HXSoftware[.]zip | Triage™

resource
unpack001/HXSoftware.exe
unpack001/hx64.dll
unpack001/vk_swiftshader.dll
unpack001/vulkan-1.dll

HXSoftware.zip

SHA256 4887920ef09966bfd09a3930b12912f64c22d52eb9c11f228581de1aab9e5dae
MD5 e2394cb6a06a1169645c367c9fda81e1
SHA1 c969a42a9953d0f3f04b29d26c500ac4f0f0dd9a
SHA512 409eb4126ff7339610ebcc4d6933f3ecb6b7d2d941d85f95bae9bd99749c4a7fb214c7ef4692ead79a960fe5e2389341b173bb201807dbdd20bfde261c365a6d
SSDEEP 196608:gtKdc26Dh9nqyg+b7IkYCUAIW9yWDGKJsq/6cyFNPkApKvX2VyCF:8KNSh9m+b7PYxAFy4GEHyrP06yI
MD5 SHA1 SHA512 SSDEEP

HXSoftware.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fbc4058b92d9bc4dda2dbc64cc61d0b3f193415aad15c362a5d87c90ca1be30b
MD5 b5e479d3926b22b59926050c29c4e761
SHA1 a456cc6993d12abe6c44f2d453d7ae5da2029e24
SHA512 09d1aa9b9d7905c37b76a6b697de9f2230219e7f51951654de73b0ad47b8bb8f93cf63aa4688a958477275853b382a2905791db9dcb186cad7f96015b2909fe8
SSDEEP 192:q+yk9cqvjX3xszdzztCbxbsIcaqc2Ng5vGIcaBSNtUqOwciQjdv:Tyk9Hv1O/Cbxbbcaqc2NidcaANt/dcio
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

12750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

hx64.dll

IMPHASH eb523a1a6018f1d54403a048e7843b26
SHA256 bffb9e1b30a3db4655d29f0671caf6e50d10f047329abdb99bbb81c4c9c668cc
MD5 4b8bb1d72dd7d6a3233bfbd7757aad8b
SHA1 518a11b90fc87b0fc19bc0fec52dc048ca378459
SHA512 a45e4c66f1395e34c81b481795a24aebaace684e349e02bc14b8c00d3587e5f7ddd57a8b36810b751e25244cc832a207bcd7b077bf6154c8658d778f2adbb212
SSDEEP 24576:oOrp3UZ5Uzp7GCJOE5avlSGnwZ4MuJDCIzUvOh1Ot:oOrpWe7GeOxMGwZ45DHic
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

774384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

chrome_elf.dll.pdb

kernel32

AcquireSRWLockExclusive AddVectoredExceptionHandler CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileW CreateMutexW CreateNamedPipeW CreateProcessW CreateRemoteThread CreateThread DeleteCriticalSection DeleteFileW DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileTime GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetVersionExW GetWindowsDirectoryW InitOnceExecuteOnce InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32EnumProcessModules K32GetMappedFileNameW K32GetModuleFileNameExA K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalAlloc LocalFree LockFileEx MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW RemoveVectoredExceptionHandler RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetEnvironmentVariableW SetEvent SetFilePointerEx SetLastError SetNamedPipeHandleState SetProcessMitigationPolicy SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SleepEx SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TransactNamedPipe TryAcquireSRWLockExclusive UnhandledExceptionFilter UnlockFileEx UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualProtectEx VirtualQuery WaitForSingleObject WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WerRegisterRuntimeExceptionModule WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory lstrcmpiA lstrlenA

ntdll

NtClose NtCreateKey NtDeleteKey NtOpenKeyEx NtQueryValueKey NtSetValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlInitUnicodeString

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

971KB

Virtual Size

971KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

201KB

Virtual Size

200KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

60KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

34KB

Virtual Size

33KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.crthunk

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

362B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

304B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

resources.pak

SHA256 43a70ef718619fa77560983e1ad246ac1133042fb2fc6675a3eaf71de12266b4
MD5 a3248235d9a5c412eaff789fc318367c
SHA1 46265bfd6ccf55370064307ad4e3df8770a1e410
SHA512 f3308c31a591301784d2a24e9b3a9e8d64189dfb279851c23b44a478b8a450ae0a9ea15c756b489235dcf1a0322060bae9b6a95d0ce82309e60d24232f7e3da0
SSDEEP 196608:xEIeZpyF1gBGOXxIuMwGDK7Skr6/2oj2snmm4bdr2aN:leZp+MBIup97SkrU2AB4Jh
MD5 SHA1 SHA512 SSDEEP

v8_context_snapshot.bin

SHA256 38bd3610023c1f6bae1452096bdc3298a90baea4438afa08a74584aa75f997f1
MD5 bbc5480d9f231e5d0564edbb2a53284c
SHA1 87a6ea5db959ed7b038cc6edb2676263576490de
SHA512 d75aaa676710b1629c3e99cd60e185e5bc67e8d9f65d3f875daa88b7fc229c430fa52d02d799a703488375be39c7ea268170e5bd21cd9ccfbc8dcd86234e6168
SSDEEP 6144:gPm2hiHvnyB2vD5zwqIH2jjHnL3GWaa/rTKaU8STvx/scy7syEI92WkPZ2Ak:KkHPdvLHjGWaarO3/rasg2lPk
MD5 SHA1 SHA512 SSDEEP

vk_swiftshader.dll

IMPHASH cff2e3bc77a72caa699e7cda3a0c38d8
SHA256 d81546bce0c5671f4101da450b62dcdd98c7c71f063b9863fcfa17c9f20f4ca9
MD5 b0e40a40b53d79bb04c29ce593ef8c13
SHA1 4820c6ff151578dc5cc37eea478a2a622325237d
SHA512 08aab10fc45b6fb3d82201ddba154c132661f12fa059f6bddb4f8a4711badc9f9004fdafd12a2df7de69c49be797d19dacf9816ef19f5e10bd0070ed556c28b7
SSDEEP 49152:C11wwg+2zcmMotjXHCT1H8mcKdPricwQ+XK2fDZEAjPe9pZzDs9VafQKkqo66lKK:m1rGM2t14ZzmVqQ3t3
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

4052608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

vk_swiftshader.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW ConvertFiberToThread ConvertThreadToFiberEx CreateFiberEx CreateFileW CreateRemoteThreadEx CreateThread DeleteCriticalSection DeleteFiber DeleteFileW DeleteProcThreadAttributeList EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetLogicalProcessorInformationEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RemoveDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetConsoleTextAttribute SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SwitchToFiber SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

