ACBSP[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ACBSP.exe
Size

45.9MB
MD5

6882e5fad03f4ab040ff1840f2a1cb61
SHA1

288fa3d3f7245d1863cc1ec7e74bcca0f3a98567
SHA256

3afae724cf65b5bb574e6bd4469dec9dbc5f0e97addbfe61ec4c72b77e505905
SHA512

eea7361746c04161bc8eaa8e50504814366dc184ce386a54abfd602b33f8c588ce535d5fe9baca233ca69d8bd56bdb5b2b12896f7c5b879b68a329427bac93fd
SSDEEP

196608:DE0CddAZ+msgJWuQQN4lU0JZPoyU9WBpey0i3rUiAaay9/50YhS2/QLE3qsQM9rl:QMGGWbQsQysOpeji3eovJ/QCQMC1ynUW

Score

1^/10

Malware Config

Signatures

Files

ACBSP.exe
.exe windows:5 windows x86 arch:x86

3950bf31b418d196d787f956b9c53a3f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e1:60:2b:77:e5:e5:12:06:74:61:88:31:62:bc:73
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

12/08/2010, 00:00

Not After

14/07/2011, 23:59

Subject

CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\assassin\1697\assassin\pc-rome\main\output\win32\exe\scimitar_f.pdb

Imports

kernel32

GetPrivateProfileSectionNamesW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleA
SetPriorityClass
GetCurrentProcess
CreateSemaphoreA
Sleep
GetCurrentProcessId
GetCurrentThreadId
CreateFileA
GetModuleFileNameA
SetUnhandledExceptionFilter
FindFirstFileA
SetErrorMode
SetCurrentDirectoryA
GetTickCount
FlushConsoleInputBuffer
GlobalMemoryStatus
ExpandEnvironmentStringsA
TerminateThread
CreateMutexA
ReleaseMutex
GetNumberOfConsoleInputEvents
PeekConsoleInputA
SetConsoleMode
ReadConsoleInputA
GetPrivateProfileIntW
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentDirectoryW
QueryPerformanceFrequency
QueryPerformanceCounter
GetExitCodeProcess
CreateProcessA
ReadFile
GetQueuedCompletionStatus
CloseHandle
CreateIoCompletionPort
GetThreadContext
lstrcmpiA
GlobalAlloc
GlobalFree
GetEnvironmentVariableA
InterlockedExchangeAdd
GetExitCodeThread
WaitForMultipleObjectsEx
SleepEx
CreateEventW
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetProcessHeap
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
SetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetFileType
SetHandleCount
GetLastError
CreateFileW
GetConsoleMode
GetConsoleCP
LCMapStringW
LCMapStringA
GetTimeZoneInformation
WideCharToMultiByte
SetConsoleCtrlHandler
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
FatalAppExitA
HeapDestroy
HeapCreate
TlsFree
HeapReAlloc
CreateThread
ExitThread
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetDriveTypeA
FileTimeToLocalFileTime
FileTimeToSystemTime
GetStartupInfoA
GetCommandLineA
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
RtlUnwind
HeapAlloc
HeapFree
WritePrivateProfileStringA
GetPrivateProfileSectionNamesA
GetPrivateProfileSectionA
GetSystemTimeAsFileTime
GetFullPathNameA
GetSystemTime
UnlockFile
LockFileEx
LockFile
SetEndOfFile
GetTempPathA
FormatMessageA
LocalFree
FlushFileBuffers
GetVersionExA
ExitProcess
InterlockedDecrement
InterlockedIncrement
InterlockedExchange
InterlockedCompareExchange
DisconnectNamedPipe
PeekNamedPipe
DuplicateHandle
MoveFileA
CopyFileA
DeleteFileA
FindNextFileA
RemoveDirectoryA
FindClose
CreateDirectoryA
GetSystemInfo
ResumeThread
SuspendThread
RaiseException
GetFileAttributesA
SetFileAttributesA
GetCurrentDirectoryA
TlsGetValue
GetLocaleInfoA
MultiByteToWideChar
SetFilePointer
VirtualFree
VirtualAlloc
WriteFile
CreateDirectoryW
OutputDebugStringA
GetFileSize
ReadFileEx
WriteFileEx
CancelIo
DeleteFileW
GetOverlappedResult
GetLocalTime
GetLogicalDriveStringsA
SwitchToThread
WaitForSingleObject
OpenThread
SetLastError
VirtualQuery
GetCurrentThread
GetFileTime
GetFileSizeEx
GetProcessTimes
TlsAlloc
TlsSetValue
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
WaitForMultipleObjects
CreateEventA
PulseEvent
SetEvent
ResetEvent
ReleaseSemaphore
SetThreadAffinityMask
GetVersion
SetThreadPriority
SetThreadPriorityBoost
DebugBreak
GetFileInformationByHandle

