Genshin Impact[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Genshin Impact.rar
Size

6.0MB
MD5

c5ae06f55ae9d9d6d0786d5145ecd2cf
SHA1

27c4524be73996dea039362394a0ebd14665fe2f
SHA256

5985aa21be2afcced0d6490eed53ba8bc445a3fd8e1feabd23d1fc678ceaeddb
SHA512

326406efb9e1cd0a3f65cac8a74bccca700b69987fa231d60e2a7ae7ce3364e59611f63cba6bf721e18d022c41bfb6052d0971a1df05f2f2d24a2da35fd265e1
SSDEEP

98304:HpVjEhCV4TGBEgh6sPXf1TZSCXAOPOOBsDKP04oRFW7IcVac7z3ekKzXChX7x7YZ:H7EhEB6g1P1TUCXAABkK84oRFE8UUk7E

Score

N/A

Malware Config

Signatures

Files

Genshin Impact.rar
.rar

Password: Setup
Genshin Impact/bin/EOSSDK-Win64-Shipping.dll
.dll windows x64

Password: Setup

99d7cc498283cadd34be8cf722d22e7f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/02/2018, 00:00

Not After

01/03/2021, 23:59

Subject

CN=Epic Games Inc.,O=Epic Games Inc.,L=Raleigh,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

18/02/2018, 00:00

Not After

01/03/2021, 23:59

Subject

CN=Epic Games Inc.,O=Epic Games Inc.,L=Raleigh,ST=North Carolina,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

88:f9:9e:fa:be:71:20:9c:83:f2:69:bd:a7:9b:53:d1:9d:76:7e:14:f7:39:2b:48:47:64:85:38:aa:0e:00:3e
Signer

Actual PE Digest

88:f9:9e:fa:be:71:20:9c:83:f2:69:bd:a7:9b:53:d1:9d:76:7e:14:f7:39:2b:48:47:64:85:38:aa:0e:00:3e

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Epic Games Inc.,O=Epic Games Inc.,L=Raleigh,ST=North Carolina,C=US

23/10/2019, 22:08
Valid: false

0b:ad:32:a6:50:a1:2b:74:b1:14:71:bf:cb:10:49:40:f8:e8:34:ea
Signer

Actual PE Digest

0b:ad:32:a6:50:a1:2b:74:b1:14:71:bf:cb:10:49:40:f8:e8:34:ea

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Epic Games Inc.,O=Epic Games Inc.,L=Raleigh,ST=North Carolina,C=US

23/10/2019, 22:08
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

shutdown
socket
gethostname
WSAStartup
WSACleanup
WSAGetLastError
setsockopt
freeaddrinfo
getnameinfo
inet_pton
sendto
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSASetEvent
WSAWaitForMultipleEvents
WSASetLastError
gethostbyname
__WSAFDIsSet
WSAIoctl
select
recvfrom
recv
ntohs
ntohl
listen
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
WSACreateEvent
WSACloseEvent
bind
getaddrinfo
closesocket
WSAStringToAddressW
WSAAddressToStringW
getprotobyname
inet_addr
accept

