loader[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
loader.exe
Size 532KB
Sample260720-ny2lbsbs8x
SHA256 b8449e8a0622d40180f985ea815baa06c759170b411554fc9c0d4fc5f60b577d
MD5 491f96cf5519272a784cdfcd2d9060d1
SHA1 03b0b387dca79f2ce089a2af1d69d6de942ff8f5
SHA512 72359b275c5890070a7d92bdd861eea2f36bbd134c78b535be8d24b72039a99e517e202e8e32ce2e656fb75060274384f0b6e06693d272b2b240e696b7c971c2
SSDEEP 6144:avp5ht4BOpv6VNZcOMu8sXjW1HXfxnW+TkLyoP553r5GatM8azYGBQ6iLezkUMk6:EOqOMKXjW9o+gvh5bv0WoZFa
TLSH
T1E9C42917E2A361F8C117C13483A66773E6317C1982347D7B9B94CB722F60E606B69F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loader.exe

File Explorer

loader.exe

.exe 532KB

loader.exe

IMPHASH f522716da156fe47f68c6e531b471aaa
SHA256 b8449e8a0622d40180f985ea815baa06c759170b411554fc9c0d4fc5f60b577d
MD5 491f96cf5519272a784cdfcd2d9060d1
SHA1 03b0b387dca79f2ce089a2af1d69d6de942ff8f5
SHA512 72359b275c5890070a7d92bdd861eea2f36bbd134c78b535be8d24b72039a99e517e202e8e32ce2e656fb75060274384f0b6e06693d272b2b240e696b7c971c2
SSDEEP 6144:avp5ht4BOpv6VNZcOMu8sXjW1HXfxnW+TkLyoP553r5GatM8azYGBQ6iLezkUMk6:EOqOMKXjW9o+gvh5bv0WoZFa
TLSH
T1E9C42917E2A361F8C117C13483A66773E6317C1982347D7B9B94CB722F60E606B69F29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryReflectionKey RegQueryValueExA

credui

CredUIPromptForWindowsCredentialsW CredUnPackAuthenticationBufferW

d2d1

D2D1CreateFactory D2D1MakeRotateMatrix

dwmapi

DwmSetWindowAttribute

dwrite

DWriteCreateFactory

gdi32

CreateSolidBrush

iphlpapi

GetIfEntry

kernel32

AllocConsole CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileW CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesA GetFileSize GetHandleInformation GetLastError GetModuleHandleA GetOverlappedResult GetProcAddress GetProcessAffinityMask GetStartupInfoA GetStdHandle GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetWindowsDirectoryA InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile Module32First Module32Next MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleTextAttribute SetEvent SetFileAttributesA SetFileAttributesW SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _ismbblead _lock _read _setjmp _strdup _unlock _vscprintf _vsnprintf atexit _write abort calloc exit fprintf fputc fputs free freopen_s fwrite getenv localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc signal strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen wcsstr

ole32

CoCreateInstance CoInitializeEx

rpcrt4

NdrContextHandleSize

user32

CreateWindowExA DefWindowProcA DestroyWindow DispatchMessageA GetAsyncKeyState GetClientRect GetCursorPos GetMessageA LoadCursorA MessageBoxA PostQuitMessage RegisterClassA ScreenToClient SetForegroundWindow ShowWindow TranslateMessage UpdateWindow wsprintfA wsprintfW

