AGH[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

AGH.exe
Size

17.4MB
MD5

8a937041f37689f31748da2f13944b0a
SHA1

3810eae8f46d9c813b15022b488c0fb04574949a
SHA256

c30327052754afa3c20f4479369d0014b58c381ebffcee24e71d18eeba248c22
SHA512

5946427bf873904327a515de56a2cc02f6aa7db9aca49f516546cd384eeb47563e7048caae87247f51ddb272a429502969402bc6d267c8d1833c4a49634eb78e
SSDEEP

393216:dTHtu/KhKDsT6KgrJ5LvxUw/FYI3ehP1xv1zdAgs6tz9zqUFxxwKFnIC:c76h5qZK2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AGH.exe

Files

AGH.exe
.exe windows:5 windows x86 arch:x86

50e57fe09abdcc2e55ceaa3b20bbd1da

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\buildslave\unity\build\build\WindowsStandaloneSupport\Variations\win32_nondevelopment_mono\player_win_x86.pdb

Imports

hid

HidP_GetButtonCaps
HidP_GetCaps
HidD_GetProductString
HidD_GetPreparsedData
HidP_MaxDataListLength
HidP_GetData
HidD_FreePreparsedData
HidP_GetValueCaps
HidD_GetHidGuid

kernel32

GetLocalTime
GetTimeZoneInformation
LocalFree
TerminateThread
GetSystemInfo
GetSystemTimeAsFileTime
CreateFileW
InitializeCriticalSection
ResetEvent
ReadFile
SetFilePointerEx
WriteFile
SetFilePointer
SetEndOfFile
GetFileAttributesExW
SetFileAttributesW
GetFileAttributesW
CopyFileW
MoveFileExW
FindClose
FindNextFileW
FindFirstFileW
FindFirstFileExW
LoadLibraryExW
InterlockedIncrement
InterlockedDecrement
CreateEventW
GlobalUnlock
GlobalLock
GlobalAlloc
GetModuleHandleA
RemoveDirectoryW
DeleteFileW
SetFileTime
GetSystemTime
GetDiskFreeSpaceExA
GetModuleFileNameW
lstrcpynA
lstrcpyA
lstrcpynW
GetCommandLineW
CancelIo
GetOverlappedResult
ExpandEnvironmentStringsW
SetLastError
ResumeThread
GetThreadContext
SuspendThread
OutputDebugStringA
GetEnvironmentVariableA
GetFileAttributesA
GetModuleFileNameA
GetVersionExA
GetCurrentDirectoryA
VerifyVersionInfoW
VerSetConditionMask
GetVersionExW
GlobalMemoryStatusEx
GetUserDefaultUILanguage
GetComputerNameW
GetTempPathW
LocalAlloc
SetUnhandledExceptionFilter
GetCurrentDirectoryW
OpenEventW
DebugBreak
GetFileSize
FileTimeToDosDateTime
FileTimeToLocalFileTime
lstrlenA
GetFileTime
VirtualQuery
GlobalMemoryStatus
SetErrorMode
HeapAlloc
HeapFree
GetCurrentProcess
HeapReAlloc
DecodePointer
EncodePointer
HeapQueryInformation
HeapSize
DuplicateHandle
ExitProcess
SetConsoleCtrlHandler
SystemTimeToFileTime
MapViewOfFile
HeapSetInformation
GetStartupInfoW
GetStdHandle
HeapCreate
IsProcessorFeaturePresent
GetLocaleInfoW
UnhandledExceptionFilter
TerminateProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetStdHandle
InterlockedExchange
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleW
CreateFileA
CompareStringW
SetEnvironmentVariableA
GetProcessHeap
GetProcessAffinityMask
InterlockedExchangeAdd
VirtualProtect
VirtualAlloc
VirtualFree
SwitchToThread
SetThreadAffinityMask
InitializeSListHead
InterlockedPushEntrySList
InterlockedPopEntrySList
InterlockedFlushSList
GetThreadPriority
OpenEventA
SetWaitableTimer
CreateWaitableTimerA
GetSystemDirectoryA
GetDriveTypeW
PeekNamedPipe
GetFileInformationByHandle
FindFirstFileExA
GetDriveTypeA
FileTimeToSystemTime
SetConsoleMode
ReadConsoleInputA
GetFullPathNameA
GetDateFormatA
GetTimeFormatA
CreateSemaphoreW
FlushInstructionCache
CreateMutexW
SignalObjectAndWait
ExpandEnvironmentStringsA
VerifyVersionInfoA
FlushConsoleInputBuffer
GetVersion
GetCurrentProcessId
GetFullPathNameW
GetModuleHandleW
GetCurrentThreadId
SetThreadPriority
FormatMessageA
ExitThread
CreateFileMappingA
CreateThread
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
UnmapViewOfFile
CreateMutexA
ReleaseMutex
WaitForSingleObject
GetWindowsDirectoryW
IsDebuggerPresent
GetCommandLineA
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
RaiseException
SleepEx
QueryPerformanceFrequency
QueryPerformanceCounter
SetHandleInformation
FormatMessageW
SetDllDirectoryW
LoadLibraryW
GetLastError
CreateDirectoryW
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
MultiByteToWideChar
InterlockedCompareExchange
CreateEventA
SetEvent
ReleaseSemaphore
WaitForSingleObjectEx
Sleep
CloseHandle
CreateSemaphoreA
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
RtlUnwind

