D:\SourceCode\gc3.gpuswitch\NR2301_production_V1.5\Service\ServiceSDK\Release\GPUSwitchPlugin\GPUSwitchPlugin.pdb
Static task
static1
Behavioral task
behavioral1
Sample
80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb.dll
Resource
win10v2004-20240802-en
General
-
Target
80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb
-
Size
353KB
-
MD5
eea4966246d8fa0bdad6ffbbd3f642fa
-
SHA1
0ff4d87ac58f8d38b0543b68ab132d453d67aa07
-
SHA256
80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb
-
SHA512
722aba2b43806a7b3e9cffcda5e1f858cb0d1d917443e9fcf8dccbc7f0484157612d2618b7557f1af629c120f587a55ba3f76dffd21ab99c7c26214a6c5810b6
-
SSDEEP
6144:yAob5PdLGdnxTCeyHHAN3XnPY896gx4gOm7gteB3fi:WbDGFx2Zgxo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb
Files
-
80d690710fab8e82a77559f4449088dc78bd92f778b032de16b93119832f7edb.dll windows:6 windows x64 arch:x64
7a8ba659700e666d9a948adda1130f8d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
armourycratese.toolkit
?SetThreadCrashHandlers@@YAXAEBU_GUID@@PEB_W1@Z
shlwapi
PathRemoveFileSpecW
PathAddBackslashW
PathFileExistsW
PathAddBackslashA
PathAppendW
StrCmpW
SHDeleteKeyW
PathAppendA
kernel32
WaitForSingleObject
CreateFileW
GetFileAttributesW
FindFirstChangeNotificationW
OpenProcess
HeapSize
SetFileAttributesW
GetPrivateProfileStringW
Sleep
K32GetModuleBaseNameW
GetSystemDirectoryA
TerminateThread
FindCloseChangeNotification
DeleteFileW
HeapReAlloc
CloseHandle
GetPackagePathByFullName
CreateThread
GetLocalTime
K32EnumProcesses
HeapDestroy
LocalFree
FreeLibrary
WideCharToMultiByte
QueryFullProcessImageNameW
K32EnumProcessModules
K32QueryWorkingSet
FindClose
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetUserDefaultUILanguage
GetProcessId
GetModuleFileNameW
GetPackageFamilyName
TerminateProcess
DeviceIoControl
GetPrivateProfileIntW
GetCurrentProcess
FindNextFileW
GetPackageId
WritePrivateProfileStringW
FindFirstFileW
GetPackageFullName
GetModuleHandleW
DeleteCriticalSection
GetLastError
InitializeCriticalSectionEx
GetProcAddress
LoadLibraryExW
SystemTimeToFileTime
GetProcessHeap
FileTimeToLocalFileTime
HeapAlloc
LoadLibraryW
FileTimeToSystemTime
OutputDebugStringW
GetSystemDirectoryW
lstrcmpA
SetLastError
HeapFree
InitializeSListHead
MultiByteToWideChar
LocalAlloc
GetModuleFileNameA
GetFullPathNameW
VerSetConditionMask
VerifyVersionInfoW
GetExitCodeProcess
user32
LoadCursorW
CreateWindowExW
SendMessageW
EnumDisplayDevicesW
PostMessageW
DefWindowProcW
FindWindowW
LoadIconW
GetSystemMetrics
GetWindowLongPtrW
RegisterClassExW
wsprintfW
ShowWindow
DispatchMessageW
SetDisplayConfig
UpdateWindow
GetMessageW
QueryDisplayConfig
RegisterWindowMessageW
TranslateMessage
SetWindowLongPtrW
GetDisplayConfigBufferSizes
advapi32
AllocateAndInitializeSid
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
DuplicateTokenEx
GetUserNameW
BuildTrusteeWithSidW
GetLengthSid
CreateProcessAsUserW
FreeSid
OpenProcessToken
DeleteAce
GetNamedSecurityInfoW
SetTokenInformation
RegCreateKeyExW
GetAce
EqualSid
SetNamedSecurityInfoW
shell32
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CoUninitialize
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
oleaut32
VariantInit
SysAllocStringLen
VariantClear
SysFreeString
SysAllocString
gpuswitch_cli_wrapper
?CLR_KillProcess@WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAAHPEAUIAEFLibrary@@PEAVAsusValueSet@@1PEAX@Z
?CLR_LaunchGPUSwitchDialog@WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAAHPEAUIAEFLibrary@@PEAVAsusValueSet@@1PEAX@Z
?CLR_LaunchGPUSwitchTutorial@WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAAHPEAUIAEFLibrary@@PEAVAsusValueSet@@1PEAX@Z
?CLR_EnumerateProcess@WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAAHPEAUIAEFLibrary@@PEAVAsusValueSet@@1PEAX@Z
??0WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAA@XZ
msvcp140
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
_Query_perf_frequency
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
_Unlink
_Remove_dir
_Close_dir
_Open_dir
_Lstat
_Stat
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?_Winerror_message@std@@YAKKPEADK@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
crypt32
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose
CryptDecodeObject
CertGetNameStringW
CertFindCertificateInStore
wintrust
WinVerifyTrust
setupapi
SetupDiCallClassInstaller
SetupDiSetClassInstallParamsW
SetupDiGetClassDevsW
SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiClassGuidsFromNameW
userenv
CreateEnvironmentBlock
externalgpuconfighelper2
?GetEGPUID@CDockingController@@QEAAJPEAU_EGC_GPUID2@@@Z
?Uninitialize@CDockingController@@QEAAHPEAX@Z
?Initialize@CDockingController@@QEAAHPEAXP6AX0@Z@Z
?Get@CDockingController@@SAPEAV1@XZ
vcruntime140
memset
memmove
memcpy
_CxxThrowException
__std_type_info_destroy_list
wcsstr
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
wcsrchr
_purecall
memcmp
__C_specific_handler
__std_terminate
__CxxFrameHandler3
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfwprintf
fclose
fflush
fputc
fgetc
_get_stream_buffer_pointers
_fseeki64
fread
fsetpos
ungetc
__stdio_common_vfprintf
setvbuf
fgetpos
__stdio_common_vswprintf
fwrite
__stdio_common_vsscanf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf_s
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
wcscat_s
wcsncpy_s
isdigit
strncmp
isalpha
_stricmp
_wcsicmp
towlower
wcscpy_s
_wcsnicmp
strncpy_s
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
system
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
api-ms-win-crt-heap-l1-1-0
_callnewh
free
malloc
api-ms-win-crt-locale-l1-1-0
setlocale
api-ms-win-crt-filesystem-l1-1-0
remove
_wrmdir
_wsplitpath_s
_wmkdir
_lock_file
_unlock_file
api-ms-win-crt-convert-l1-1-0
_itow_s
mbstowcs
wcstol
api-ms-win-crt-time-l1-1-0
_time64
Exports
Exports
??4WrapperForGPUSwitchConfigEditor@CLR_Library@@QEAAAEAV01@AEBV01@@Z
QueryInterfaceVersion
QueryLibrary
Sections
.text Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 130KB - Virtual size: 130KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 620B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