GetClientRect GetDC IsWindow ReleaseDC

gdi32

StretchDIBits

vkAcquireNextImage2KHR vkAcquireNextImageKHR vkAllocateCommandBuffers vkAllocateDescriptorSets vkAllocateMemory vkBeginCommandBuffer vkBindBufferMemory vkBindBufferMemory2 vkBindImageMemory vkBindImageMemory2 vkCmdBeginQuery vkCmdBeginRenderPass vkCmdBeginRenderPass2 vkCmdBeginRendering vkCmdBindDescriptorSets vkCmdBindIndexBuffer vkCmdBindPipeline vkCmdBindVertexBuffers vkCmdBindVertexBuffers2 vkCmdBlitImage vkCmdBlitImage2 vkCmdClearAttachments vkCmdClearColorImage vkCmdClearDepthStencilImage vkCmdCopyBuffer vkCmdCopyBuffer2 vkCmdCopyBufferToImage vkCmdCopyBufferToImage2 vkCmdCopyImage vkCmdCopyImage2 vkCmdCopyImageToBuffer vkCmdCopyImageToBuffer2 vkCmdCopyQueryPoolResults vkCmdDispatch vkCmdDispatchBase vkCmdDispatchIndirect vkCmdDraw vkCmdDrawIndexed vkCmdDrawIndexedIndirect vkCmdDrawIndexedIndirectCount vkCmdDrawIndirect vkCmdDrawIndirectCount vkCmdEndQuery vkCmdEndRenderPass vkCmdEndRenderPass2 vkCmdEndRendering vkCmdExecuteCommands vkCmdFillBuffer vkCmdNextSubpass vkCmdNextSubpass2 vkCmdPipelineBarrier vkCmdPipelineBarrier2 vkCmdPushConstants vkCmdResetEvent vkCmdResetEvent2 vkCmdResetQueryPool vkCmdResolveImage vkCmdResolveImage2 vkCmdSetBlendConstants vkCmdSetCullMode vkCmdSetDepthBias vkCmdSetDepthBiasEnable vkCmdSetDepthBounds vkCmdSetDepthBoundsTestEnable vkCmdSetDepthCompareOp vkCmdSetDepthTestEnable vkCmdSetDepthWriteEnable vkCmdSetDeviceMask vkCmdSetEvent vkCmdSetEvent2 vkCmdSetFrontFace vkCmdSetLineWidth vkCmdSetPrimitiveRestartEnable vkCmdSetPrimitiveTopology vkCmdSetRasterizerDiscardEnable vkCmdSetScissor vkCmdSetScissorWithCount vkCmdSetStencilCompareMask vkCmdSetStencilOp vkCmdSetStencilReference vkCmdSetStencilTestEnable vkCmdSetStencilWriteMask vkCmdSetViewport vkCmdSetViewportWithCount vkCmdUpdateBuffer vkCmdWaitEvents vkCmdWaitEvents2 vkCmdWriteTimestamp vkCmdWriteTimestamp2 vkCreateBuffer vkCreateBufferView vkCreateCommandPool vkCreateComputePipelines vkCreateDescriptorPool vkCreateDescriptorSetLayout vkCreateDescriptorUpdateTemplate vkCreateDevice vkCreateEvent vkCreateFence vkCreateFramebuffer vkCreateGraphicsPipelines vkCreateImage vkCreateImageView vkCreateInstance vkCreatePipelineCache vkCreatePipelineLayout vkCreatePrivateDataSlot vkCreateQueryPool vkCreateRenderPass vkCreateRenderPass2 vkCreateSampler vkCreateSamplerYcbcrConversion vkCreateSemaphore vkCreateShaderModule vkCreateSwapchainKHR vkCreateWin32SurfaceKHR vkDestroyBuffer vkDestroyBufferView vkDestroyCommandPool vkDestroyDescriptorPool vkDestroyDescriptorSetLayout vkDestroyDescriptorUpdateTemplate vkDestroyDevice vkDestroyEvent vkDestroyFence vkDestroyFramebuffer vkDestroyImage vkDestroyImageView vkDestroyInstance vkDestroyPipeline vkDestroyPipelineCache vkDestroyPipelineLayout vkDestroyPrivateDataSlot vkDestroyQueryPool vkDestroyRenderPass vkDestroySampler vkDestroySamplerYcbcrConversion