fm[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

fm.exe
Size

336.3MB
MD5

57efefd7b81053a60f14f4a01443103b
SHA1

449e5c0c26b47407213d092a52d413dae1f8f213
SHA256

d0c9fb1a66248ee6ae2febf086dbc50b3ad4100ee7ee8d6ec0ee31015ff6b8c1
SHA512

7552fb7c6156ea48aea3bb714529f07701d6fcd927be51759ec309a4684be4a82ac7ff1f062e788987917eb1a8f4390b38f142f78fdf17a072a903cc3581c2ea
SSDEEP

3145728:pl3G8vw9l0L+OXMMfSKoS1XUCKk9526n6X6uKHpZ:vvw9l0L+OXMMfSKoS1XUCKkDGKuuZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fm.exe

Files

fm.exe
.exe windows:6 windows x64 arch:x64

6a31fa4649b53379369626d133f89c36

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

fm.pdb

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDecrypt
CryptDestroyHash
CryptDestroyKey
CryptEnumProvidersW
CryptExportKey
CryptGetProvParam
CryptGetUserKey
CryptReleaseContext
CryptSetHashParam
CryptSignHashW
DeregisterEventSource
GetUserNameW
RegCloseKey
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExA
RegQueryValueExW
RegisterEventSourceW
ReportEventW

api-ms-win-crt-convert-l1-1-0

atoi
mbstowcs
strtod
strtof
strtol
strtoll
strtoul
strtoull
wcstol
wcstombs

api-ms-win-crt-environment-l1-1-0

getenv
_wgetcwd

api-ms-win-crt-filesystem-l1-1-0

_access
_fstat64
_fstat64i32
_lock_file
_stat64
_stat64i32
_unlink
_unlock_file
_waccess
_wstat64
rename

api-ms-win-crt-heap-l1-1-0

_aligned_free
_aligned_malloc
_aligned_realloc
_callnewh
_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dtest
_fdsign
_fdtest
acos
acosf
asinf
atan2
atan2f
ceil
ceilf
cos
cosf
exp
exp2f
expf
floor
floorf
fmod
fmodf
ilogbf
ldexp
llround
log
logf
lroundf
modf
modff
pow
powf
rintf
round
roundf
scalbnf
sin
sinf
sqrt
sqrtf
tan
tanf
trunc

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___wargv
__sys_nerr
_beginthreadex
_c_exit
_cexit
_configure_wide_argv
_crt_atexit
_errno
_exit
_get_wide_winmain_command_line
_getpid
_initialize_onexit_table
_initialize_wide_environment
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_invoke_watson
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
_set_invalid_parameter_handler
abort
exit
raise
signal
strerror
strerror_s
system
terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vfscanf
__stdio_common_vfwprintf
__stdio_common_vsnprintf_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
__stdio_common_vswprintf
__stdio_common_vswprintf_s
_close
_fileno
_fseeki64
_ftelli64
_get_stream_buffer_pointers
_lseeki64
_open
_read
_set_fmode
_setmode
_wfopen
_wfopen_s
_wfsopen
clearerr
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
fsetpos
ftell
fwrite
getc
setbuf
setvbuf
ungetc

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
_strnicmp
_wcsdup
isalpha
isspace
strcat
strcmp
strcpy
strcpy_s
strcspn
strlen
strncat
strncmp
strncpy
strspn
tolower
toupper
wcscmp
wcscpy
wcslen
wcsncpy
wcspbrk

