ForzaHorizon5[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ForzaHorizon5.exe
Size

164.0MB
MD5

a917deced2ce7faf2fa1bc2161b1d344
SHA1

40410c4d273a791e854ba3d3c82b47e0f1d8470b
SHA256

6e2bf1b94f2d14905dc987df11625ab36017a2284f73e942c788a959fd2b4ed3
SHA512

0040ce61784afa5911aacbf8004dbb8d219fc84afedf6e33316447084c332e211e79a552d48f47c81caec82942ea81209f9a38f792e97693b83b9bb625d7d81f
SSDEEP

1572864:nbSrec/W+ogjrdmRJPH1LuHw/NeU5yb1VWTv37qfIMhQR7iiuX5nR:bSrec+Pgjrd+i+8uyvhQRWF

Score

1^/10

Malware Config

Signatures

Files

ForzaHorizon5.exe
.exe windows:6 windows x64 arch:x64

5f88a8c6bddf3fb46264d8394e1a9b0b

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:09

Not After

14/11/2024, 19:09

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:0a:45:a0:58:40:3b:7a:8f:cc:88:88:d6:b8:12:28:aa:e3:d6:e9:24:6c:45:e1:3e:96:0f:60:ae:37:f0:92
Signer

Actual PE Digest

9f:0a:45:a0:58:40:3b:7a:8f:cc:88:88:d6:b8:12:28:aa:e3:d6:e9:24:6c:45:e1:3e:96:0f:60:ae:37:f0:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\scratch\p4\woodstock_rc\forza2\exe\x64\Release_Final\forzahorizon5.pdb

Imports

xinput1_3

ord4
ord2

vcruntime140

__CxxFrameHandler3
wcsrchr
_CxxThrowException
_set_purecall_handler
__current_exception_context
__current_exception
__std_type_info_hash
wcschr
__RTtypeid
__C_specific_handler
strrchr
strchr
strstr
wcsstr
memchr
__std_type_info_compare
__std_type_info_name
__std_exception_destroy
memset
__RTDynamicCast
memmove
memcmp
memcpy
_purecall
__std_terminate
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn
_c_exit
_invalid_parameter_noinfo
_errno
_exit
_initterm_e
_initterm
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_at_quick_exit
signal
_wassert
raise
strerror_s
_crt_atexit
_register_onexit_function
_initialize_onexit_table
terminate
_register_thread_local_exe_atexit_callback
_set_invalid_parameter_handler
abort
_beginthreadex
_control87
exit
_clearfp
_get_wide_winmain_command_line
set_terminate

api-ms-win-crt-string-l1-1-0

strcmp
strncpy_s
strncmp
towlower
_wcslwr_s
wcscpy_s
wcscat_s
strtok_s
tolower
isdigit
iswspace
_strdup
_wcsupr
strcpy_s
wcstok_s
wcsnlen
strncpy
isupper
_stricmp
isspace
_wcsicoll_l
_wcsicoll
isalnum
wcspbrk
strspn
strcspn
wcsncpy_s
isalpha
iswalpha
strcat_s
_wcsupr_s
_strnicmp
strnlen
wcsncpy
iswalnum
strlen
_wcsnicmp
_wcsicmp
wcsncmp
toupper
towupper
iswascii

api-ms-win-crt-convert-l1-1-0

_wtoi
mbstowcs_s
strtoul
atoi
_wcstoui64
_i64toa_s
wcstol
wcstoul
wcstof
atof
strtod
wcstombs_s
strtoull
wcstoull
strtoll
_strtoui64_l
mbstowcs
_itoa_s
wcstod
strtof
_ui64toa_s
_strtoui64
strtol
_itow_s

api-ms-win-crt-stdio-l1-1-0

fputs
__stdio_common_vsnprintf_s
fsetpos
_setmode
_fileno
fgets
ferror
ftell
fseek
fopen
feof
__stdio_common_vfprintf
__stdio_common_vswscanf
__stdio_common_vsprintf_s
__acrt_iob_func
__stdio_common_vfwprintf
_get_stream_buffer_pointers
__p__commode
_set_fmode
__stdio_common_vswprintf_s
fclose
fflush
__stdio_common_vsprintf
fgetc
fgetpos
__stdio_common_vsscanf
fputc
_wfopen
fread
_fseeki64
fwrite
setvbuf
__stdio_common_vswprintf
ungetc