user32

MessageBoxW
IsWindowVisible
ScreenToClient
WindowFromPoint
GetCursorPos
GetCaretBlinkTime
EnumDisplaySettingsA
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
IsClipboardFormatAvailable
CreateIconIndirect
ReleaseDC
GetDC
GetSystemMetrics
SetCursor
CloseClipboard
wvsprintfA
UpdateWindow
MonitorFromWindow
PostQuitMessage
ValidateRect
GetWindowLongW
RegisterClassExW
DialogBoxParamW
EndDialog
LoadIconA
SendDlgItemMessageW
SetDlgItemTextA
SetDlgItemTextW
MessageBoxA
CopyRect
OffsetRect
GetAncestor
UnregisterClassW
SetWindowTextW
GetDesktopWindow
AdjustWindowRectEx
GetWindowPlacement
ChangeDisplaySettingsA
GetDlgItem
SetWindowLongA
CreateDialogParamA
SetWindowPos
GetWindowRect
GetParent
GetThreadDesktop
GetUserObjectInformationA
EnumWindows
RegisterWindowMessageA
SendMessageA
IsIconic
ShowWindow
SetTimer
PeekMessageA
GetMessageA
KillTimer
LoadImageW
DialogBoxParamA
CheckDlgButton
PeekMessageW
CreateDialogParamW
IsDialogMessageW
DispatchMessageW
MsgWaitForMultipleObjects
EnableWindow
CopyImage
SetWindowLongW
IsDlgButtonChecked
LoadCursorA
DestroyCursor
DestroyIcon
SetCapture
ReleaseCapture
UnregisterDeviceNotification
DispatchMessageA
TranslateMessage
PtInRect
GetClientRect
GetWindowLongA
GetProcessWindowStation
GetUserObjectInformationW
SendMessageTimeoutA
GetMessageExtraInfo
RegisterDeviceNotificationW
SystemParametersInfoW
ClientToScreen
DefWindowProcW
DestroyWindow
CreateWindowExW
GetAsyncKeyState
GetKeyState
wsprintfA
RegisterRawInputDevices
GetRawInputData
GetRawInputDeviceInfoW
GetRawInputDeviceList
SetForegroundWindow
ClipCursor
SetCursorPos
ShowCursor
GetFocus
SetFocus
EnumDisplayDevicesA
EnumDisplayMonitors
GetMonitorInfoA
RegisterClassW

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueA

ole32

CoUninitialize
CoInitialize
CoCreateGuid
CoTaskMemAlloc
CoTaskMemFree
CoSetProxyBlanket
StringFromGUID2
PropVariantClear
CoCreateInstance

shlwapi

PathCanonicalizeW
PathFileExistsW
SHDeleteKeyW

advapi32

CryptGetHashParam
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptImportKey
CryptVerifySignatureA
CryptDestroyKey
RegDeleteValueA
RegQueryValueExA
RegSetValueExA
RegCreateKeyW
OpenProcessToken
CryptDestroyHash
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextA
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
GetUserNameA
GetSidSubAuthority
GetTokenInformation