api-ms-win-crt-time-l1-1-0

_gmtime64
_gmtime64_s
_localtime64
_time64
strftime
_ftime64

api-ms-win-crt-utility-l1-1-0

_byteswap_uint64
_byteswap_ulong
div
qsort
rand
rand_s
srand

bcrypt

BCryptGenRandom

bidstack-cpp-sdk

??0SHA256Hash@sdk@bidstack@@QEAA@XZ
?Free@memory@sdk@bidstack@@YAXPEAX@Z
?Malloc@memory@sdk@bidstack@@YAPEAX_K@Z
?cancel_request@AdClient@sdk@bidstack@@QEAAXI@Z
?create_ad_client@sdk@bidstack@@YAPEAVAdClient@12@AEBUConfig@312@@Z
?create_ad_spot@ViewabilityChecker@sdk@bidstack@@QEAA_KXZ
?destroy@AdClient@sdk@bidstack@@QEAAXXZ
?destroy_ad_spot@ViewabilityChecker@sdk@bidstack@@QEAAH_K@Z
?empty@SHA256Hash@sdk@bidstack@@SA?AU123@XZ
?get_creative_status@IAdClientEventHandler@sdk@bidstack@@UEAA?AW4CreativeStatus@23@PEBUCreative@23@@Z
?get_inspection_output_destination@hash@sdk@bidstack@@YAPEBDXZ
?get_viewability_checker@AdClient@sdk@bidstack@@QEAAPEAVViewabilityChecker@23@XZ
?is_inspection_enabled@hash@sdk@bidstack@@YA_NXZ
?notify_gameplay_end_raw@AdClient@sdk@bidstack@@QEAAXPEBD@Z
?notify_gameplay_start_raw@AdClient@sdk@bidstack@@QEAAXPEBD@Z
?notify_impression_raw@AdClient@sdk@bidstack@@QEAAXPEBD0@Z
?notify_pause_raw@AdClient@sdk@bidstack@@QEAAXPEBD@Z
?notify_unpause_raw@AdClient@sdk@bidstack@@QEAAXPEBD@Z
?request_ads_raw@AdClient@sdk@bidstack@@QEAAIPEBD0_N@Z
?set_ad_spot_ad_unit_name@ViewabilityChecker@sdk@bidstack@@QEAAH_KPEBD@Z
?set_ad_spot_geometry_quad_world_matrix@ViewabilityChecker@sdk@bidstack@@QEAAH_KAEBUMat4@23@@Z
?set_ad_spot_notification_id@ViewabilityChecker@sdk@bidstack@@QEAAH_KPEBD@Z
?set_ad_spot_visible@ViewabilityChecker@sdk@bidstack@@QEAAH_K_N@Z
?set_ad_spot_visible_sides@ViewabilityChecker@sdk@bidstack@@QEAAH_KW4AdSpotVisibleSides@23@@Z
?set_camera@ViewabilityChecker@sdk@bidstack@@QEAAHHMAEBUMat4@23@PEBD@Z
?set_log_callback@sdk@bidstack@@YAXP6AXPEAXW4LogLevel@12@PEBD_K@Z0@Z
?set_log_level@sdk@bidstack@@YAXW4LogLevel@12@@Z
?set_privacy@AdClient@sdk@bidstack@@QEAAHAEBUPrivacy@123@@Z
?set_user_raw@AdClient@sdk@bidstack@@QEAAHPEBUHashedUserID@23@_KPEBDW4Gender@23@2@Z
?to_str@SHA256Hash@sdk@bidstack@@SAHQEADQEBE@Z
?update_frame_viewability@ViewabilityChecker@sdk@bidstack@@QEAAXXZ

comdlg32

PrintDlgW

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenStore
CertOpenSystemStoreW