api-ms-win-crt-math-l1-1-0

fmaxf
fmin
floorf
_dclass
sqrtf
ceilf
fmod
log10
atanf
sqrt
log2f
fminf
log10f
lround
modf
sin
cos
_dsign
_fdsign
cosf
roundf
pow
_isnan
tanf
tanhf
sinf
atan2
exp2f
powf
ceil
logf
log
log2
__setusermatherr
exp2
atan2f
ldexp
_fdpcomp
asinf
acosf
_finite
_fdclass
acos
fmodf
expf
sinhf
modff
round

api-ms-win-crt-utility-l1-1-0

rand
qsort
srand

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
malloc
realloc
_aligned_malloc
calloc
_msize
_aligned_free

api-ms-win-crt-filesystem-l1-1-0

_unlock_file
_makepath
_stat64i32
_splitpath
_wrename
_wsplitpath_s
_wremove
_makepath_s
remove
_splitpath_s
_lock_file

api-ms-win-crt-locale-l1-1-0

localeconv
_wcreate_locale
_configthreadlocale
_free_locale
_create_locale

api-ms-win-crt-time-l1-1-0

_difftime64
_gmtime64
_localtime64
_time64
_localtime64_s
_gmtime64_s

concrt140

?_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXXZ
??1_Concurrent_queue_base_v4@details@Concurrency@@MEAA@XZ
??0_Concurrent_queue_base_v4@details@Concurrency@@IEAA@_K@Z
?_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IEAA_NPEAX@Z
??1_Concurrent_vector_base_v4@details@Concurrency@@IEAA@XZ
?_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_NXZ
?_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IEBAXXZ
?_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_K_K0P6AXPEAXPEBX0@Z2@Z
?_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IEBAX_K@Z
??1scoped_lock@critical_section@Concurrency@@QEAA@XZ
??0scoped_lock@critical_section@Concurrency@@QEAA@AEAV12@@Z
??1critical_section@Concurrency@@QEAA@XZ
??0critical_section@Concurrency@@QEAA@XZ
?_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXAEAV123@@Z
??1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@XZ
?_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KA_K_K@Z
?_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IEAAX_K00@Z
?_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IEBA_KXZ
?_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IEAAPEAX_KAEA_K@Z
?_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IEAA_KP6AXPEAX_K@Z@Z
?_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEAX@Z
?_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IEBA_KXZ
??0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAA@AEBV_Concurrent_queue_base_v4@12@@Z
?_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IEAAXXZ
?_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IEAAXPEBX@Z

d3d12

D3D12SerializeVersionedRootSignature
ord101

dxgi

CreateDXGIFactory2
CreateDXGIFactory1

msvcp140

?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strcoll
_Strxfrm
_Wcscoll
_Wcsxfrm
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?c_str@?$_Yarn@D@std@@QEBAPEBDXZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?tolower@?$ctype@_W@std@@QEBAPEB_WPEA_WPEB_W@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAGXZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QEAA_N_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?id@?$collate@_W@std@@2V0locale@2@A
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
_Cnd_register_at_thread_exit
_Cnd_unregister_at_thread_exit
?_Syserror_map@std@@YAPEBDH@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?uncaught_exceptions@std@@YAHXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Lock_shared_ptr_spin_lock
_Unlock_shared_ptr_spin_lock
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?swap@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?swap@?$basic_iostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Random_device@std@@YAIXZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??Bid@locale@std@@QEAA_KXZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
_Thrd_hardware_concurrency
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
?_Throw_C_error@std@@YAXH@Z
_Cnd_broadcast
_Cnd_wait
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Mtx_unlock
_Mtx_lock
_Mtx_destroy_in_situ
_Mtx_init_in_situ
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_sleep
_Xtime_get_ticks
?_Xbad_alloc@std@@YAXXZ
_Query_perf_frequency
_Query_perf_counter
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ
?tellp@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?_Winerror_map@std@@YAHH@Z
?classic@locale@std@@SAAEBV12@XZ
?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@G@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
_Mtx_trylock
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?swap@?$basic_ostream@DU?$char_traits@D@std@@@std@@IEAAXAEAV12@@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Thrd_join
_Thrd_id
_Mtx_current_owns
_Cnd_timedwait
_Cnd_do_broadcast_at_thread_exit
?_Throw_Cpp_error@std@@YAXH@Z
?toupper@?$ctype@D@std@@QEBADD@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ

advapi32

RegCloseKey
CryptEnumProvidersW
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegGetValueW
RegOpenKeyExA
ConvertSidToStringSidW
LookupAccountNameW
RegSetValueExW
RegDeleteValueW
RegNotifyChangeKeyValue
RegGetValueA
SystemFunction036
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
LookupAccountSidW
IsValidSid
GetTokenInformation
OpenProcessToken
RegQueryValueExW
CredFree
CredDeleteW
CredEnumerateW
CredWriteW
CryptSignHashW

kernel32

GetSystemDirectoryW
VerifyVersionInfoW
GetTimeFormatEx
GetDateFormatEx
GetUserDefaultLocaleName
CreateThreadpoolWait
SetThreadpoolWait
WaitForThreadpoolWaitCallbacks
CloseThreadpoolWait
DisassociateCurrentThreadFromCallback
CreateThreadpoolWork
SubmitThreadpoolWork
WaitForThreadpoolWorkCallbacks
CloseThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GlobalFree
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
LoadLibraryExW
GetLargePageMinimum
WerRegisterFile
GetLocalTime
RtlCaptureStackBackTrace
GetUserDefaultUILanguage
GetUserGeoID
LCIDToLocaleName
LocaleNameToLCID
VirtualFree
VirtualAlloc
TryAcquireSRWLockShared
ConvertThreadToFiber
CreateFiber
ConvertFiberToThread
DeleteFiber
SwitchToFiber
GetSystemTime
GetSystemCpuSetInformation
FileTimeToLocalFileTime
CompareFileTime
GetComputerNameA
CreateSemaphoreA
VirtualQuery
VirtualProtect
GetLogicalProcessorInformation
SetThreadSelectedCpuSets
GetThreadContext
GetThreadId
CreateProcessA
ResumeThread
SuspendThread
GetExitCodeThread
SetThreadPriorityBoost
OpenThread
CreateThread
TerminateProcess
ExitProcess
CreateEventA
CreateMutexW
CreateMutexA
InitializeCriticalSectionEx
DuplicateHandle
SetWaitableTimer
CreateWaitableTimerW
QueueUserAPC
TerminateThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FormatMessageA
GetVersionExW
GetEnvironmentVariableW
RtlVirtualUnwind
GetSystemDefaultLocaleName
WideCharToMultiByte
InitOnceComplete
InitOnceBeginInitialize
GetStartupInfoW
UnhandledExceptionFilter
RtlCaptureContext
InitializeSListHead
SetFileTime
SetUnhandledExceptionFilter
CloseThreadpoolIo
WaitForThreadpoolIoCallbacks
CancelThreadpoolIo
StartThreadpoolIo
CreateThreadpoolIo
InitializeCriticalSectionAndSpinCount
FlsGetValue
FlsAlloc
SleepEx
ReleaseMutex
GetSystemInfo
K32GetProcessMemoryInfo
FreeLibrary
GetPhysicallyInstalledSystemMemory
HeapSize
CreateEventW
K32GetModuleBaseNameA
GetStdHandle
GetFileType
LoadLibraryA
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetFileInformationByHandle
OpenProcess
K32EnumProcesses
K32EnumProcessModules
K32GetModuleFileNameExW
TryAcquireSRWLockExclusive
CreateSemaphoreExW
SetThreadDescription
SetThreadAffinityMask
SetThreadIdealProcessor
GetProcessAffinityMask
GetFileAttributesExW
GlobalMemoryStatusEx
WaitForMultipleObjectsEx
CreateDirectoryA
IsProcessorFeaturePresent
GetProcessHeap
HeapFree
HeapAlloc
MultiByteToWideChar
GetFileInformationByHandleEx
FileTimeToSystemTime
MoveFileExW
CopyFileW
GetOverlappedResultEx
GetOverlappedResult
SetLastError
CreateFile2
GetTempPathW
WriteFile
SetFilePointerEx
SetFilePointer
SetFileAttributesW
SetEndOfFile
RemoveDirectoryW
ReadFile
GetFullPathNameW
GetFileTime
GetFileSizeEx
GetFileSize
GetFileAttributesExA
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceExW
FlushFileBuffers
FindNextFileW
FindNextFileA
FindFirstFileW
FindClose
DeleteFileW
DeleteFileA
CreateFileW
CreateFileA
CreateDirectoryW
K32GetModuleInformation
GetModuleHandleExW
GetThreadTimes
GetCurrentProcess
Module32NextW
Module32FirstW
CreateToolhelp32Snapshot
FormatMessageW
GetModuleHandleW
GetModuleHandleA
GetCurrentProcessId
OutputDebugStringA
LoadLibraryW
GetProcAddress
GetThreadPriority
LocalAlloc
SetThreadPriority
GetCurrentThread
GetLastError
IsDebuggerPresent
GetModuleFileNameA
DeleteCriticalSection
InitializeCriticalSection
SetCurrentDirectoryA
GlobalMemoryStatus
AcquireSRWLockShared
ReleaseSRWLockShared
GetCurrentThreadId
WaitForSingleObjectEx
SwitchToThread
ReleaseSemaphore
OutputDebugStringW
TryEnterCriticalSection
GetModuleFileNameW
Sleep
WaitForSingleObject
ResetEvent
SetEvent
CloseHandle
GetCommandLineW
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
SystemTimeToFileTime
GetSystemTimeAsFileTime
GetTickCount64
WaitForMultipleObjects
QueryPerformanceFrequency
QueryPerformanceCounter
VerSetConditionMask
lstrlenW
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
DeleteTimerQueue
InterlockedPushEntrySList
RtlLookupFunctionEntry
LocalFree