gdi32

SwapBuffers
DeleteObject
CreateBitmap
CreateDIBSection
SetPixelFormat
ChoosePixelFormat
GetDeviceCaps
GetObjectA

shell32

CommandLineToArgvW
SHGetFolderPathW
ShellExecuteW
SHFileOperationW

opengl32

wglGetCurrentContext
wglCreateContext
wglMakeCurrent
wglDeleteContext
wglGetProcAddress
wglGetCurrentDC

winmm

timeBeginPeriod
waveInGetNumDevs
timeEndPeriod
waveOutGetDevCapsA
waveOutGetDevCapsW
waveOutClose
waveOutOpen
waveOutUnprepareHeader
waveOutWrite
waveOutReset
waveOutGetPosition
timeGetTime
waveOutGetNumDevs
waveInPrepareHeader
waveInUnprepareHeader
waveInGetDevCapsA
waveInGetDevCapsW
waveInStart
waveInOpen
waveInClose
waveInReset
waveOutPrepareHeader
waveInAddBuffer

ws2_32

accept
ntohs
gethostname
socket
WSAGetLastError
connect
WSAAsyncGetHostByName
WSAStartup
inet_ntoa
closesocket
WSACleanup
htonl
bind
htons
inet_addr
WSACancelAsyncRequest
getsockopt
WSAEventSelect
WSACloseEvent
WSACreateEvent
WSAWaitForMultipleEvents
WSAResetEvent
WSAEnumNetworkEvents
WSASetEvent
getpeername
getprotobyname
recv
gethostbyname
ntohl
shutdown
getnameinfo
getaddrinfo
WSAIoctl
recvfrom
sendto
send
select
__WSAFDIsSet
freeaddrinfo
WSASocketA
WSASetLastError
setsockopt
ioctlsocket
getsockname
listen

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantChangeType
VariantInit

imm32

ImmReleaseContext
ImmSetOpenStatus
ImmGetConversionStatus
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmGetContext
ImmSetCompositionStringW