dbghelp

SymGetTypeInfo
MiniDumpWriteDump

eossdk-win64-shipping

EOS_Achievements_CopyPlayerAchievementByIndex
EOS_Achievements_GetPlayerAchievementCount
EOS_Achievements_PlayerAchievement_Release
EOS_Achievements_QueryPlayerAchievements
EOS_Achievements_UnlockAchievements
EOS_Auth_AddNotifyLoginStatusChanged
EOS_Auth_CopyUserAuthToken
EOS_Auth_DeletePersistentAuth
EOS_Auth_GetLoginStatus
EOS_Auth_Login
EOS_Auth_Logout
EOS_Auth_RemoveNotifyLoginStatusChanged
EOS_Auth_Token_Release
EOS_ByteArray_ToString
EOS_Connect_AddNotifyAuthExpiration
EOS_Connect_CreateUser
EOS_Connect_GetExternalAccountMapping
EOS_Connect_GetLoginStatus
EOS_Connect_LinkAccount
EOS_Connect_Login
EOS_Connect_QueryExternalAccountMappings
EOS_Connect_RemoveNotifyAuthExpiration
EOS_Connect_UnlinkAccount
EOS_EResult_IsOperationComplete
EOS_EResult_ToString
EOS_Ecom_CatalogItem_Release
EOS_Ecom_CatalogOffer_Release
EOS_Ecom_Checkout
EOS_Ecom_CopyEntitlementByIndex
EOS_Ecom_CopyEntitlementByNameAndIndex
EOS_Ecom_CopyItemById
EOS_Ecom_CopyOfferByIndex
EOS_Ecom_Entitlement_Release
EOS_Ecom_GetEntitlementsCount
EOS_Ecom_GetOfferCount
EOS_Ecom_QueryEntitlements
EOS_Ecom_QueryOffers
EOS_Ecom_RedeemEntitlements
EOS_EpicAccountId_IsValid
EOS_EpicAccountId_ToString
EOS_Friends_AddNotifyFriendsUpdate
EOS_Friends_GetFriendAtIndex
EOS_Friends_GetFriendsCount
EOS_Friends_GetStatus
EOS_Friends_QueryFriends
EOS_Friends_RemoveNotifyFriendsUpdate
EOS_Initialize
EOS_Leaderboards_CopyLeaderboardRecordByIndex
EOS_Leaderboards_GetLeaderboardRecordCount
EOS_Leaderboards_LeaderboardRecord_Release
EOS_Leaderboards_QueryLeaderboardRanks
EOS_LobbyDetails_CopyAttributeByIndex
EOS_LobbyDetails_CopyAttributeByKey
EOS_LobbyDetails_CopyInfo
EOS_LobbyDetails_GetAttributeCount
EOS_LobbyDetails_Info_Release
EOS_LobbyDetails_Release
EOS_LobbyModification_AddAttribute
EOS_LobbyModification_Release
EOS_LobbySearch_CopySearchResultByIndex
EOS_LobbySearch_Find
EOS_LobbySearch_GetSearchResultCount
EOS_LobbySearch_Release
EOS_LobbySearch_SetLobbyId
EOS_LobbySearch_SetParameter
EOS_Lobby_AddNotifyJoinLobbyAccepted
EOS_Lobby_AddNotifyLobbyInviteAccepted
EOS_Lobby_AddNotifyLobbyInviteReceived
EOS_Lobby_AddNotifyLobbyUpdateReceived
EOS_Lobby_Attribute_Release
EOS_Lobby_CopyLobbyDetailsHandleByInviteId
EOS_Lobby_CopyLobbyDetailsHandleByUiEventId
EOS_Lobby_CreateLobby
EOS_Lobby_CreateLobbySearch
EOS_Lobby_DestroyLobby
EOS_Lobby_JoinLobby
EOS_Lobby_LeaveLobby
EOS_Lobby_RemoveNotifyJoinLobbyAccepted
EOS_Lobby_RemoveNotifyLobbyInviteAccepted
EOS_Lobby_RemoveNotifyLobbyInviteReceived
EOS_Lobby_RemoveNotifyLobbyUpdateReceived
EOS_Lobby_SendInvite
EOS_Lobby_UpdateLobby
EOS_Lobby_UpdateLobbyModification
EOS_Logging_SetCallback
EOS_Logging_SetLogLevel
EOS_P2P_AcceptConnection
EOS_P2P_AddNotifyPeerConnectionClosed
EOS_P2P_AddNotifyPeerConnectionRequest
EOS_P2P_CloseConnection
EOS_P2P_ReceivePacket
EOS_P2P_RemoveNotifyPeerConnectionClosed
EOS_P2P_RemoveNotifyPeerConnectionRequest
EOS_P2P_SendPacket
EOS_P2P_SetPortRange
EOS_P2P_SetRelayControl
EOS_Platform_Create
EOS_Platform_GetAchievementsInterface
EOS_Platform_GetAuthInterface
EOS_Platform_GetConnectInterface
EOS_Platform_GetEcomInterface
EOS_Platform_GetFriendsInterface
EOS_Platform_GetLeaderboardsInterface
EOS_Platform_GetLobbyInterface
EOS_Platform_GetP2PInterface
EOS_Platform_GetPlayerDataStorageInterface
EOS_Platform_GetPresenceInterface
EOS_Platform_GetStatsInterface
EOS_Platform_GetUserInfoInterface
EOS_Platform_Release
EOS_Platform_SetApplicationStatus
EOS_Platform_SetNetworkStatus
EOS_Platform_Tick
EOS_PlayerDataStorage_CopyFileMetadataAtIndex
EOS_PlayerDataStorage_DeleteFile
EOS_PlayerDataStorage_DuplicateFile
EOS_PlayerDataStorage_FileMetadata_Release
EOS_PlayerDataStorage_QueryFileList
EOS_PlayerDataStorage_ReadFile
EOS_PlayerDataStorage_WriteFile
EOS_PresenceModification_Release
EOS_PresenceModification_SetRawRichText
EOS_Presence_CreatePresenceModification
EOS_Presence_SetPresence
EOS_ProductUserId_ToString
EOS_Shutdown
EOS_Stats_IngestStat
EOS_UserInfo_CopyUserInfo
EOS_UserInfo_QueryUserInfo
EOS_UserInfo_Release