winmm

timeGetTime

kernel32

ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetOverlappedResult
WriteFile
ReadFile
RtlCaptureStackBackTrace
VerSetConditionMask
GetStdHandle
GetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFinalPathNameByHandleW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFileTime
OutputDebugStringW
RaiseException
GetLastError
SetThreadErrorMode
PeekNamedPipe
QueryPerformanceFrequency
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
SwitchToThread
GetCurrentThread
OpenThread
SetThreadPriority
SuspendThread
ResumeThread
CreateProcessW
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetNativeSystemInfo
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
AcquireSRWLockShared
GetModuleFileNameW
GetModuleHandleW
TlsGetValue
GetProcAddress
LoadLibraryW
SetThreadAffinityMask
FormatMessageW
MoveFileW
VerifyVersionInfoW
FileTimeToSystemTime
SystemTimeToFileTime
GetUserPreferredUILanguages
GetUserDefaultLocaleName
K32GetProcessMemoryInfo
LoadLibraryExA
DeleteFiber
SwitchToFiber
InitializeCriticalSectionAndSpinCount
GetDateFormatEx
GetTimeFormatEx
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResolveLocaleName
GetCurrencyFormatEx
GetNumberFormatEx
LocaleNameToLCID
LCIDToLocaleName
GetUserGeoID
GetGeoInfoW
GetDynamicTimeZoneInformation
GetLocaleInfoEx
GetACP
LoadLibraryA
GlobalFree
GlobalAlloc
SleepConditionVariableCS
InitializeSRWLock
SetHandleInformation
TlsAlloc
LocalFree
LocalAlloc
CreateThread
CloseHandle
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
QueryPerformanceCounter
DeleteCriticalSection
SetCriticalSectionSpinCount
InitializeCriticalSection
CreateFiber
GetFileType
WakeAllConditionVariable
InitializeConditionVariable
MultiByteToWideChar
SleepEx
SetLastError
TryEnterCriticalSection
FormatMessageA
OutputDebugStringA
IsDebuggerPresent
WideCharToMultiByte
VirtualQuery
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
TlsFree
FreeLibrary
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetTickCount64
InitializeCriticalSectionEx
TlsSetValue
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetFilePointerEx
GetFileSize
VerifyVersionInfoA
GetModuleHandleA
GetSystemDirectoryA
ExpandEnvironmentStringsA
WaitForMultipleObjects
WaitForSingleObjectEx
GetModuleHandleExW

user32

EndDialog
MessageBoxA
DialogBoxParamW
SetWindowTextW
SetWindowPos
UnregisterHotKey
GetUserObjectInformationW
GetTopWindow
GetProcessWindowStation
GetDlgItem
SetDlgItemTextW
GetSystemMetrics
RegisterHotKey
SetForegroundWindow
ScreenToClient
GetWindowRect
MessageBoxW

gdi32

DeleteDC
GetTextExtentPoint32W
CreateCompatibleDC

advapi32

RegQueryValueExA
RegQueryInfoKeyA
RegOpenKeyExA
RegEnumKeyExA
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
DeregisterEventSource
GetUserNameW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW

shell32

ShellExecuteW
SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoTaskMemFree
CoCreateGuid

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

crypt32

CryptMsgGetParam
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringW
CryptQueryObject
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertDuplicateCertificateContext
CertOpenSystemStoreW
CertGetCertificateContextProperty

wintrust

WinVerifyTrust

secur32

AcquireCredentialsHandleA
InitializeSecurityContextA
CompleteAuthToken
DeleteSecurityContext
FreeCredentialsHandle

winhttp

WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser

wldap32

ord30
ord79
ord35
ord301
ord32
ord27
ord200
ord22
ord41
ord50
ord60
ord211
ord46
ord143
ord26
ord33

normaliz

IdnToAscii

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@O@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
_Mtx_init_in_situ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_unlock
_Cnd_init_in_situ
_Cnd_destroy_in_situ
_Cnd_wait
_Cnd_broadcast
?_Throw_C_error@std@@YAXH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?_Xbad_alloc@std@@YAXXZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

bcrypt

BCryptGenRandom

vcruntime140

__std_type_info_name
__RTDynamicCast
__std_terminate
__std_type_info_destroy_list
__RTtypeid
__std_type_info_compare
__CxxFrameHandler3
strchr
memchr
_purecall
memcpy
memmove
memset
wcsstr
strrchr
wcsrchr
wcschr
memcmp
strstr
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

wcstod
_wtoi
strtoull
atoll
strtoll
wcstoul
_wcstoi64
strtod
_strtoi64
_wtof
_wcstoui64
_wtoi64
strtoul
atoi
strtol

api-ms-win-crt-utility-l1-1-0

srand
rand
qsort
div

api-ms-win-crt-string-l1-1-0

strncpy
isalnum
_strnicmp
iswspace
wcsncmp
islower
isprint
isspace
strtok_s
toupper
iswxdigit
strspn
isgraph
strncmp
iswalpha
strnlen
iswdigit
strcmp
isupper
isdigit
strpbrk
wcsncpy
iswalnum
isalpha
strncpy_s
_stricmp
strcspn
tolower
_strdup
isxdigit