dnsapi

DnsQuery_A
DnsFree

iphlpapi

GetIpAddrTable

winhttp

WinHttpGetIEProxyConfigForCurrentUser

Exports

Exports

??0Allocator@shdfnd@physx@@QAE@PBD@Z
??0ErrorHandler@shdfnd@physx@@QAE@XZ
??0FPUGuard@shdfnd@physx@@QAE@XZ
??0Foundation@shdfnd@physx@@AAE@AAVPxErrorCallback@2@AAVPxAllocatorCallback@2@@Z
??0MutexImpl@shdfnd@physx@@QAE@XZ
??0PAUtils@shdfnd@physx@@QAE@XZ
??0PxFoundation@physx@@QAE@ABV01@@Z
??0PxFoundation@physx@@QAE@XZ
??0ReadWriteLock@shdfnd@physx@@QAE@XZ
??0SListImpl@shdfnd@physx@@QAE@XZ
??0SyncImpl@shdfnd@physx@@QAE@XZ
??0TempAllocator@shdfnd@physx@@QAE@PBD@Z
??0ThreadImpl@shdfnd@physx@@QAE@P6APAXPAX@Z0@Z
??0ThreadImpl@shdfnd@physx@@QAE@XZ
??0Time@shdfnd@physx@@QAE@XZ
??1ErrorHandler@shdfnd@physx@@QAE@XZ
??1FPUGuard@shdfnd@physx@@QAE@XZ
??1Foundation@shdfnd@physx@@EAE@XZ
??1MutexImpl@shdfnd@physx@@QAE@XZ
??1PAUtils@shdfnd@physx@@QAE@XZ
??1PxFoundation@physx@@MAE@XZ
??1ReadWriteLock@shdfnd@physx@@QAE@XZ
??1SListImpl@shdfnd@physx@@QAE@XZ
??1SyncImpl@shdfnd@physx@@QAE@XZ
??1ThreadImpl@shdfnd@physx@@QAE@XZ
??4Allocator@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4ErrorHandler@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4FPUGuard@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4MutexImpl@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4PAUtils@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4PxFoundation@physx@@QAEAAV01@ABV01@@Z
??4SListImpl@shdfnd@physx@@QAEAAU012@ABU012@@Z
??4SyncImpl@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4TempAllocator@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4ThreadImpl@shdfnd@physx@@QAEAAV012@ABV012@@Z
??4Time@shdfnd@physx@@QAEAAV012@ABV012@@Z
??_7Foundation@shdfnd@physx@@6B@
??_7PxFoundation@physx@@6B@
??_FAllocator@shdfnd@physx@@QAEXXZ
??_FTempAllocator@shdfnd@physx@@QAEXXZ
?MAX_LISTENER_COUNT@ErrorHandler@shdfnd@physx@@2IB
?PxDiagonalize@physx@@YA?AVPxVec3@1@ABVPxMat33@1@AAVPxQuat@1@@Z
?PxShortestRotation@physx@@YA?AVPxQuat@1@ABVPxVec3@1@0@Z
?PxTransformFromPlaneEquation@physx@@YA?AVPxTransform@1@ABVPxPlane@1@@Z
?PxTransformFromSegment@physx@@YA?AVPxTransform@1@ABVPxVec3@1@0PAM@Z
?TlsAlloc@shdfnd@physx@@YAIXZ
?TlsFree@shdfnd@physx@@YAXI@Z
?TlsGet@shdfnd@physx@@YAPAXI@Z
?TlsSet@shdfnd@physx@@YAIIPAX@Z
?allocate@Allocator@shdfnd@physx@@QAEPAXIPBDH@Z
?allocate@TempAllocator@shdfnd@physx@@QAEPAXIPBDH@Z
?atomicAdd@shdfnd@physx@@YAHPCHH@Z
?atomicCompareExchange@shdfnd@physx@@YAHPCHHH@Z
?atomicCompareExchangePointer@shdfnd@physx@@YAPAXPAPCXPAX1@Z
?atomicDecrement@shdfnd@physx@@YAHPCH@Z
?atomicExchange@shdfnd@physx@@YAHPCHH@Z
?atomicIncrement@shdfnd@physx@@YAHPCH@Z
?atomicMax@shdfnd@physx@@YAHPCHH@Z
?computeQuatFromNormal@shdfnd@physx@@YA?AVPxQuat@2@ABVPxVec3@2@@Z
?createInstance@Foundation@shdfnd@physx@@SAPAV123@IAAVPxErrorCallback@3@AAVPxAllocatorCallback@3@@Z
?deallocate@Allocator@shdfnd@physx@@QAEXPAX@Z
?deallocate@TempAllocator@shdfnd@physx@@QAEXPAX@Z
?debugEvent@PAUtils@shdfnd@physx@@QAEXGII@Z
?decRefCount@Foundation@shdfnd@physx@@SAXXZ
?destroyInstance@Foundation@shdfnd@physx@@SAXXZ
?disableFPExceptions@shdfnd@physx@@YAXXZ
?enableFPExceptions@shdfnd@physx@@YAXXZ
?error@Foundation@shdfnd@physx@@QAAXW4Enum@PxErrorCode@3@PBDH1ZZ