gdi32

CreateBitmap
CreateDIBSection
CreateFontIndirectA
CreateFontW
CreateSolidBrush
DeleteObject
EndDoc
EndPage
GdiSetBatchLimit
GetDeviceCaps
GetObjectA
GetStockObject
GetTextExtentPoint32W
GetTextMetricsW
SelectObject
SetTextColor
StartDocW
StartPage
TextOutW

icuin65

?createInstance@Transliterator@icu_65@@SAPEAV12@AEBVUnicodeString@2@W4UTransDirection@@AEAW4UErrorCode@@@Z
?createInstance@Collator@icu_65@@SAPEAV12@AEBVLocale@2@AEAW4UErrorCode@@@Z

icuuc65

??0ByteSink@icu_65@@QEAA@XZ
??0CheckedArrayByteSink@icu_65@@QEAA@PEADH@Z
??0Locale@icu_65@@QEAA@AEBV01@@Z
??0Locale@icu_65@@QEAA@PEBD000@Z
??0StringPiece@icu_65@@QEAA@PEBD@Z
??0StringPiece@icu_65@@QEAA@PEBDH@Z
??0UnicodeString@icu_65@@QEAA@CVConstChar16Ptr@1@H@Z
??0UnicodeString@icu_65@@QEAA@H@Z
??0UnicodeString@icu_65@@QEAA@PEBD@Z
??0UnicodeString@icu_65@@QEAA@XZ
??1ByteSink@icu_65@@UEAA@XZ
??1CheckedArrayByteSink@icu_65@@UEAA@XZ
??1Locale@icu_65@@UEAA@XZ
??1UnicodeString@icu_65@@UEAA@XZ
??2UMemory@icu_65@@SAPEAX_K@Z
??3UMemory@icu_65@@SAXPEAX@Z
??4Locale@icu_65@@QEAAAEAV01@$$QEAV01@@Z
??4Locale@icu_65@@QEAAAEAV01@AEBV01@@Z
??4UnicodeString@icu_65@@QEAAAEAV01@$$QEAV01@@Z
??8Locale@icu_65@@QEBACAEBV01@@Z
?Flush@ByteSink@icu_65@@UEAAXXZ
?GetAppendBuffer@ByteSink@icu_65@@UEAAPEADHHPEADHPEAH@Z
?char32At@UnicodeString@icu_65@@QEBAHH@Z
?countChar32@UnicodeString@icu_65@@QEBAHHH@Z
?createWordInstance@BreakIterator@icu_65@@SAPEAV12@AEBVLocale@2@AEAW4UErrorCode@@@Z
?doCaseCompare@UnicodeString@icu_65@@AEBACHHPEB_SHHI@Z
?doCompare@UnicodeString@icu_65@@AEBACHHPEB_SHH@Z
?fromUTF8@UnicodeString@icu_65@@SA?AV12@VStringPiece@2@@Z
?getFrench@Locale@icu_65@@SAAEBV12@XZ
?getGerman@Locale@icu_65@@SAAEBV12@XZ
?getItalian@Locale@icu_65@@SAAEBV12@XZ
?getJapanese@Locale@icu_65@@SAAEBV12@XZ
?getKorean@Locale@icu_65@@SAAEBV12@XZ
?getNFCInstance@Normalizer2@icu_65@@SAPEBV12@AEAW4UErrorCode@@@Z
?getRoot@Locale@icu_65@@SAAEBV12@XZ
?getSimplifiedChinese@Locale@icu_65@@SAAEBV12@XZ
?getTraditionalChinese@Locale@icu_65@@SAAEBV12@XZ
?getUK@Locale@icu_65@@SAAEBV12@XZ
?getUS@Locale@icu_65@@SAAEBV12@XZ
?toLower@UnicodeString@icu_65@@QEAAAEAV12@AEBVLocale@2@@Z
?toTitle@UnicodeString@icu_65@@QEAAAEAV12@PEAVBreakIterator@2@AEBVLocale@2@@Z
?toUTF8@UnicodeString@icu_65@@QEBAXAEAVByteSink@2@@Z
?toUpper@UnicodeString@icu_65@@QEAAAEAV12@AEBVLocale@2@@Z
u_charType_65
u_cleanup_65
u_hasBinaryProperty_65
u_init_65
u_ispunct_65
u_setDataDirectory_65
u_tolower_65
u_toupper_65
utf8_back1SafeBody_65