api-ms-win-crt-math-l1-1-0

powf
_dtest
round
logf
ceil
floor
pow
trunc
_isnan
_fdopen
modf
sqrt
asin
atan
atan2
sin
tan
log
cos
_dsign
fmod

api-ms-win-crt-runtime-l1-1-0

raise
abort
terminate
signal
_initterm_e
__sys_nerr
_initterm
_cexit
_crt_atexit
_beginthreadex
_getpid
_execute_onexit_table
strerror_s
strerror
_register_onexit_function
_initialize_onexit_table
_errno
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
exit
_exit

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf
_wfopen
__acrt_iob_func
setbuf
clearerr
_lseeki64
__stdio_common_vfwprintf
fflush
fgets
fputc
__stdio_common_vsprintf
fputs
_read
_close
_open
_isatty
feof
fopen
fread
fseek
fclose
ftell
fwrite
ferror
__stdio_common_vsnprintf_s
_open_osfhandle
_write
__stdio_common_vfprintf
_fileno
_setmode
__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

malloc
free
realloc
calloc

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_localtime64_s
_ftime64
_gmtime64
_mktime64
clock
_localtime64
__timezone
_time64
__tzname
_tzset
__daylight

api-ms-win-crt-filesystem-l1-1-0

_fstat64i32
_stat64i32
_fstat64
_stat64
_stat32i64
rename

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

EOS_ActiveSession_CopyInfo
EOS_ActiveSession_Info_Release
EOS_ActiveSession_Release
EOS_Auth_AddNotifyLoginStatusChanged
EOS_Auth_CopyUserAuthToken
EOS_Auth_GetLoggedInAccountByIndex
EOS_Auth_GetLoggedInAccountsCount
EOS_Auth_GetLoginStatus
EOS_Auth_Login
EOS_Auth_Logout
EOS_Auth_RemoveNotifyLoginStatusChanged
EOS_Auth_Token_Release
EOS_Auth_VerifyUserAuth
EOS_Connect_AddNotifyAuthExpiration
EOS_Connect_AddNotifyLoginStatusChanged
EOS_Connect_CreateUser
EOS_Connect_GetExternalAccountMapping
EOS_Connect_GetLoggedInUserByIndex
EOS_Connect_GetLoggedInUsersCount
EOS_Connect_GetLoginStatus
EOS_Connect_LinkAccount
EOS_Connect_Login
EOS_Connect_QueryExternalAccountMappings
EOS_Connect_RemoveNotifyAuthExpiration
EOS_Connect_RemoveNotifyLoginStatusChanged
EOS_EResult_ToString
EOS_Ecom_CatalogItem_Release
EOS_Ecom_CatalogOffer_Release
EOS_Ecom_CatalogRelease_Release
EOS_Ecom_Checkout
EOS_Ecom_CopyEntitlementById
EOS_Ecom_CopyEntitlementByIndex
EOS_Ecom_CopyItemById
EOS_Ecom_CopyItemImageInfoByIndex
EOS_Ecom_CopyItemReleaseByIndex
EOS_Ecom_CopyOfferById
EOS_Ecom_CopyOfferByIndex
EOS_Ecom_CopyOfferItemByIndex
EOS_Ecom_CopyTransactionById
EOS_Ecom_CopyTransactionByIndex
EOS_Ecom_Entitlement_Release
EOS_Ecom_GetEntitlementsCount
EOS_Ecom_GetItemImageInfoCount
EOS_Ecom_GetItemReleaseCount
EOS_Ecom_GetOfferCount
EOS_Ecom_GetOfferItemCount
EOS_Ecom_GetTransactionCount
EOS_Ecom_KeyImageInfo_Release
EOS_Ecom_QueryEntitlements
EOS_Ecom_QueryOffers
EOS_Ecom_QueryOwnership
EOS_Ecom_QueryOwnershipToken
EOS_Ecom_RedeemEntitlements
EOS_Ecom_Transaction_CopyEntitlementByIndex
EOS_Ecom_Transaction_GetEntitlementsCount
EOS_Ecom_Transaction_GetTransactionId
EOS_Ecom_Transaction_Release
EOS_EpicAccountId_FromString
EOS_EpicAccountId_IsValid
EOS_EpicAccountId_ToString
EOS_Friends_AcceptInvite
EOS_Friends_AddNotifyFriendsUpdate
EOS_Friends_GetFriendAtIndex
EOS_Friends_GetFriendsCount
EOS_Friends_GetStatus
EOS_Friends_QueryFriends