user32

SetWindowsHookExA
wsprintfW
CharUpperBuffW
CharLowerBuffW
MessageBoxA
EnumDisplayDevicesA
DispatchMessageA
TranslateMessage
PeekMessageA
EnumDisplayMonitors
GetWindowRect
EnumDisplayDevicesW
IsWindowVisible
GetSystemMetrics
ShowCursor
SystemParametersInfoA
CallNextHookEx
DefWindowProcA
GetAsyncKeyState
IsIconic
PostQuitMessage
DestroyWindow
UpdateWindow
IsWindow
GetForegroundWindow
UnhookWindowsHookEx
ShowWindow
CreateWindowExA
RegisterClassExA
LoadIconA
LoadImageA
LoadCursorA
MessageBoxW

advapi32

RegQueryValueExA
RegDeleteKeyA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
RegCreateKeyA

shell32

SHGetSpecialFolderPathW
SHGetFolderPathA
ShellExecuteA
SHCreateDirectoryExW

ole32

CoInitializeEx
CoInitialize
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
CoTaskMemFree

imagehlp

StackWalk64
SymGetModuleInfo64
SymGetModuleBase
SymFunctionTableAccess
StackWalk
SymGetLineFromAddr
SymFunctionTableAccess64
SymGetSymFromAddr
SymCleanup
SymInitialize
SymSetOptions
SymGetOptions
SymGetModuleInfo
UnDecorateSymbolName

binkw32

_BinkSetSoundSystem@8
_BinkWait@4
_BinkDoFrame@4
_BinkShouldSkip@4
_BinkNextFrame@4
_BinkSetVolume@12
_BinkGoto@12
_BinkPause@8
_BinkClose@4
_BinkSetMemory@8
_BinkCopyToBuffer@28
_BinkCopyToBufferRect@44
_BinkGetFrameBuffersInfo@8
_BinkOpen@8
_BinkOpenDirectSound@4
_BinkSetSoundTrack@8

d3d9

Direct3DCreate9

d3dx9_42

D3DXGetShaderConstantTableEx
D3DXCheckTextureRequirements

dinput8

DirectInput8Create

ws2_32

connect
accept
WSAStartup
setsockopt
ntohl
__WSAFDIsSet
inet_ntoa
getpeername
sendto
send
recvfrom
socket
recv
WSAIoctl
select
ioctlsocket
WSAGetLastError
closesocket
WSACleanup
WSARecvFrom
WSACreateEvent
WSACloseEvent
WSAResetEvent
listen
getsockopt
WSASetLastError
shutdown
gethostbyname
inet_addr
WSASendTo
htons
WSAAsyncSelect
gethostname
ntohs
getsockname
WSAGetOverlappedResult
WSAWaitForMultipleEvents
WSASocketA
WSAConnect
htonl
WSAEventSelect
bind

ubiorbitapi_r2_loader

??1OrbitClient@orbitclient@mg@@QAE@XZ
?GetSavegameId@SavegameInfo@orbitclient@mg@@QAEIXZ
?GetSize@SavegameInfo@orbitclient@mg@@QAEIXZ
?GetName@SavegameInfo@orbitclient@mg@@QAEPBGXZ
?GetSavegameList@OrbitClient@orbitclient@mg@@QAEXIPAVIGetSavegameListListener@23@I@Z
?GetRequestUniqueId@OrbitClient@orbitclient@mg@@QAEIXZ
?StartLauncher@OrbitClient@orbitclient@mg@@QAE_NIIPBD0@Z
?GetInstallationErrorString@OrbitClient@orbitclient@mg@@QAEPAGPBD@Z
?GetInstallationErrorNum@OrbitClient@orbitclient@mg@@QAEIXZ
??0OrbitClient@orbitclient@mg@@QAE@XZ
?GetLoginDetails@OrbitClient@orbitclient@mg@@QAEXIPAVIGetLoginDetailsListener@23@@Z
?Close@SavegameWriter@orbitclient@mg@@QAEX_N@Z
?Write@SavegameWriter@orbitclient@mg@@QAEXIPAVISavegameWriteListener@23@PAXI@Z
?SetName@SavegameWriter@orbitclient@mg@@QAE_NPAG@Z
?GetSavegameWriter@OrbitClient@orbitclient@mg@@QAEXIPAVIGetSavegameWriterListener@23@II_N@Z
?RemoveSavegame@OrbitClient@orbitclient@mg@@QAEXIPAVIRemoveSavegameListener@23@II@Z
?GetLocText@OrbitClient@orbitclient@mg@@QAEPBGPBGPBD@Z
?Close@SavegameReader@orbitclient@mg@@QAEXXZ
?Read@SavegameReader@orbitclient@mg@@QAEXIPAVISavegameReadListener@23@IPAXI@Z
?GetSavegameReader@OrbitClient@orbitclient@mg@@QAEXIPAVIGetSavegameReaderListener@23@II@Z
?Update@OrbitClient@orbitclient@mg@@QAEXXZ