imm32

ImmGetCompositionStringW
ImmGetContext
ImmNotifyIME
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionStringW
ImmSetCompositionWindow

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
AllocConsole
CloseHandle
CompareFileTime
ConvertFiberToThread
ConvertThreadToFiber
CopyFileW
CreateDirectoryW
CreateEventA
CreateEventW
CreateFiber
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessW
CreateSemaphoreA
CreateSemaphoreW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerW
DeleteCriticalSection
DeleteFiber
DeleteFileW
EnterCriticalSection
ExitProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FormatMessageA
FormatMessageW
FreeConsole
FreeLibrary
GetCommandLineA
GetCommandLineW
GetComputerNameW
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDiskFreeSpaceExW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeThread
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLogicalDrives
GetLogicalProcessorInformation
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetProcessId
GetProcessTimes
GetProductInfo
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetSystemPowerStatus
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetUserDefaultUILanguage
GetVersionExW
GetVolumeInformationW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
GlobalLock
GlobalMemoryStatusEx
GlobalUnlock
HeapAlloc
HeapFree
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessorFeaturePresent
K32EnumProcessModules
K32EnumProcesses
K32GetModuleBaseNameA
K32GetModuleBaseNameW
K32GetProcessMemoryInfo
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFileTimeToFileTime
LocalFree
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenEventA
OpenProcess
OutputDebugStringA
OutputDebugStringW
Process32FirstW
Process32NextW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadConsoleA
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleCtrlHandler
SetConsoleMode
SetConsoleTitleW
SetEvent
SetFileAttributesW
SetFilePointer
SetFileTime
SetLastError
SetNamedPipeHandleState
SetThreadAffinityMask
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
Sleep
SleepConditionVariableCS
SleepEx
SwitchToFiber
SwitchToThread
SystemTimeToFileTime
TerminateProcess
TerminateThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TransactNamedPipe
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoA
VerifyVersionInfoW
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForMultipleObjects
WaitForMultipleObjectsEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
__chkstk
lstrcatW
lstrcmpA
lstrcmpW
lstrcmpiA
lstrcmpiW
lstrcpyW
lstrlenA
lstrlenW

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
??0facet@locale@std@@IEAA@_K@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1facet@locale@std@@MEAA@XZ
??1ios_base@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??Bid@locale@std@@QEAA_KXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Incref@facet@locale@std@@UEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Raise_handler@std@@3P6AXAEBVexception@stdext@@@ZEA
?_Random_device@std@@YAIXZ
?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_future_error@std@@YAXAEBVerror_code@1@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_XLgamma@std@@YANN@Z
?_Xbad_alloc@std@@YAXXZ
?_Xbad_function_call@std@@YAXXZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flags@ios_base@std@@QEAAHH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
?id@?$ctype@D@std@@2V0locale@2@A
?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setf@ios_base@std@@QEAAHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exception@std@@YA_NXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_broadcast
_Cnd_destroy_in_situ
_Cnd_init_in_situ
_Cnd_register_at_thread_exit
_Cnd_timedwait
_Cnd_unregister_at_thread_exit
_Cnd_wait
_Mtx_current_owns
_Mtx_destroy_in_situ
_Mtx_init_in_situ
_Mtx_lock
_Mtx_unlock
_Query_perf_counter
_Query_perf_frequency
_Strcoll
_Strxfrm
_Thrd_yield
_Xtime_get_ticks

msvcrt

memcpy

ntdll

NtClose
NtCreateThreadEx
NtGetContextThread
NtOpenFile
NtReadFile
NtSuspendThread
NtTerminateThread
NtWriteFile