EOS_Friends_RejectInvite
EOS_Friends_RemoveNotifyFriendsUpdate
EOS_Friends_SendInvite
EOS_Initialize
EOS_Logging_SetCallback
EOS_Logging_SetLogLevel
EOS_Metrics_BeginPlayerSession
EOS_Metrics_EndPlayerSession
EOS_P2P_AcceptConnection
EOS_P2P_AddNotifyPeerConnectionClosed
EOS_P2P_AddNotifyPeerConnectionRequest
EOS_P2P_CloseConnection
EOS_P2P_CloseConnections
EOS_P2P_GetNATType
EOS_P2P_GetNextReceivedPacketSize
EOS_P2P_QueryNATType
EOS_P2P_ReceivePacket
EOS_P2P_RemoveNotifyPeerConnectionClosed
EOS_P2P_RemoveNotifyPeerConnectionRequest
EOS_P2P_SendPacket
EOS_Platform_CheckForLauncherAndRestart
EOS_Platform_Create
EOS_Platform_GetActiveCountryCode
EOS_Platform_GetActiveLocaleCode
EOS_Platform_GetAuthInterface
EOS_Platform_GetConnectInterface
EOS_Platform_GetEcomInterface
EOS_Platform_GetFriendsInterface
EOS_Platform_GetMetricsInterface
EOS_Platform_GetOverrideCountryCode
EOS_Platform_GetOverrideLocaleCode
EOS_Platform_GetP2PInterface
EOS_Platform_GetPresenceInterface
EOS_Platform_GetSessionsInterface
EOS_Platform_GetUserInfoInterface
EOS_Platform_Release
EOS_Platform_SetOverrideCountryCode
EOS_Platform_SetOverrideLocaleCode
EOS_Platform_Tick
EOS_PresenceModification_DeleteData
EOS_PresenceModification_Release
EOS_PresenceModification_SetData
EOS_PresenceModification_SetRawRichText
EOS_PresenceModification_SetStatus
EOS_Presence_AddNotifyOnPresenceChanged
EOS_Presence_CopyPresence
EOS_Presence_CreatePresenceModification
EOS_Presence_HasPresence
EOS_Presence_Info_Release
EOS_Presence_QueryPresence
EOS_Presence_RemoveNotifyOnPresenceChanged
EOS_Presence_SetPresence
EOS_ProductUserId_FromString
EOS_ProductUserId_IsValid
EOS_ProductUserId_ToString
EOS_SessionDetails_Attribute_Release
EOS_SessionDetails_CopyInfo
EOS_SessionDetails_CopySessionAttributeByIndex
EOS_SessionDetails_GetSessionAttributeCount
EOS_SessionDetails_Info_Release
EOS_SessionDetails_Release
EOS_SessionModification_AddAttribute
EOS_SessionModification_Release
EOS_SessionModification_RemoveAttribute
EOS_SessionModification_SetBucketId
EOS_SessionModification_SetHostAddress
EOS_SessionModification_SetJoinInProgressAllowed
EOS_SessionModification_SetMaxPlayers
EOS_SessionModification_SetPermissionLevel
EOS_SessionSearch_CopySearchResultByIndex
EOS_SessionSearch_Find
EOS_SessionSearch_GetSearchResultCount
EOS_SessionSearch_Release
EOS_SessionSearch_RemoveParameter
EOS_SessionSearch_SetMaxResults
EOS_SessionSearch_SetParameter
EOS_SessionSearch_SetSessionId
EOS_SessionSearch_SetTargetUserId
EOS_Sessions_AddNotifySessionInviteReceived
EOS_Sessions_CopyActiveSessionHandle
EOS_Sessions_CopySessionHandleByInviteId
EOS_Sessions_CreateSessionModification
EOS_Sessions_CreateSessionSearch
EOS_Sessions_DestroySession
EOS_Sessions_DumpSessionState
EOS_Sessions_EndSession
EOS_Sessions_JoinSession
EOS_Sessions_RegisterPlayers
EOS_Sessions_RemoveNotifySessionInviteReceived
EOS_Sessions_SendInvite
EOS_Sessions_StartSession
EOS_Sessions_UnregisterPlayers
EOS_Sessions_UpdateSession
EOS_Sessions_UpdateSessionModification
EOS_Shutdown
EOS_UserInfo_CopyUserInfo
EOS_UserInfo_QueryUserInfo
EOS_UserInfo_QueryUserInfoByDisplayName
EOS_UserInfo_Release