wininet

InternetSetCookieExA
InternetGetCookieExA

winmm

timeGetTime

xinput1_3

ord4
ord2
ord3

oleaut32

SysAllocString
SysFreeString

dbghelp

MiniDumpWriteDump

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

iphlpapi

GetAdaptersAddresses
GetIfEntry
GetBestInterface

Exports

Exports

?AddPlayerMotionDevice@MotionEngine@AK@@YA?AW4AKRESULT@@EKKPAX@Z
?Break@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?BypassEnvironment@SoundEngine@AK@@YA?AW4AKRESULT@@K_N@Z
?CancelBankCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CancelEventCallback@SoundEngine@AK@@YAXK@Z
?CancelEventCallbackCookie@SoundEngine@AK@@YAXPAX@Z
?CheckPoolId@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ClearBanks@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ClearPreparedEvents@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?Close@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Create@StreamMgr@AK@@YAPAVIAkStreamMgr@2@ABUAkStreamMgrSettings@@@Z
?CreateDevice@StreamMgr@AK@@YAKABUAkDeviceSettings@@PAVIAkLowLevelIOHook@12@@Z
?CreatePool@MemoryMgr@AK@@YAJPAXKKKK@Z
?CreateVorbisFilePlugin@@YAPAVIAkSoftwareCodec@@PAX@Z
?DestroyDevice@StreamMgr@AK@@YA?AW4AKRESULT@@K@Z
?DestroyPool@MemoryMgr@AK@@YA?AW4AKRESULT@@J@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?ExecuteActionOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WW4AkActionOnEventType@12@IJW4AkCurveInterpolation@@@Z
?Falign@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?Free@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?GetBlock@MemoryMgr@AK@@YAPAXJ@Z
?GetDefaultDeviceSettings@StreamMgr@AK@@YAXAAUAkDeviceSettings@@@Z
?GetDefaultInitSettings@MusicEngine@AK@@YAXAAUAkMusicSettings@@@Z
?GetDefaultInitSettings@SoundEngine@AK@@YAXAAUAkInitSettings@@@Z
?GetDefaultPlatformInitSettings@SoundEngine@AK@@YAXAAUAkPlatformInitSettings@@@Z
?GetDefaultSettings@StreamMgr@AK@@YAXAAUAkStreamMgrSettings@@@Z
?GetFileLocationResolver@StreamMgr@AK@@YAPAVIAkFileLocationResolver@12@XZ
?GetIDFromString@SoundEngine@AK@@YAKPBD@Z
?GetIDFromString@SoundEngine@AK@@YAKPB_W@Z
?GetMaxPools@MemoryMgr@AK@@YAJXZ
?GetNumPools@MemoryMgr@AK@@YAJXZ
?GetPlayingSegmentInfo@MusicEngine@AK@@YA?AW4AKRESULT@@KAAUAkSegmentInfo@@@Z
?GetPoolAttributes@MemoryMgr@AK@@YA?AW4AkMemPoolAttributes@@J@Z
?GetPoolMemoryUsed@MemoryMgr@AK@@YAXJAAUPoolMemInfo@12@@Z
?GetPoolName@MemoryMgr@AK@@YAPA_WJ@Z
?GetPoolStats@MemoryMgr@AK@@YA?AW4AKRESULT@@JAAUPoolStats@12@@Z
?GetSourcePlayPosition@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?GetSpeakerConfiguration@SoundEngine@AK@@YAKXZ
?GetTimeStamp@Monitor@AK@@YAJXZ
?Init@MusicEngine@AK@@YA?AW4AKRESULT@@PAUAkMusicSettings@@@Z
?Init@SoundEngine@AK@@YA?AW4AKRESULT@@PAUAkInitSettings@@PAUAkPlatformInitSettings@@@Z
?IsInitialized@MemoryMgr@AK@@YA_NXZ
?IsInitialized@SoundEngine@AK@@YA_NXZ
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KJ@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1J@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2JAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBXKP6AXKW43@JPAX@Z2AAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WJAAK@Z
?LoadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2JAAK@Z
?LockPlaylist@DynamicSequence@SoundEngine@AK@@YAPAVPlaylist@123@K@Z
?Malign@MemoryMgr@AK@@YAPAXJIK@Z
?Malloc@MemoryMgr@AK@@YAPAXJI@Z
?Open@DynamicSequence@SoundEngine@AK@@YAKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXW4DynamicSequenceType@123@@Z
?Pause@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?Play@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?PlaySourcePlugin@SoundEngine@AK@@YAKKKI@Z
?PostCode@Monitor@AK@@YA?AW4AKRESULT@@W4ErrorCode@12@W4ErrorLevel@12@@Z
?PostEvent@SoundEngine@AK@@YAKKIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostEvent@SoundEngine@AK@@YAKPBDIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostEvent@SoundEngine@AK@@YAKPB_WIKP6AXW4AkCallbackType@@PAUAkCallbackInfo@@@ZPAXKPAUAkExternalSourceInfo@@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PBDW4ErrorLevel@12@@Z
?PostString@Monitor@AK@@YA?AW4AKRESULT@@PB_WW4ErrorLevel@12@@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?PostTrigger@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KP6AXKW43@JPAX@Z2W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@KW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PBDW4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WP6AXKW43@JPAX@Z3W4AkBankContent@12@@Z
?PrepareBank@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PB_WW4AkBankContent@12@@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAKKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPBDKP6AXKW43@JPAX@Z3@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WK@Z