ole32

CoTaskMemFree
CoCreateGuid

openal32

alBufferData
alDeleteBuffers
alDeleteSources
alGenBuffers
alGenSources
alGetError
alGetSourcei
alListenerfv
alSourcePause
alSourcePlay
alSourceStop
alSourceUnqueueBuffers
alSourcef
alSourcefv
alSourcei
alcCloseDevice
alcCreateContext
alcDestroyContext
alcGetContextsDevice
alcGetCurrentContext
alcGetError
alcGetString
alcIsExtensionPresent
alcMakeContextCurrent
alcOpenDevice

pdh

PdhAddCounterW
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhMakeCounterPathW
PdhOpenQueryW
PdhRemoveCounter

powrprof

CallNtPowerInformation

shell32

CommandLineToArgvW
DragAcceptFiles
DragFinish
DragQueryFileW
DragQueryPoint
SHFileOperationW
SHGetFolderPathW
SHGetKnownFolderPath
ShellExecuteA
ShellExecuteW

shlwapi

ord219
PathFileExistsW

steam_api64

SteamAPI_GetHSteamUser
SteamAPI_Init
SteamAPI_RegisterCallResult
SteamAPI_RegisterCallback
SteamAPI_RestartAppIfNecessary
SteamAPI_RunCallbacks
SteamAPI_Shutdown
SteamAPI_UnregisterCallResult
SteamAPI_UnregisterCallback
SteamInternal_ContextInit
SteamInternal_CreateInterface
SteamInternal_FindOrCreateUserInterface

user32

AdjustWindowRect
BeginPaint
CallWindowProcA
ClientToScreen
CloseClipboard
CreateIconIndirect
CreateWindowExA
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyWindow
DispatchMessageA
DispatchMessageW
DrawTextW
EmptyClipboard
EnableWindow
EndPaint
EnumDisplayMonitors
EnumDisplaySettingsA
FillRect
FindWindowW
GetActiveWindow
GetAsyncKeyState
GetCapture
GetClientRect
GetClipboardData
GetCursor
GetDC
GetDesktopWindow
GetDlgCtrlID
GetDlgItem
GetForegroundWindow
GetGUIThreadInfo
GetGestureInfo
GetKeyState
GetKeyboardLayout
GetMessageA
GetMonitorInfoA
GetMonitorInfoW
GetProcessWindowStation
GetUserObjectInformationW
GetWindowLongA
GetWindowLongPtrA
GetWindowLongW
GetWindowRect
GetWindowTextA
GetWindowTextLengthA
GetWindowTextLengthW
GetWindowTextW
InvalidateRect
IsClipboardFormatAvailable
IsIconic
IsZoomed
LoadCursorA
LoadCursorW
LoadIconA
LoadIconW
MapVirtualKeyW
MessageBeep
MessageBoxA
MessageBoxW
MonitorFromWindow
MoveWindow
MsgWaitForMultipleObjects
OpenClipboard
PeekMessageW
PostMessageW
PostQuitMessage
PtInRect
RegisterClassExW
RegisterClassW
ReleaseCapture
ReleaseDC
ScreenToClient
SendDlgItemMessageA
SendMessageA
SetCapture
SetClassLongPtrW
SetClipboardData
SetCursor
SetCursorPos
SetForegroundWindow
SetRect
SetWindowLongA
SetWindowLongPtrA
SetWindowLongW
SetWindowPos
SetWindowTextA
SetWindowTextW
ShowWindow
TrackMouseEvent
TranslateMessage
UpdateWindow
WaitForInputIdle
wsprintfW