?errorImpl@Foundation@shdfnd@physx@@QAEXW4Enum@PxErrorCode@3@PBDH1PAD@Z
?flush@SListImpl@shdfnd@physx@@QAEPAVSListEntry@23@XZ
?getAllocator@Foundation@shdfnd@physx@@UBEAAVPxBroadcastingAllocator@3@XZ
?getAllocator@shdfnd@physx@@YAAAVPxAllocatorCallback@2@XZ
?getAllocatorCallback@Foundation@shdfnd@physx@@UBEAAVPxAllocatorCallback@3@XZ
?getBootCounterFrequency@Time@shdfnd@physx@@SAABUCounterFrequencyToTensOfNanos@23@XZ
?getCallbackCount@ErrorHandler@shdfnd@physx@@QBEIXZ
?getCheckedAllocator@Foundation@shdfnd@physx@@QAEAAVPxAllocatorCallback@3@XZ
?getCounterFrequency@Time@shdfnd@physx@@SA?AUCounterFrequencyToTensOfNanos@23@XZ
?getCurrentCounterValue@Time@shdfnd@physx@@SA_KXZ
?getCurrentTimeInTensOfNanoSeconds@Time@shdfnd@physx@@SA_KXZ
?getDefaultStackSize@ThreadImpl@shdfnd@physx@@SAIXZ
?getElapsedSeconds@Time@shdfnd@physx@@QAENXZ
?getErrorCallback@ErrorHandler@shdfnd@physx@@QBEPAVPxErrorCallback@3@H@Z
?getErrorCallback@Foundation@shdfnd@physx@@UBEAAVPxErrorCallback@3@XZ
?getErrorHandler@Foundation@shdfnd@physx@@QAEAAVErrorHandler@23@XZ
?getErrorLevel@Foundation@shdfnd@physx@@UBE?AW4Enum@PxErrorCode@3@XZ
?getErrorMutex@Foundation@shdfnd@physx@@QAEAAV?$MutexT@V?$ReflectionAllocator@VMutexImpl@shdfnd@physx@@@shdfnd@physx@@@23@XZ
?getId@ThreadImpl@shdfnd@physx@@SAIXZ
?getInstance@Foundation@shdfnd@physx@@SAAAV123@XZ
?getLastTime@Time@shdfnd@physx@@QBENXZ
?getMaxCallbackNum@ErrorHandler@shdfnd@physx@@QBEIXZ
?getNamedAllocMap@Foundation@shdfnd@physx@@QAEAAV?$HashMap@PBVNamedAllocator@shdfnd@physx@@PBDU?$Hash@PBVNamedAllocator@shdfnd@physx@@@23@VNonTrackingAllocator@23@@23@XZ
?getNamedAllocMutex@Foundation@shdfnd@physx@@QAEAAV?$MutexT@V?$ReflectionAllocator@VMutexImpl@shdfnd@physx@@@shdfnd@physx@@@23@XZ
?getNbPhysicalCores@ThreadImpl@shdfnd@physx@@SAIXZ
?getPAUtils@Foundation@shdfnd@physx@@QAEAAVPAUtils@23@XZ
?getPriority@ThreadImpl@shdfnd@physx@@SA?AW4Enum@ThreadPriority@23@I@Z
?getReportAllocationNames@Foundation@shdfnd@physx@@UBE_NXZ
?getSize@MutexImpl@shdfnd@physx@@SAABIXZ
?getSize@SListImpl@shdfnd@physx@@SAABIXZ
?getSize@SyncImpl@shdfnd@physx@@SAABIXZ
?getSize@ThreadImpl@shdfnd@physx@@SAABIXZ
?getTempAllocFreeTable@Foundation@shdfnd@physx@@QAEAAV?$Array@PATTempAllocatorChunk@shdfnd@physx@@VAllocator@23@@23@XZ
?getTempAllocMutex@Foundation@shdfnd@physx@@QAEAAV?$MutexT@V?$ReflectionAllocator@VMutexImpl@shdfnd@physx@@@shdfnd@physx@@@23@XZ
?getWarnOnceTimestamp@Foundation@shdfnd@physx@@SAIXZ
?incRefCount@Foundation@shdfnd@physx@@SAXXZ
?integrateTransform@shdfnd@physx@@YAXABVPxTransform@2@ABVPxVec3@2@1MAAV32@@Z
?isEnabled@PAUtils@shdfnd@physx@@QAE_NXZ
?isEventEnabled@PAUtils@shdfnd@physx@@QAE_NG@Z
?kill@ThreadImpl@shdfnd@physx@@QAEXXZ
?lock@MutexImpl@shdfnd@physx@@QAEXXZ
?lock@PAUtils@shdfnd@physx@@QAE_NXZ
?lockReader@ReadWriteLock@shdfnd@physx@@QAEXXZ
?lockWriter@ReadWriteLock@shdfnd@physx@@QAEXXZ
?mInstance@Foundation@shdfnd@physx@@0PAV123@A
?mRefCount@Foundation@shdfnd@physx@@0IA
?mWarnOnceTimestap@Foundation@shdfnd@physx@@0IA
?optimizeBoundingBox@shdfnd@physx@@YA?AVPxVec3@2@AAVPxMat33@2@@Z
?peekElapsedSeconds@Time@shdfnd@physx@@QAENXZ
?pop@SListImpl@shdfnd@physx@@QAEPAVSListEntry@23@XZ
?push@SListImpl@shdfnd@physx@@QAEXPAVSListEntry@23@@Z