?PrepareEvent@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@PAPB_WKP6AXKW43@JPAX@Z3@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@KPAKKP6AXKW43@JPAX@Z4@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PBDPAPBDKP6AXKW43@JPAX@Z5@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WK@Z
?PrepareGameSyncs@SoundEngine@AK@@YA?AW4AKRESULT@@W4PreparationType@12@W4AkGroupType@@PB_WPAPB_WKP6AXKW43@JPAX@Z5@Z
?RegisterCodec@SoundEngine@AK@@YA?AW4AKRESULT@@KKP6APAVIAkSoftwareCodec@@PAX@Z1@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?RegisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@IPBD@Z
?RegisterMotionDevice@MotionEngine@AK@@YAXKKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@Z@Z
?RegisterPlugin@SoundEngine@AK@@YA?AW4AKRESULT@@W4AkPluginType@@KKP6APAVIAkPlugin@2@PAVIAkPluginMemAlloc@2@@ZP6APAVIAkPluginParam@2@1@Z@Z
?ReleaseBlock@MemoryMgr@AK@@YA?AW4AKRESULT@@JPAX@Z
?RemovePlayerMotionDevice@MotionEngine@AK@@YAXEKK@Z
?RenderAudio@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDI@Z
?ResetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WI@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKKPAKK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPBDPAPBDK@Z
?ResolveDialogueEvent@DynamicDialogue@SoundEngine@AK@@YAKPB_WPAPB_WK@Z
?Resume@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@KIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PBDIM_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIJ_N@Z
?SeekOnEvent@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WIM_N@Z
?SetActiveListeners@SoundEngine@AK@@YA?AW4AKRESULT@@IK@Z
?SetAttenuationScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetBankLoadIOSettings@SoundEngine@AK@@YA?AW4AKRESULT@@MD@Z
?SetEnvironmentVolume@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetEnvironmentVolumes@SoundEngine@AK@@YA?AW4AKRESULT@@KABUAkSpeakerVolumes@@@Z
?SetFileLocationResolver@StreamMgr@AK@@YAXPAVIAkFileLocationResolver@12@@Z
?SetGameObjectDryLevelValue@SoundEngine@AK@@YA?AW4AKRESULT@@IM@Z
?SetGameObjectEnvironmentsValues@SoundEngine@AK@@YA?AW4AKRESULT@@IPAUAkEnvironmentValue@@K@Z
?SetListenerPipeline@SoundEngine@AK@@YA?AW4AKRESULT@@K_N0@Z
?SetListenerPosition@SoundEngine@AK@@YA?AW4AKRESULT@@ABUAkListenerPosition@@K@Z
?SetListenerScalingFactor@SoundEngine@AK@@YA?AW4AKRESULT@@KM@Z
?SetListenerSpatialization@SoundEngine@AK@@YA?AW4AKRESULT@@K_NPAUAkSpeakerVolumes@@@Z
?SetLocalOutput@Monitor@AK@@YA?AW4AKRESULT@@KP6AXW4ErrorCode@12@PB_WW4ErrorLevel@12@KI@Z@Z
?SetMonitoring@MemoryMgr@AK@@YA?AW4AKRESULT@@J_N@Z
?SetMultiplePositions@SoundEngine@AK@@YA?AW4AKRESULT@@IPBUAkSoundPosition@@GW4MultiPositionType@12@@Z
?SetObjectObstructionAndOcclusion@SoundEngine@AK@@YA?AW4AKRESULT@@IKMM@Z
?SetPlayerListener@MotionEngine@AK@@YAXEE@Z
?SetPlayerVolume@MotionEngine@AK@@YAXEM@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPBD@Z
?SetPoolName@MemoryMgr@AK@@YA?AW4AKRESULT@@JPB_W@Z
?SetPosition@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetPositionInternal@SoundEngine@AK@@YA?AW4AKRESULT@@IABUAkSoundPosition@@K@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@KMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PBDMI@Z
?SetRTPCValue@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WMI@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@KK@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0@Z
?SetState@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@KKI@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PBD0I@Z
?SetSwitch@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W0I@Z
?SetVolumeThreshold@SoundEngine@AK@@YA?AW4AKRESULT@@M@Z
?StartOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@PB_W@Z
?Stop@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?StopAll@SoundEngine@AK@@YAXI@Z
?StopOutputCapture@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?StopPlayingID@SoundEngine@AK@@YAXK@Z
?StopSourcePlugin@SoundEngine@AK@@YA?AW4AKRESULT@@KKK@Z
?Term@MemoryMgr@AK@@YAXXZ
?Term@MusicEngine@AK@@YAXXZ
?Term@SoundEngine@AK@@YAXXZ
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KP6AXKW43@JPAX@Z1@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@KPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PBDPAJ@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WP6AXKW43@JPAX@Z2@Z
?UnloadBank@SoundEngine@AK@@YA?AW4AKRESULT@@PB_WPAJ@Z
?UnlockPlaylist@DynamicSequence@SoundEngine@AK@@YA?AW4AKRESULT@@K@Z
?UnregisterAllGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@XZ
?UnregisterGameObj@SoundEngine@AK@@YA?AW4AKRESULT@@I@Z
?m_pStreamMgr@IAkStreamMgr@AK@@1PAV12@A