wininet

InternetHangUp

ws2_32

getprotobynumber

CATID_WICBitmapDecoders CATID_WICBitmapEncoders CATID_WICFormatConverters CATID_WICMetadataReader CATID_WICMetadataWriter CATID_WICPixelFormats CLSID_WICAdngDecoder CLSID_WICBmpDecoder CLSID_WICBmpEncoder CLSID_WICDdsDecoder CLSID_WICDdsEncoder CLSID_WICDefaultFormatConverter CLSID_WICFormatConverterHighColor CLSID_WICFormatConverterNChannel CLSID_WICFormatConverterWMPhoto CLSID_WICGifDecoder CLSID_WICGifEncoder CLSID_WICHeifDecoder CLSID_WICHeifEncoder CLSID_WICIcoDecoder CLSID_WICImagingCategories CLSID_WICImagingFactory CLSID_WICImagingFactory1 CLSID_WICImagingFactory2 CLSID_WICJpegDecoder CLSID_WICJpegEncoder CLSID_WICJpegQualcommPhoneEncoder CLSID_WICPlanarFormatConverter CLSID_WICPngDecoder CLSID_WICPngDecoder1 CLSID_WICPngDecoder2 CLSID_WICPngEncoder CLSID_WICRAWDecoder CLSID_WICTiffDecoder CLSID_WICTiffEncoder CLSID_WICWebpDecoder CLSID_WICWmpDecoder CLSID_WICWmpEncoder GUID_ContainerFormatAdng GUID_ContainerFormatBmp GUID_ContainerFormatDds GUID_ContainerFormatGif GUID_ContainerFormatHeif GUID_ContainerFormatIco GUID_ContainerFormatJpeg GUID_ContainerFormatPng GUID_ContainerFormatRaw GUID_ContainerFormatTiff GUID_ContainerFormatWebp GUID_ContainerFormatWmp GUID_VendorMicrosoft GUID_VendorMicrosoftBuiltIn GUID_WICPixelFormat112bpp6ChannelsAlpha GUID_WICPixelFormat112bpp7Channels GUID_WICPixelFormat128bpp7ChannelsAlpha GUID_WICPixelFormat128bpp8Channels GUID_WICPixelFormat128bppPRGBAFloat GUID_WICPixelFormat128bppRGBAFixedPoint GUID_WICPixelFormat128bppRGBAFloat GUID_WICPixelFormat128bppRGBFixedPoint GUID_WICPixelFormat128bppRGBFloat GUID_WICPixelFormat144bpp8ChannelsAlpha GUID_WICPixelFormat16bppBGR555 GUID_WICPixelFormat16bppBGR565 GUID_WICPixelFormat16bppBGRA5551 GUID_WICPixelFormat16bppCbCr GUID_WICPixelFormat16bppCbQuantizedDctCoefficients GUID_WICPixelFormat16bppCrQuantizedDctCoefficients GUID_WICPixelFormat16bppGray GUID_WICPixelFormat16bppGrayFixedPoint GUID_WICPixelFormat16bppGrayHalf GUID_WICPixelFormat16bppYQuantizedDctCoefficients GUID_WICPixelFormat1bppIndexed GUID_WICPixelFormat24bpp3Channels GUID_WICPixelFormat24bppBGR GUID_WICPixelFormat24bppRGB GUID_WICPixelFormat2bppGray GUID_WICPixelFormat2bppIndexed GUID_WICPixelFormat32bpp3ChannelsAlpha GUID_WICPixelFormat32bpp4Channels GUID_WICPixelFormat32bppBGR GUID_WICPixelFormat32bppBGR101010 GUID_WICPixelFormat32bppBGRA GUID_WICPixelFormat32bppCMYK GUID_WICPixelFormat32bppGrayFixedPoint GUID_WICPixelFormat32bppGrayFloat GUID_WICPixelFormat32bppPBGRA GUID_WICPixelFormat32bppPRGBA GUID_WICPixelFormat32bppR10G10B10A2 GUID_WICPixelFormat32bppR10G10B10A2HDR10 GUID_WICPixelFormat32bppRGB GUID_WICPixelFormat32bppRGBA GUID_WICPixelFormat32bppRGBA1010102 GUID_WICPixelFormat32bppRGBA1010102XR GUID_WICPixelFormat32bppRGBE GUID_WICPixelFormat40bpp4ChannelsAlpha GUID_WICPixelFormat40bpp5Channels GUID_WICPixelFormat40bppCMYKAlpha GUID_WICPixelFormat48bpp3Channels GUID_WICPixelFormat48bpp5ChannelsAlpha GUID_WICPixelFormat48bpp6Channels GUID_WICPixelFormat48bppBGR GUID_WICPixelFormat48bppBGRFixedPoint GUID_WICPixelFormat48bppRGB GUID_WICPixelFormat48bppRGBFixedPoint GUID_WICPixelFormat48bppRGBHalf GUID_WICPixelFormat4bppGray GUID_WICPixelFormat4bppIndexed GUID_WICPixelFormat56bpp6ChannelsAlpha GUID_WICPixelFormat56bpp7Channels GUID_WICPixelFormat64bpp3ChannelsAlpha GUID_WICPixelFormat64bpp4Channels GUID_WICPixelFormat64bpp7ChannelsAlpha GUID_WICPixelFormat64bpp8Channels GUID_WICPixelFormat64bppBGRA GUID_WICPixelFormat64bppBGRAFixedPoint GUID_WICPixelFormat64bppCMYK GUID_WICPixelFormat64bppPBGRA GUID_WICPixelFormat64bppPRGBA GUID_WICPixelFormat64bppPRGBAHalf