vkDestroySemaphore vkDestroyShaderModule vkDestroySurfaceKHR vkDestroySwapchainKHR vkDeviceWaitIdle vkEndCommandBuffer vkEnumerateDeviceExtensionProperties vkEnumerateDeviceLayerProperties vkEnumerateInstanceExtensionProperties vkEnumerateInstanceLayerProperties vkEnumerateInstanceVersion vkEnumeratePhysicalDeviceGroups vkEnumeratePhysicalDevices vkFlushMappedMemoryRanges vkFreeCommandBuffers vkFreeDescriptorSets vkFreeMemory vkGetBufferDeviceAddress vkGetBufferMemoryRequirements vkGetBufferMemoryRequirements2 vkGetBufferOpaqueCaptureAddress vkGetDescriptorSetLayoutSupport vkGetDeviceBufferMemoryRequirements vkGetDeviceGroupPeerMemoryFeatures vkGetDeviceGroupPresentCapabilitiesKHR vkGetDeviceGroupSurfacePresentModesKHR vkGetDeviceImageMemoryRequirements vkGetDeviceImageSparseMemoryRequirements vkGetDeviceMemoryCommitment vkGetDeviceMemoryOpaqueCaptureAddress vkGetDeviceProcAddr vkGetDeviceQueue vkGetDeviceQueue2 vkGetEventStatus vkGetFenceStatus vkGetImageMemoryRequirements vkGetImageMemoryRequirements2 vkGetImageSparseMemoryRequirements vkGetImageSparseMemoryRequirements2 vkGetImageSubresourceLayout vkGetInstanceProcAddr vkGetPhysicalDeviceExternalBufferProperties vkGetPhysicalDeviceExternalFenceProperties vkGetPhysicalDeviceExternalSemaphoreProperties vkGetPhysicalDeviceFeatures vkGetPhysicalDeviceFeatures2 vkGetPhysicalDeviceFormatProperties vkGetPhysicalDeviceFormatProperties2 vkGetPhysicalDeviceImageFormatProperties vkGetPhysicalDeviceImageFormatProperties2 vkGetPhysicalDeviceMemoryProperties vkGetPhysicalDeviceMemoryProperties2 vkGetPhysicalDevicePresentRectanglesKHR vkGetPhysicalDeviceProperties vkGetPhysicalDeviceProperties2 vkGetPhysicalDeviceQueueFamilyProperties vkGetPhysicalDeviceQueueFamilyProperties2 vkGetPhysicalDeviceSparseImageFormatProperties vkGetPhysicalDeviceSparseImageFormatProperties2 vkGetPhysicalDeviceSurfaceCapabilities2KHR vkGetPhysicalDeviceSurfaceCapabilitiesKHR vkGetPhysicalDeviceSurfaceFormats2KHR vkGetPhysicalDeviceSurfaceFormatsKHR vkGetPhysicalDeviceSurfacePresentModesKHR vkGetPhysicalDeviceSurfaceSupportKHR vkGetPhysicalDeviceToolProperties vkGetPhysicalDeviceWin32PresentationSupportKHR vkGetPipelineCacheData vkGetPrivateData vkGetQueryPoolResults vkGetRenderAreaGranularity vkGetSemaphoreCounterValue vkGetSwapchainImagesKHR vkInvalidateMappedMemoryRanges vkMapMemory vkMergePipelineCaches vkQueueBindSparse vkQueuePresentKHR vkQueueSubmit vkQueueSubmit2 vkQueueWaitIdle vkReleaseSwapchainImagesEXT vkResetCommandBuffer vkResetCommandPool vkResetDescriptorPool vkResetEvent vkResetFences vkResetQueryPool vkSetEvent vkSetPrivateData vkSignalSemaphore vkTrimCommandPool vkUnmapMemory vkUpdateDescriptorSetWithTemplate vkUpdateDescriptorSets vkWaitForFences vkWaitSemaphores vk_icdEnumerateAdapterPhysicalDevices vk_icdGetInstanceProcAddr vk_icdGetPhysicalDeviceProcAddr vk_icdNegotiateLoaderICDInterfaceVersion