?quit@ThreadImpl@shdfnd@physx@@QAEXXZ
?quitIsSignalled@ThreadImpl@shdfnd@physx@@QAE_NXZ
?rawEvent@PAUtils@shdfnd@physx@@QAEXGIIE@Z
?rawEventWithTimestamp@PAUtils@shdfnd@physx@@QAE_NG_KIIE@Z
?registerErrorCallback@ErrorHandler@shdfnd@physx@@QAEHAAVPxErrorCallback@3@@Z
?registerEvent@PAUtils@shdfnd@physx@@QAEGPBD@Z
?release@Foundation@shdfnd@physx@@UAEXXZ
?reportError@ErrorHandler@shdfnd@physx@@QAEXW4Enum@PxErrorCode@3@PBD1H@Z
?reset@SyncImpl@shdfnd@physx@@QAEXXZ
?sNumTensOfNanoSecondsInASecond@Time@shdfnd@physx@@2_KB
?set@SyncImpl@shdfnd@physx@@QAEXXZ
?setAffinityMask@ThreadImpl@shdfnd@physx@@QAEII@Z
?setErrorLevel@Foundation@shdfnd@physx@@UAEXW4Enum@PxErrorCode@3@@Z
?setName@ThreadImpl@shdfnd@physx@@QAEXPBD@Z
?setPriority@ThreadImpl@shdfnd@physx@@QAEXW4Enum@ThreadPriority@23@@Z
?setReportAllocationNames@Foundation@shdfnd@physx@@UAEX_N@Z
?signalQuit@ThreadImpl@shdfnd@physx@@QAEXXZ
?sleep@ThreadImpl@shdfnd@physx@@SAXI@Z
?slerp@shdfnd@physx@@YA?AVPxQuat@2@MABV32@0@Z
?start@ThreadImpl@shdfnd@physx@@QAEXIPAVRunnable@23@@Z
?startEvent@PAUtils@shdfnd@physx@@QAEXGG@Z
?statEvent@PAUtils@shdfnd@physx@@QAEXGI@Z
?statEvent@PAUtils@shdfnd@physx@@QAEXGII@Z
?stopEvent@PAUtils@shdfnd@physx@@QAEXGG@Z
?trylock@MutexImpl@shdfnd@physx@@QAE_NXZ
?unRegisterErrorCallback@ErrorHandler@shdfnd@physx@@QAEXAAVPxErrorCallback@3@@Z
?unRegisterErrorCallback@ErrorHandler@shdfnd@physx@@QAEXH@Z
?unlock@MutexImpl@shdfnd@physx@@QAEXXZ
?unlock@PAUtils@shdfnd@physx@@QAE_NXZ
?unlockReader@ReadWriteLock@shdfnd@physx@@QAEXXZ
?unlockWriter@ReadWriteLock@shdfnd@physx@@QAEXXZ
?wait@SyncImpl@shdfnd@physx@@QAE_NI@Z
?waitForQuit@ThreadImpl@shdfnd@physx@@QAE_NXZ
?waitForever@SyncImpl@shdfnd@physx@@2IB
?yield@ThreadImpl@shdfnd@physx@@SAXXZ
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
PxCreateFoundation
PxGetFoundation

Sections

.text
Size: 14.3MB - Virtual size: 14.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 226KB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.trace
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 554KB - Virtual size: 553KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 560KB - Virtual size: 559KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

50e57fe09abdcc2e55ceaa3b20bbd1da

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

hid

kernel32

user32

version

ole32

shlwapi

advapi32

gdi32

shell32

opengl32

winmm

ws2_32

oleaut32

imm32

dnsapi

iphlpapi

winhttp

Exports

Exports

Sections

.text Size: 14.3MB - Virtual size: 14.3MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 226KB - Virtual size: 1.0MB

.rodata Size: 3KB - Virtual size: 2KB

.trace Size: 7KB - Virtual size: 7KB

.data1 Size: 512B - Virtual size: 64B

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 554KB - Virtual size: 553KB

.reloc Size: 560KB - Virtual size: 559KB

.text
Size: 14.3MB - Virtual size: 14.3MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 226KB - Virtual size: 1.0MB

.rodata
Size: 3KB - Virtual size: 2KB

.trace
Size: 7KB - Virtual size: 7KB

.data1
Size: 512B - Virtual size: 64B

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 554KB - Virtual size: 553KB

.reloc
Size: 560KB - Virtual size: 559KB