GUID_WICPixelFormat64bppRGB GUID_WICPixelFormat64bppRGBA GUID_WICPixelFormat64bppRGBAFixedPoint GUID_WICPixelFormat64bppRGBAHalf GUID_WICPixelFormat64bppRGBFixedPoint GUID_WICPixelFormat64bppRGBHalf GUID_WICPixelFormat72bpp8ChannelsAlpha GUID_WICPixelFormat80bpp4ChannelsAlpha GUID_WICPixelFormat80bpp5Channels GUID_WICPixelFormat80bppCMYKAlpha GUID_WICPixelFormat8bppAlpha GUID_WICPixelFormat8bppCb GUID_WICPixelFormat8bppCr GUID_WICPixelFormat8bppGray GUID_WICPixelFormat8bppIndexed GUID_WICPixelFormat8bppY GUID_WICPixelFormat96bpp5ChannelsAlpha GUID_WICPixelFormat96bpp6Channels GUID_WICPixelFormat96bppRGBFixedPoint GUID_WICPixelFormat96bppRGBFloat GUID_WICPixelFormatBlackWhite GUID_WICPixelFormatDontCare IID_IDXGIAdapter IID_IDXGIAdapter1 IID_IDXGIDevice IID_IDXGIDevice1 IID_IDXGIDeviceSubObject IID_IDXGIFactory IID_IDXGIFactory1 IID_IDXGIKeyedMutex IID_IDXGIObject IID_IDXGIOutput IID_IDXGIResource IID_IDXGISurface IID_IDXGISurface1 IID_IDXGISwapChain IID_IWICBitmap IID_IWICBitmapClipper IID_IWICBitmapCodecInfo IID_IWICBitmapDecoder IID_IWICBitmapDecoderInfo IID_IWICBitmapEncoder IID_IWICBitmapEncoderInfo IID_IWICBitmapFlipRotator IID_IWICBitmapFrameDecode IID_IWICBitmapFrameEncode IID_IWICBitmapLock IID_IWICBitmapScaler IID_IWICBitmapSource IID_IWICColorContext IID_IWICColorTransform IID_IWICComponentInfo IID_IWICDdsDecoder IID_IWICDdsEncoder IID_IWICDdsFrameDecode IID_IWICEnumMetadataItem IID_IWICFastMetadataEncoder IID_IWICFormatConverter IID_IWICFormatConverterInfo IID_IWICImageEncoder IID_IWICImagingFactory IID_IWICImagingFactory2 IID_IWICMetadataQueryReader IID_IWICMetadataQueryWriter IID_IWICPalette IID_IWICPixelFormatInfo IID_IWICPixelFormatInfo2 IID_IWICStream IID_IWICWineDecoder NET_FRAGMENT_EXTRA_FLAG NET_FRAGMENT_SECURITY_FLAG WinMain _GCC_specific_handler _Unwind_Backtrace _Unwind_DeleteException _Unwind_FindEnclosingFunction _Unwind_ForcedUnwind _Unwind_GetCFA _Unwind_GetDataRelBase _Unwind_GetGR _Unwind_GetIP _Unwind_GetIPInfo _Unwind_GetLanguageSpecificData _Unwind_GetRegionStart _Unwind_GetTextRelBase _Unwind_RaiseException _Unwind_Resume _Unwind_Resume_or_Rethrow _Unwind_SetGR _Unwind_SetIP _Z12import_trickv _Z13win_procedureP6HWND__jyx _Z9error_msgB5cxx11 _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE13internet_open _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE15http_query_info _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE16internet_connect _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE17http_send_request _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE18internet_read_file _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE19internet_set_option _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE21internet_close_handle _ZGVZ26transmit_fragment_internalP14c_net_fragmentbPbbE21internet_open_request _ZGVZN5utils13create_workerEPFmPvES0_E24create_simple_thread_ptr _ZN11c_font_base10calc_alignER7c_vec3iS0_hh _ZN11c_font_base10draw_bytesE7c_vec3ijNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE6c_vec4hhh _ZN11c_font_base4drawE7c_vec3ijNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE6c_vec4hhh _ZN11c_font_base8get_sizeEjNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEPb _ZN11c_font_d2d14drawE7c_vec3ijNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE6c_vec4hhh _ZN11c_font_d2d18get_sizeEjNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEPb _ZN11c_font_d2d1D0Ev _ZN11c_font_d2d1D1Ev _ZN13c_render_base10solid_lineE7c_vec3iS0_6c_vec4bf _ZN13c_render_base13gradient_rectE7c_vec3iS0_6c_vec4S1_S1_S1_f _ZN13c_render_base14draw_watermarkEP11c_font_basebi _ZN13c_render_base14frametime_stopEfj _ZN13c_render_base14framtime_startEv _ZN13c_render_base18register_font_baseEP11c_font_base _ZN13c_render_base5scaleEv _ZN13c_render_base7rescaleE7c_vec3i _ZN13c_render_base7rescaleEi _ZN13c_render_base9tick_markE7c_vec3i6c_vec4f _ZN13c_render_d2d110begin_drawEv _ZN13c_render_d2d110set_colourE6c_vec4 _ZN13c_render_d2d111create_fontENSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEjj _ZN13c_render_d2d111filled_rectE7c_vec3iS0_6c_vec4fj _ZN13c_render_d2d113filled_circleE7c_vec3iff6c_vec4 _ZN13c_render_d2d113outlined_rectE7c_vec3iS0_6c_vec4fj _ZN13c_render_d2d115outlined_circleE7c_vec3iff6c_vec4 _ZN13c_render_d2d115pop_clip_regionEv _ZN13c_render_d2d116push_clip_regionE7c_vec3iS0_ _ZN13c_render_d2d120gradient_rect_linearE7c_vec3iS0_S0_S0_6c_vec4S1_f _ZN13c_render_d2d14modeEv _ZN13c_render_d2d15setupEPv _ZN13c_render_d2d16unloadEb _ZN13c_render_d2d18end_drawEv _ZN13c_render_d2d1D0Ev _ZN13c_render_d2d1D1Ev _ZN16__mingw_uuidof_sI12ID2D1FactoryE11__uuid_instE _ZN16__mingw_uuidof_sI14IDWriteFactoryE11__uuid_instE _ZN18gcs_component_base13draw_anywhereE7c_vec3iS0_ _ZN18gcs_component_base13pre_run_childEv _ZN18gcs_component_base3posEb _ZN18gcs_component_base3runEv _ZN18gcs_component_base4drawE7c_vec3iS0_ _ZN18gcs_component_base4sizeEv _ZN18gcs_component_base5setupEv _ZN18gcs_component_base5thinkE7c_vec3iS0_ _ZN18gcs_component_base7pre_runEv _ZN18gcs_component_base7set_posE7c_vec3i _ZN18gcs_component_base8post_runEv _ZN18gcs_component_base8set_nameENSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEE _ZN18gcs_component_base8set_sizeE7c_vec3i _ZN18gcs_component_base9call_hookEjPv _ZN18gcs_component_base9draw_lastE7c_vec3iS0_ _ZN18gcs_component_base9is_moduleEv _ZN18gcs_component_base9run_childEPS_ _ZN19gcs_component_group5setupEv _ZN19gcs_component_group5thinkE7c_vec3iS0_ _ZN20gcs_component_canvas4drawE7c_vec3iS0_ _ZN20gcs_component_canvas5setupEv _ZN20gcs_component_canvas5thinkE7c_vec3iS0_ _ZN21s_log_window_metadata8on_clickEv _ZN23gcs_component_scrollbar4drawE7c_vec3iS0_ _ZN23gcs_component_scrollbar5setupEv _ZN23gcs_component_scrollbar5thinkE7c_vec3iS0_ _ZN23gcs_component_scrollbar9is_moduleEv _ZN24gcs_component_group_host4drawE7c_vec3iS0_ _ZN24gcs_component_group_host5setupEv _ZN24gcs_component_group_host5thinkE7c_vec3iS0_ _ZN24gcs_component_group_host6updateEv _ZN2jm6detail14syscall_holderILj0EE5entryE _ZN33gcs_component_cheat_select_option4drawE7c_vec3iS0_ _ZN33gcs_component_cheat_select_option5setupEv _ZN33gcs_component_cheat_select_option5thinkE7c_vec3iS0_ _ZN33gcs_component_cheat_select_option7pre_runEv _ZN33gcs_component_cheat_select_option8post_runEv _ZN3gcs11free_memoryEPy _ZN3gcs12render_sceneEP9gcs_scene7c_vec3iP11c_font_baseS4_ _ZN3gcs9add_sceneI8gcs_menuEEPT_v _ZN4file11delete_fileENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE _ZN4file16delete_file_typeENSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEES5_bPy _ZN5utils13create_workerEPFmPvES0_ _ZN5utils14create_processENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES5_ _ZN5utils14has_breakpointEPy _ZN5utils17listen_for_errorsEv _ZN5utils17submit_error_codeEjj _ZN5utils19get_process_modulesEP16tagMODULEENTRY32jPjy _ZN5utils21get_process_hash_listEPjS0_ _ZN5utils34get_module_info_from_address_spaceEyP16tagMODULEENTRY32 _ZN5utils6formatENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEz _ZN5utils6xor_upEPhi _ZN5utils7load_upEv _ZN5utils7save_upEv _ZN5utils8check_upEv _ZN5utils9delete_upEv _ZN5utils9is_hookedEPyb _ZN5utils9prompt_upEPbPy _ZN6c_stub4loadEP21c_net_receive_licensej _ZN6c_vec310distance2dES_b _ZN6c_vec314distance_meterES_b _ZN6c_vec315normalize_angleEv _ZN6c_vec38distanceES_b _ZN6c_vec415normalize_angleEv _ZN8c_global11prompt_failEy _ZN8c_global12handle_credsEPbS0_ _ZN8gcs_menu5setupEv _ZN9gcs_scene5setupEv _ZN9gcs_scene5thinkEv _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN19gcs_component_group5setupEvEUlS1_S2_E_E10_M_managerERSt9_Any_dataRKS7_St18_Manager_operation _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN19gcs_component_group5setupEvEUlS1_S2_E_E9_M_invokeERKSt9_Any_dataOS1_OS2_ _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E0_E10_M_managerERSt9_Any_dataRKS7_St18_Manager_operation _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E0_E9_M_invokeERKSt9_Any_dataOS1_OS2_ _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E1_E10_M_managerERSt9_Any_dataRKS7_St18_Manager_operation _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E1_E9_M_invokeERKSt9_Any_dataOS1_OS2_ _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E_E10_M_managerERSt9_Any_dataRKS7_St18_Manager_operation _ZNSt17_Function_handlerIFbP18gcs_component_basePvEZN8gcs_menu5setupEvEUlS1_S2_E_E9_M_invokeERKSt9_Any_dataOS1_OS2_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE12_M_constructILb1EEEvPKcy _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1ERKS4_ _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE12_M_constructILb1EEEvPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_assignERKS4_ _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE9_M_mutateEyyPKwy _ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEED1Ev _ZTV11c_font_d2d1 _ZTV13c_render_d2d1 _ZTV19gcs_component_group _ZTV20gcs_component_canvas _ZTV23gcs_component_scrollbar _ZTV24gcs_component_group_host _ZTV33gcs_component_cheat_select_option _ZTV8gcs_menu _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE13internet_open _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE15http_query_info _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE16internet_connect _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE17http_send_request _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE18internet_read_file _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE19internet_set_option _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE21internet_close_handle _ZZ26transmit_fragment_internalP14c_net_fragmentbPbbE21internet_open_request _ZZN13c_render_d2d110set_colourE6c_vec4E10last_alpha _ZZN13c_render_d2d110set_colourE6c_vec4E8last_hex _ZZN5utils13create_workerEPFmPvES0_E24create_simple_thread_ptr _ZZN5utils17listen_for_errorsEvENUlPvE_4_FUNES0_ _ZZN8c_server15request_licenseE7up_dataPbE9max_tries _ZZN8gcs_menu5setupEvE22bitmap_buffering_delay _ZZN8gcs_menu5setupEvENUlP33gcs_component_cheat_select_optionE_4_FUNES1_ __emutls_get_address __emutls_register_common assert_internal error_code error_line error_status_code file_map file_map_alloc gen_flag_debug_mode global global_alloc hde32_disasm hde32_table hde64_disasm hde64_table input_system input_system_alloc render render_alloc server server_alloc stbi_flip_vertically_on_write stbi_write_bmp_to_func stbi_write_force_png_filter stbi_write_jpg_to_func stbi_write_png_compression_level stbi_write_png_to_func stbi_write_png_to_mem stbi_write_tga_to_func stbi_write_tga_with_rle stbi_zlib_compress stub stub_alloc

Name

.text

Size

429KB

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_sysc

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

628B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

loader.exe

advapi32

credui

d2d1

dwmapi

dwrite

gdi32

iphlpapi

kernel32

msvcrt

ole32

rpcrt4

user32

wininet

ws2_32

generic