Sections

.text
Size: 31.9MB - Virtual size: 31.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.2MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 137B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3950bf31b418d196d787f956b9c53a3f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

e1:60:2b:77:e5:e5:12:06:74:61:88:31:62:bc:73Certificate

Extended Key Usages

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91Certificate

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

imagehlp

binkw32

d3d9

d3dx9_42

dinput8

ws2_32

ubiorbitapi_r2_loader

wininet

winmm

xinput1_3

oleaut32

dbghelp

version

iphlpapi

Exports

Exports

Sections

.text Size: 31.9MB - Virtual size: 31.9MB

.rdata Size: 4.0MB - Virtual size: 4.0MB

.data Size: 2.2MB - Virtual size: 2.6MB

.tls Size: 512B - Virtual size: 137B

.data1 Size: 1KB - Virtual size: 1KB

.rsrc Size: 6.0MB - Virtual size: 6.0MB

.reloc Size: 1.8MB - Virtual size: 1.8MB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

e1:60:2b:77:e5:e5:12:06:74:61:88:31:62:bc:73
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

.text
Size: 31.9MB - Virtual size: 31.9MB

.rdata
Size: 4.0MB - Virtual size: 4.0MB

.data
Size: 2.2MB - Virtual size: 2.6MB

.tls
Size: 512B - Virtual size: 137B

.data1
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 6.0MB - Virtual size: 6.0MB

.reloc
Size: 1.8MB - Virtual size: 1.8MB