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__RTDynamicCast
__RTtypeid
__current_exception
__current_exception_context
__intrinsic_setjmp
__std_exception_copy
__std_exception_destroy
__std_terminate
__std_type_info_compare
__std_type_info_name
_purecall
_set_purecall_handler
longjmp
memchr
memcmp
memmove
memset
strchr
strrchr
strstr
wcsstr

vcruntime140_1

__CxxFrameHandler4

vpxmt

si_vpx_codec_dec_init_ver
si_vpx_codec_decode
si_vpx_codec_destroy
si_vpx_codec_get_frame
si_vpx_codec_vp8_dx

wininet

HttpAddRequestHeadersW
HttpOpenRequestA
HttpOpenRequestW
HttpQueryInfoA
HttpQueryInfoW
HttpSendRequestA
HttpSendRequestW
InternetCloseHandle
InternetConnectA
InternetConnectW
InternetCrackUrlW
InternetGetConnectedState
InternetOpenA
InternetOpenW
InternetQueryDataAvailable
InternetQueryOptionA
InternetReadFile
InternetSetOptionA
InternetSetOptionW

winmm

timeEndPeriod
timeBeginPeriod

ws2_32

accept
ioctlsocket
WSAGetLastError
WSASetLastError
WSAStartup
WSACleanup
listen
ntohs
__WSAFDIsSet
recv
select
send
bind
setsockopt
socket
closesocket
connect
getpeername
gethostname
getsockname
getsockopt
htonl
htons
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAIoctl
WSAResetEvent
WSAWaitForMultipleEvents
freeaddrinfo
getaddrinfo

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.xcode
Size: 72.7MB - Virtual size: 72.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 10.8MB - Virtual size: 10.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.link
Size: 984KB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.debug
Size: 512B - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.shared
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text1
Size: 512B - Virtual size: 4KB

.rodata
Size: 2KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sbss
Size: 512B - Virtual size: 4KB

.bss
Size: 77KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.udata
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 512B - Virtual size: 616KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.xpdata
Size: 249.9MB - Virtual size: 249.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 512B - Virtual size: 5B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data2
Size: 512B - Virtual size: 182B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.mkdev
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6a31fa4649b53379369626d133f89c36

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

bcrypt

bidstack-cpp-sdk

comdlg32

crypt32

dbghelp

eossdk-win64-shipping

gdi32

icuin65

icuuc65

imm32

kernel32

msvcp140

msvcrt

ntdll

ole32

openal32

pdh

powrprof

shell32

shlwapi

steam_api64

user32

vcruntime140

vcruntime140_1

vpxmt

wininet

winmm

ws2_32

wtsapi32

Exports

Exports

Sections

.xcode Size: 72.7MB - Virtual size: 72.7MB

.reloc Size: 10.8MB - Virtual size: 10.8MB

.link Size: 984KB - Virtual size: 1.9MB

.debug Size: 512B - Virtual size: 1.6MB

.shared Size: 512B - Virtual size: 4KB

.text1 Size: 512B - Virtual size: 4KB

.rodata Size: 2KB - Virtual size: 8KB

.sbss Size: 512B - Virtual size: 4KB

.bss Size: 77KB - Virtual size: 80KB

.udata Size: 176KB - Virtual size: 176KB

.text Size: 512B - Virtual size: 616KB

.xpdata Size: 249.9MB - Virtual size: 249.9MB

.00cfg Size: 14KB - Virtual size: 14KB

.edata Size: 512B - Virtual size: 5B

.data2 Size: 512B - Virtual size: 182B

.didata Size: 15KB - Virtual size: 15KB

.tls Size: 45KB - Virtual size: 44KB

.xdata Size: 1.6MB - Virtual size: 1.6MB

.mkdev Size: 36KB - Virtual size: 36KB

.xcode
Size: 72.7MB - Virtual size: 72.7MB

.reloc
Size: 10.8MB - Virtual size: 10.8MB

.link
Size: 984KB - Virtual size: 1.9MB

.debug
Size: 512B - Virtual size: 1.6MB

.shared
Size: 512B - Virtual size: 4KB

.text1
Size: 512B - Virtual size: 4KB

.rodata
Size: 2KB - Virtual size: 8KB

.sbss
Size: 512B - Virtual size: 4KB

.bss
Size: 77KB - Virtual size: 80KB

.udata
Size: 176KB - Virtual size: 176KB

.text
Size: 512B - Virtual size: 616KB

.xpdata
Size: 249.9MB - Virtual size: 249.9MB

.00cfg
Size: 14KB - Virtual size: 14KB

.edata
Size: 512B - Virtual size: 5B

.data2
Size: 512B - Virtual size: 182B

.didata
Size: 15KB - Virtual size: 15KB

.tls
Size: 45KB - Virtual size: 44KB

.xdata
Size: 1.6MB - Virtual size: 1.6MB

.mkdev
Size: 36KB - Virtual size: 36KB