Name

.text

Size

4.1MB

Virtual Size

4.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

835KB

Virtual Size

835KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

101KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

86B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

vulkan-1.dll

IMPHASH 1cca81ae4aa193b35ac4e7a2c9d50b0f
SHA256 9bb9e4518b12181adabeef90cda8be63b14c48d5530edd09d3f94d6bf5dc9637
MD5 909a565934a345ba9e03c9fee41b01b0
SHA1 0637b6a8e8dcd1d8921b70fd287497500d6e8414
SHA512 49a7e2dc30c62ced4e677cf9da0c0470e6c0a630527c406bf1bf389e71c5f3fce59ed15c1359f94abbf037ff27ed704386133ab5b3e63f4f7e92d526a5e3dd66
SSDEEP 24576:AZZuQ8uG53XLvUMbJg6Z5W1DYsHq6g3P0zAk7J1eXdoG:KYL53XLvvJg6Z5W1DYsHq6g3P0zAk7J
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

470880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

vulkan-1.dll.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDateFormatW GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesExW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetDllDirectoryA SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation OpenProcessToken RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA

cfgmgr32

CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Sibling CM_Locate_DevNodeW CM_Open_DevNode_Key

vkAcquireNextImage2KHR vkAcquireNextImageKHR vkAllocateCommandBuffers vkAllocateDescriptorSets vkAllocateMemory vkBeginCommandBuffer vkBindBufferMemory vkBindBufferMemory2 vkBindImageMemory vkBindImageMemory2 vkCmdBeginQuery vkCmdBeginRenderPass vkCmdBeginRenderPass2 vkCmdBeginRendering vkCmdBindDescriptorSets vkCmdBindIndexBuffer vkCmdBindPipeline vkCmdBindVertexBuffers vkCmdBindVertexBuffers2 vkCmdBlitImage vkCmdBlitImage2 vkCmdClearAttachments vkCmdClearColorImage vkCmdClearDepthStencilImage vkCmdCopyBuffer vkCmdCopyBuffer2 vkCmdCopyBufferToImage vkCmdCopyBufferToImage2 vkCmdCopyImage vkCmdCopyImage2 vkCmdCopyImageToBuffer vkCmdCopyImageToBuffer2 vkCmdCopyQueryPoolResults vkCmdDispatch vkCmdDispatchBase vkCmdDispatchIndirect vkCmdDraw vkCmdDrawIndexed vkCmdDrawIndexedIndirect vkCmdDrawIndexedIndirectCount vkCmdDrawIndirect vkCmdDrawIndirectCount vkCmdEndQuery vkCmdEndRenderPass vkCmdEndRenderPass2 vkCmdEndRendering vkCmdExecuteCommands vkCmdFillBuffer vkCmdNextSubpass vkCmdNextSubpass2 vkCmdPipelineBarrier vkCmdPipelineBarrier2 vkCmdPushConstants vkCmdResetEvent vkCmdResetEvent2 vkCmdResetQueryPool vkCmdResolveImage vkCmdResolveImage2 vkCmdSetBlendConstants vkCmdSetCullMode vkCmdSetDepthBias vkCmdSetDepthBiasEnable vkCmdSetDepthBounds vkCmdSetDepthBoundsTestEnable vkCmdSetDepthCompareOp vkCmdSetDepthTestEnable vkCmdSetDepthWriteEnable vkCmdSetDeviceMask vkCmdSetEvent vkCmdSetEvent2 vkCmdSetFrontFace vkCmdSetLineWidth vkCmdSetPrimitiveRestartEnable vkCmdSetPrimitiveTopology vkCmdSetRasterizerDiscardEnable vkCmdSetScissor vkCmdSetScissorWithCount vkCmdSetStencilCompareMask vkCmdSetStencilOp vkCmdSetStencilReference vkCmdSetStencilTestEnable vkCmdSetStencilWriteMask vkCmdSetViewport vkCmdSetViewportWithCount vkCmdUpdateBuffer vkCmdWaitEvents vkCmdWaitEvents2 vkCmdWriteTimestamp vkCmdWriteTimestamp2 vkCreateBuffer vkCreateBufferView vkCreateCommandPool vkCreateComputePipelines vkCreateDescriptorPool vkCreateDescriptorSetLayout vkCreateDescriptorUpdateTemplate vkCreateDevice vkCreateDisplayModeKHR vkCreateDisplayPlaneSurfaceKHR vkCreateEvent vkCreateFence vkCreateFramebuffer vkCreateGraphicsPipelines vkCreateHeadlessSurfaceEXT vkCreateImage vkCreateImageView vkCreateInstance vkCreatePipelineCache vkCreatePipelineLayout vkCreatePrivateDataSlot vkCreateQueryPool vkCreateRenderPass vkCreateRenderPass2 vkCreateSampler vkCreateSamplerYcbcrConversion vkCreateSemaphore vkCreateShaderModule vkCreateSharedSwapchainsKHR vkCreateSwapchainKHR vkCreateWin32SurfaceKHR vkDestroyBuffer vkDestroyBufferView vkDestroyCommandPool vkDestroyDescriptorPool vkDestroyDescriptorSetLayout vkDestroyDescriptorUpdateTemplate vkDestroyDevice vkDestroyEvent vkDestroyFence