetIdentity@?$Matrix4x4@N@Render@Scaleform@@QEAAXXZ
?SetInverse@?$Matrix2x4@M@Render@Scaleform@@QEAAXAEBV123@@Z
?SetInverse@?$Matrix2x4@N@Render@Scaleform@@QEAAXAEBV123@@Z
?SetLerp@?$Matrix2x4@M@Render@Scaleform@@QEAAXAEBV123@0M@Z
?SetXScale@?$Matrix2x4@M@Render@Scaleform@@QEAAXM@Z
?SetYScale@?$Matrix2x4@M@Render@Scaleform@@QEAAXM@Z
?SetZero@?$Matrix2x4@M@Render@Scaleform@@QEAAXXZ
?SkipBytes@BufferedFile@Scaleform@@UEAAHH@Z
?Sleep@Thread@Scaleform@@SA_NI@Z
?Start@Thread@Scaleform@@UEAA_NW4ThreadState@12@@Z
?Suspend@Thread@Scaleform@@QEAA_NXZ
?Tell@BufferedFile@Scaleform@@UEAAHXZ
?Transform@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?Transform@?$Matrix3x4@M@Render@Scaleform@@QEBA?AV?$Point@M@23@AEBV423@@Z
?Transform@?$Matrix3x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?TransformByInverse@?$Matrix2x4@M@Render@Scaleform@@QEBAXPEAV?$Point@M@23@AEBV423@@Z
?Transpose@?$Matrix3x4@N@Render@Scaleform@@QEAAXXZ
?Transpose@?$Matrix4x4@M@Render@Scaleform@@QEAAXXZ
?Transpose@?$Matrix4x4@N@Render@Scaleform@@QEAAXXZ
?TryAcquire@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquire@Event@Scaleform@@UEAA_NXZ
?TryAcquire@Mutex@Scaleform@@UEAA_NXZ
?TryAcquire@Semaphore@Scaleform@@UEAA_NXZ
?TryAcquireCancel@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Event@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Mutex@Scaleform@@UEAA_NXZ
?TryAcquireCancel@Semaphore@Scaleform@@UEAA_NXZ
?TryAcquireCommit@AcquireInterface@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Event@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Mutex@Scaleform@@UEAA_NXZ
?TryAcquireCommit@Semaphore@Scaleform@@UEAA_NXZ
?TryLock@Mutex@Scaleform@@QEAA_NXZ
?Unlock@Mutex@Scaleform@@QEAAXXZ
?View@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?ViewLH@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?ViewRH@?$Matrix3x4@M@Render@Scaleform@@QEAAXAEBV?$Point3@M@23@00@Z
?Wait@Event@Scaleform@@QEAA_NI@Z
?Wait@WaitCondition@Scaleform@@QEAA_NPEAVMutex@2@I@Z
?Wait@Waitable@Scaleform@@QEAA_NI@Z
?Write@BufferedFile@Scaleform@@UEAAHPEBEH@Z

Sections

.text
Size: 41.1MB - Virtual size: 41.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.interpr
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17.8MB - Virtual size: 17.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.4MB - Virtual size: 4.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 707KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bind
Size: 201KB - Virtual size: 201KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

88aa0caf941cb2c726be6010d8d3eed1

Code Sign

0e:03:32:99:51:38:b2:ba:de:c3:22:23:05:b5:e2:12Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

bd:7e:4e:66:fe:04:bb:66:09:e8:42:31:f4:a7:04:b0:12:7e:5c:f1:3a:17:db:f2:7f:72:8a:7e:45:67:d0:29Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

steam_api64

dxgi

ws2_32

amd_ags_x64

fmodex64

fmod_event64

oo2core_6_win64

wldap32

crypt32

advapi32

winmm

bink2w64

kernel32

user32

gdi32

shell32

ole32

oleaut32

imm32

d3d11

d3dx11_43

d3d9

xinput1_3

dinput8

d3dcompiler_43

Exports

Exports

Sections

.text Size: 41.1MB - Virtual size: 41.1MB

.interpr Size: 48KB - Virtual size: 47KB

.rdata Size: 17.8MB - Virtual size: 17.8MB

.data Size: 2.4MB - Virtual size: 4.3MB

.pdata Size: 2.6MB - Virtual size: 2.6MB

.gfids Size: 4KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 707KB - Virtual size: 706KB

.bind Size: 201KB - Virtual size: 201KB

0e:03:32:99:51:38:b2:ba:de:c3:22:23:05:b5:e2:12
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

bd:7e:4e:66:fe:04:bb:66:09:e8:42:31:f4:a7:04:b0:12:7e:5c:f1:3a:17:db:f2:7f:72:8a:7e:45:67:d0:29
Signer

.text
Size: 41.1MB - Virtual size: 41.1MB

.interpr
Size: 48KB - Virtual size: 47KB

.rdata
Size: 17.8MB - Virtual size: 17.8MB

.data
Size: 2.4MB - Virtual size: 4.3MB

.pdata
Size: 2.6MB - Virtual size: 2.6MB

.gfids
Size: 4KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 707KB - Virtual size: 706KB

.bind
Size: 201KB - Virtual size: 201KB