user32

SetWindowLongW
CopyRect
SetRect
ClientToScreen
ShowCursor
AdjustWindowRect
GetWindowRect
GetClientRect
SetWindowTextW
EndPaint
BeginPaint
SetForegroundWindow
UpdateWindow
EnableMenuItem
GetSystemMenu
GetSystemMetrics
MsgWaitForMultipleObjectsEx
MessageBoxIndirectA
GetWindowLongPtrW
IsIconic
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetKeyNameTextW
MapVirtualKeyW
LoadImageW
TranslateMessage
DispatchMessageW
PeekMessageW
EnumDisplaySettingsW
MonitorFromPoint
GetDoubleClickTime
MonitorFromRect
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SetWindowLongPtrW
IsZoomed
GetWindowTextW
GetParent
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
PostMessageW
GetActiveWindow
GetKeyState
SetCapture
ReleaseCapture
SetCursor
SystemParametersInfoW
SendMessageW
GetClassInfoExW
ShowWindowAsync
AdjustWindowRectExForDpi
LoadCursorW
MonitorFromWindow
RegisterWindowMessageW
GetMonitorInfoW
EnumWindows
GetWindowThreadProcessId
GetClassLongPtrW
GetDpiForWindow
GetAsyncKeyState

ws2_32

inet_addr
getsockopt
getpeername
htonl
WSASetLastError
WSARecv
WSASend
WSAAddressToStringW
WSAStringToAddressW
closesocket
getsockname
connect
htons
recv
send
socket
ntohl
inet_pton
gethostbyaddr
gethostbyname
__WSAFDIsSet
accept
bind
ioctlsocket
listen
ntohs
sendto
setsockopt
shutdown
WSAStartup
WSACleanup
WSAGetLastError
WSAIoctl
WSARecvFrom
WSASendTo
WSASocketW
getaddrinfo
freeaddrinfo
getnameinfo
inet_ntop
select

api-ms-win-core-version-l1-1-0

VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW

mfplat

MFStartup
MFShutdown

api-ms-win-core-com-l1-1-0

CoUninitialize
CoCreateInstanceEx
CoIncrementMTAUsage
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
CoCreateGuid
CoInitializeEx

bcrypt

BCryptGenerateKeyPair
BCryptImportKeyPair
BCryptGenRandom
BCryptCreateHash
BCryptFinalizeKeyPair
BCryptDestroyHash
BCryptExportKey
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptSignHash
BCryptFinishHash
BCryptOpenAlgorithmProvider
BCryptGetProperty