vkDestroyFramebuffer vkDestroyImage vkDestroyImageView vkDestroyInstance vkDestroyPipeline vkDestroyPipelineCache vkDestroyPipelineLayout vkDestroyPrivateDataSlot vkDestroyQueryPool vkDestroyRenderPass vkDestroySampler vkDestroySamplerYcbcrConversion vkDestroySemaphore vkDestroyShaderModule vkDestroySurfaceKHR vkDestroySwapchainKHR vkDeviceWaitIdle vkEndCommandBuffer vkEnumerateDeviceExtensionProperties vkEnumerateDeviceLayerProperties vkEnumerateInstanceExtensionProperties vkEnumerateInstanceLayerProperties vkEnumerateInstanceVersion vkEnumeratePhysicalDeviceGroups vkEnumeratePhysicalDevices vkFlushMappedMemoryRanges vkFreeCommandBuffers vkFreeDescriptorSets vkFreeMemory vkGetBufferDeviceAddress vkGetBufferMemoryRequirements vkGetBufferMemoryRequirements2 vkGetBufferOpaqueCaptureAddress vkGetDescriptorSetLayoutSupport vkGetDeviceBufferMemoryRequirements vkGetDeviceGroupPeerMemoryFeatures vkGetDeviceGroupPresentCapabilitiesKHR vkGetDeviceGroupSurfacePresentModesKHR vkGetDeviceImageMemoryRequirements vkGetDeviceImageSparseMemoryRequirements vkGetDeviceMemoryCommitment vkGetDeviceMemoryOpaqueCaptureAddress vkGetDeviceProcAddr vkGetDeviceQueue vkGetDeviceQueue2 vkGetDisplayModeProperties2KHR vkGetDisplayModePropertiesKHR vkGetDisplayPlaneCapabilities2KHR vkGetDisplayPlaneCapabilitiesKHR vkGetDisplayPlaneSupportedDisplaysKHR vkGetEventStatus vkGetFenceStatus vkGetImageMemoryRequirements vkGetImageMemoryRequirements2 vkGetImageSparseMemoryRequirements vkGetImageSparseMemoryRequirements2 vkGetImageSubresourceLayout vkGetInstanceProcAddr vkGetPhysicalDeviceDisplayPlaneProperties2KHR vkGetPhysicalDeviceDisplayPlanePropertiesKHR vkGetPhysicalDeviceDisplayProperties2KHR vkGetPhysicalDeviceDisplayPropertiesKHR vkGetPhysicalDeviceExternalBufferProperties vkGetPhysicalDeviceExternalFenceProperties vkGetPhysicalDeviceExternalSemaphoreProperties vkGetPhysicalDeviceFeatures vkGetPhysicalDeviceFeatures2 vkGetPhysicalDeviceFormatProperties vkGetPhysicalDeviceFormatProperties2 vkGetPhysicalDeviceImageFormatProperties vkGetPhysicalDeviceImageFormatProperties2 vkGetPhysicalDeviceMemoryProperties vkGetPhysicalDeviceMemoryProperties2 vkGetPhysicalDevicePresentRectanglesKHR vkGetPhysicalDeviceProperties vkGetPhysicalDeviceProperties2 vkGetPhysicalDeviceQueueFamilyProperties vkGetPhysicalDeviceQueueFamilyProperties2 vkGetPhysicalDeviceSparseImageFormatProperties vkGetPhysicalDeviceSparseImageFormatProperties2 vkGetPhysicalDeviceSurfaceCapabilities2KHR vkGetPhysicalDeviceSurfaceCapabilitiesKHR vkGetPhysicalDeviceSurfaceFormats2KHR vkGetPhysicalDeviceSurfaceFormatsKHR vkGetPhysicalDeviceSurfacePresentModesKHR vkGetPhysicalDeviceSurfaceSupportKHR vkGetPhysicalDeviceToolProperties vkGetPhysicalDeviceWin32PresentationSupportKHR vkGetPipelineCacheData vkGetPrivateData vkGetQueryPoolResults vkGetRenderAreaGranularity vkGetSemaphoreCounterValue vkGetSwapchainImagesKHR vkInvalidateMappedMemoryRanges vkMapMemory vkMergePipelineCaches vkQueueBindSparse vkQueuePresentKHR vkQueueSubmit vkQueueSubmit2 vkQueueWaitIdle vkResetCommandBuffer vkResetCommandPool vkResetDescriptorPool vkResetEvent vkResetFences vkResetQueryPool vkSetEvent vkSetPrivateData vkSignalSemaphore vkTrimCommandPool vkUnmapMemory vkUpdateDescriptorSetWithTemplate vkUpdateDescriptorSets vkWaitForFences vkWaitSemaphores

Name

.text

Size

650KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

263KB

Virtual Size

262KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

HXSoftware.zip

HXSoftware.exe

mscoree

dotnet

hx64.dll

kernel32

ntdll

version

generic

resources.pak

v8_context_snapshot.bin

vk_swiftshader.dll

kernel32

user32

gdi32

generic

vulkan-1.dll

kernel32

advapi32

cfgmgr32

generic

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

HXSoftware.zip

HXSoftware.exe

mscoree

dotnet

hx64.dll

kernel32

ntdll

version

generic

resources.pak

v8_context_snapshot.bin

vk_swiftshader.dll

kernel32

user32

gdi32

generic

vulkan-1.dll

kernel32

advapi32

cfgmgr32

generic