Sections

.text
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 703KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Genshin Impact/bin/GFSDK_ShadowLib.win64.dll
.dll windows x64

Password: Setup

01379a9dac7a0f86e0ad48b2f09cc205

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3dx9_43

D3DXMatrixMultiply
D3DXMatrixLookAtLH
D3DXMatrixPerspectiveOffCenterLH
D3DXMatrixOrthoOffCenterLH
D3DXVec3TransformCoord
D3DXMatrixInverse
D3DXVec4Transform

kernel32

GetCPInfo
CreateFileW
RtlLookupFunctionEntry
RtlUnwindEx
RaiseException
RtlPcToFileHeader
DecodePointer
EncodePointer
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
CloseHandle
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FlsGetValue
FlsFree
SetLastError
FlsAlloc
WriteFile
GetModuleFileNameW
GetACP
GetOEMCP
IsValidCodePage
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
LoadLibraryW
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapReAlloc
WriteConsoleW

Exports

Exports

?NV_ShadowLib_AddBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_BufferDesc@@PEAPEAI@Z
?NV_ShadowLib_AddMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_MapDesc@@PEAPEAI@Z
?NV_ShadowLib_ClearBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI@Z
?NV_ShadowLib_CloseDX@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@@Z
?NV_ShadowLib_CopyBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@W4NV_ShadowLib_Channel@@@Z
?NV_ShadowLib_DevModeClearMapRegion@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUID3D11RenderTargetView@@Ugfsdk_float2@@2@Z
?NV_ShadowLib_DevModeDisplayBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float2@@@Z
?NV_ShadowLib_DevModeDisplayExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@IIIM@Z
?NV_ShadowLib_DevModeDisplayExternalMapFrustum@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@PEAUNV_ShadowLib_ExternalMapDesc@@IUgfsdk_float3@@@Z
?NV_ShadowLib_DevModeDisplayMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@1IIIM@Z
?NV_ShadowLib_DevModeDisplayMapFrustum@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@1IUgfsdk_float3@@@Z
?NV_ShadowLib_DevModeGetMapData@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@PEAUgfsdk_float4x4@@3@Z
?NV_ShadowLib_DevModeToggleDebugCascadeShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugEyeDepthShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_DevModeToggleDebugEyeViewZShader@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI_N@Z
?NV_ShadowLib_FinalizeBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAPEAUID3D11ShaderResourceView@@@Z
?NV_ShadowLib_GetVersion@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@@Z
?NV_ShadowLib_ModulateBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11RenderTargetView@@Ugfsdk_float3@@@Z
?NV_ShadowLib_OpenDX@@YA?AW4NV_ShadowLib_Status@@PEAUNV_ShadowLib_Version@@QEIAUNV_ShadowLib_Ctx@@QEIAUID3D11Device@@QEIAUID3D11DeviceContext@@PEAUgfsdk_new_delete_t@@@Z
?NV_ShadowLib_RemoveBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_RemoveMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAPEAI@Z
?NV_ShadowLib_RenderBuffer@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAI1PEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_RenderBufferUsingExternalMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAUNV_ShadowLib_ExternalMapDesc@@PEAUID3D11ShaderResourceView@@PEAIPEAUNV_ShadowLib_BufferRenderParams@@@Z
?NV_ShadowLib_RenderMap@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUNV_ShadowLib_MapRenderParams@@@Z
?NV_ShadowLib_SetStereoFixUpResource@@YA?AW4NV_ShadowLib_Status@@QEIAUNV_ShadowLib_Ctx@@PEAIPEAUID3D11ShaderResourceView@@@Z