api-ms-win-core-memory-l1-1-3

VirtualAllocFromApp

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString
WindowsPromoteStringBuffer
WindowsCreateStringReference
WindowsPreallocateStringBuffer
WindowsDeleteString
WindowsDeleteStringBuffer
WindowsGetStringRawBuffer

api-ms-win-gaming-tcui-l1-1-0

ShowProfileCardUI
ShowPlayerPickerUI
ProcessPendingGameUI

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

amd_ags_x64

agsDriverExtensionsDX12_CreateDevice
agsInitialize

winhttp

WinHttpGetProxyForUrl
WinHttpSetStatusCallback
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpQueryDataAvailable
WinHttpQueryOption
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpQueryHeaders
WinHttpGetIEProxyConfigForCurrentUser

crypt32

CertGetCertificateChain
CertEnumCertificatesInStore
CertCreateCertificateContext
CertFindChainInStore
CertFreeCertificateChain
CertFreeCertificateContext
CertOpenStore
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertCloseStore
CertFindCertificateInStore

shlwapi

PathFileExistsA

comctl32

ord345

libxess

xessD3D12CreateContext
xessD3D12Execute
xessSetLoggingCallback
xessGetInputResolution
xessDestroyContext
xessGetProperties
xessGetIntelXeFXVersion
xessSetVelocityScale
xessD3D12Init

bink2w64

BinkRequestStopAsyncThread
BinkWaitStopAsyncThread
BinkGetRealtime
BinkSetSoundTrack
BinkSetSoundSystem2
BinkOpenXAudio2
BinkDoFrameAsync
BinkStartAsyncThread
BinkSetWillLoop
BinkSetOSFileCallbacks
BinkShouldSkip
BinkSetSpeakerVolumes
BinkUtilFree
BinkGetPlatformInfo
BinkPause
BinkClose
BinkWait
BinkNextFrame
BinkOpen
BinkDoFrameAsyncWait
BinkUtilMalloc
BinkRegisterFrameBuffers
BinkGetFrameBuffersInfo

gdi32

SelectObject
GetStockObject
DeleteObject
CreateCompatibleDC
GetObjectW
BitBlt

shell32

ShellExecuteExW
ShellExecuteW
SHGetKnownFolderPath

ole32

CoWaitForMultipleHandles
StringFromGUID2
CoGetApartmentType
PropVariantClear

partywin

ord136
ord63
ord101
ord59
ord141
ord90
ord62
ord60
ord93
ord61
ord91
ord109
ord108
ord65
ord110
ord112
ord131
ord125
ord111
ord117
ord53
ord45
ord47
ord42
ord24
ord144
ord146
ord145
ord49
ord28
ord41
ord25
ord32
ord50
ord46
ord55
ord56
ord57
ord58

partyxboxlive

PartyXblChatUserGetXboxUserId
PartyXblChatUserSetCustomContext
PartyXblLocalChatUserGetAccessibilitySettings
PartyXblLocalChatUserGetRequiredChatPermissionInfo
PartyXblGetEntityIdsFromXboxLiveUserIds
PartyXblLoginToPlayFab
PartyXblGetChatUsers
PartyXblDestroyChatUser
PartyXblCreateRemoteChatUser
PartyXblCreateLocalChatUser
PartyXblCompleteGetTokenAndSignatureRequest
PartyXblFinishProcessingStateChanges
PartyXblStartProcessingStateChanges
PartyXblInitialize
PartyXblCleanup

steam_api64

SteamAPI_Init
SteamAPI_UnregisterCallback
SteamAPI_Shutdown
SteamAPI_RegisterCallback
SteamInternal_ContextInit
SteamAPI_GetHSteamUser
SteamAPI_RestartAppIfNecessary
SteamInternal_CreateInterface
SteamInternal_FindOrCreateUserInterface
SteamAPI_RunCallbacks
SteamAPI_RegisterCallResult
SteamAPI_UnregisterCallResult
SteamAPI_ReleaseCurrentThreadMemory

webview2loader

GetAvailableCoreWebView2BrowserVersionString
CompareBrowserVersions
CreateCoreWebView2EnvironmentWithOptions

api-ms-win-crt-environment-l1-1-0

getenv

winmm

timeGetTime

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

version

GetFileVersionInfoSizeW

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo
SetRestrictedErrorInfo

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysFreeString
SysStringLen

Exports

Exports

CentreGainGetDSPDescription
CompressorGetDSPDescription
D3D12SDKPath
D3D12SDKVersion
FmodGainGetDSPDescription
SaturatorGetDSPDescription
SurroundGainGetDSPDescription
Turn10GainGetDSPDescription
ffxFsr2ContextCreate
ffxFsr2ContextDestroy
ffxFsr2ContextDispatch
ffxFsr2ContextGenerateReactiveMask
ffxFsr2GetInterfaceDX12
ffxFsr2GetJitterOffset
ffxFsr2GetJitterPhaseCount
ffxFsr2GetRenderResolutionFromQualityMode
ffxFsr2GetScratchMemorySizeDX12
ffxFsr2GetUpscaleRatioFromQualityMode
ffxFsr2ResourceIsNull
ffxGetCommandListDX12
ffxGetDX12ResourcePtr
ffxGetDeviceDX12
ffxGetResourceDX12
tm_api_close_device
tm_api_exit
tm_api_force_config_effect
tm_api_force_set_effect_state
tm_api_get_device_count
tm_api_get_device_info
tm_api_get_device_status
tm_api_get_input_state
tm_api_get_properties
tm_api_init
tm_api_open_device
tm_api_read_input_states
tm_api_set_properties
tm_api_update
tm_sdk_installer_begin
tm_sdk_installer_check_access
tm_sdk_installer_end
tm_sdk_installer_get_error_str
tm_sdk_installer_get_pid_info
tm_sdk_installer_query_timeout
tm_sdk_installer_register_changes
tm_sdk_installer_unregister_changes

Sections

.text
Size: 100.7MB - Virtual size: 100.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39.8MB - Virtual size: 39.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15.9MB - Virtual size: 19.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f88a8c6bddf3fb46264d8394e1a9b0b

Code Sign

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:afCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

9f:0a:45:a0:58:40:3b:7a:8f:cc:88:88:d6:b8:12:28:aa:e3:d6:e9:24:6c:45:e1:3e:96:0f:60:ae:37:f0:92Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

xinput1_3

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

concrt140

d3d12

dxgi

msvcp140

advapi32

kernel32

user32

ws2_32

api-ms-win-core-version-l1-1-0

mfplat

api-ms-win-core-com-l1-1-0

bcrypt

api-ms-win-core-memory-l1-1-3

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-gaming-tcui-l1-1-0

api-ms-win-shcore-scaling-l1-1-1

amd_ags_x64

winhttp

crypt32

shlwapi

comctl32

libxess

bink2w64

gdi32

shell32

ole32

partywin

partyxboxlive

steam_api64

webview2loader

api-ms-win-crt-environment-l1-1-0

winmm

api-ms-win-core-version-l1-1-1

version

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

oleaut32

Exports

Exports

Sections

.text Size: 100.7MB - Virtual size: 100.7MB

.rdata Size: 39.8MB - Virtual size: 39.8MB

.data Size: 15.9MB - Virtual size: 19.8MB

.pdata Size: 5.3MB - Virtual size: 5.3MB

.detourc Size: 8KB - Virtual size: 8KB

.detourd Size: 512B - Virtual size: 24B

_RDATA Size: 69KB - Virtual size: 69KB

.rsrc Size: 6KB - Virtual size: 6KB

.reloc Size: 2.2MB - Virtual size: 2.2MB

33:00:00:03:af:30:40:0e:4c:a3:4d:05:41:00:00:00:00:03:af
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

9f:0a:45:a0:58:40:3b:7a:8f:cc:88:88:d6:b8:12:28:aa:e3:d6:e9:24:6c:45:e1:3e:96:0f:60:ae:37:f0:92
Signer

.text
Size: 100.7MB - Virtual size: 100.7MB

.rdata
Size: 39.8MB - Virtual size: 39.8MB

.data
Size: 15.9MB - Virtual size: 19.8MB

.pdata
Size: 5.3MB - Virtual size: 5.3MB

.detourc
Size: 8KB - Virtual size: 8KB

.detourd
Size: 512B - Virtual size: 24B

_RDATA
Size: 69KB - Virtual size: 69KB

.rsrc
Size: 6KB - Virtual size: 6KB

.reloc
Size: 2.2MB - Virtual size: 2.2MB