Sections

.text
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Genshin Impact/bin/GFSDK_TXAA.win64.dll
.dll windows x64

Password: Setup

640f87b68fd9c6d4e28131d75044a54a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opengl32

glGenTextures
glTexImage2D
glTexParameteri
glClearColor
glClear
glClearDepth
glReadBuffer
glReadPixels
glDeleteTextures
glBindTexture
glViewport
glPolygonMode
glDisable
glDrawArrays
wglGetProcAddress

kernel32

SetHandleCount
HeapSize
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetModuleFileNameW
WriteFile
LoadLibraryW
HeapReAlloc
GetCurrentThreadId
FlsSetValue
GetCommandLineA
EncodePointer
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
FlsGetValue
FlsFree
SetLastError
GetLastError
FlsAlloc
HeapFree
Sleep
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LeaveCriticalSection
EnterCriticalSection
HeapAlloc

Exports

Exports

TxaaCloseDX
TxaaCloseGL
TxaaOpenDX
TxaaOpenGL
TxaaResolveDX
TxaaResolveGL

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Genshin Impact/bin/d3dcompiler_46.dll
.dll windows x64

Password: Setup

dbf56f70ee344f39500f2f3cafb3ea13

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:0d:af:8d:00:00:00:00:00:28
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

20/02/2012, 21:36

Not After

20/05/2013, 21:46

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c8:a5:88:b8:70:2a:c1:fa:26:78:15:11:d3:c6:d4:09:b4:e6:f7:67:5b:12:45:44:b8:2b:33:11:b3:ce:e6:a4
Signer

Actual PE Digest

c8:a5:88:b8:70:2a:c1:fa:26:78:15:11:d3:c6:d4:09:b4:e6:f7:67:5b:12:45:44:b8:2b:33:11:b3:ce:e6:a4

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/11/2022, 15:46
Valid: false

94:b7:db:a1:d6:23:eb:bb:4f:3a:76:6a:d3:92:75:ff:c9:d1:e7:8e
Signer

Actual PE Digest

94:b7:db:a1:d6:23:eb:bb:4f:3a:76:6a:d3:92:75:ff:c9:d1:e7:8e

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

26/07/2012, 03:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_strtoui64
sscanf
_vsnprintf
_isnan
strtoul
isxdigit
atof
setlocale
_strdup
_mbstrlen
_vsnwprintf
modf
strrchr
isalnum
_finite
_clearfp
_controlfp
malloc
_strnicmp
_fpclass
_purecall
strncmp
isspace
strstr
strchr
free
_stricmp
memmove
qsort
isalpha
toupper
atoi
isdigit
tolower
??2@YAPEAX_K@Z
getenv
??3@YAXPEAX@Z
wcsncmp
_onexit
_wcsicmp
memcpy
memset
fclose
strcpy_s
strcat_s
bsearch
_CxxThrowException
memcmp
_snwprintf_s
wcschr
iswdigit
__unDName
fread
fseek
_wfsopen
vsprintf_s
strncpy_s
wcstol
_wcsnicmp
_wsplitpath_s
towlower
wcscpy_s
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
swprintf_s
wcsncat_s
wcsrchr
_wfullpath
_wmakepath_s
_time64
_chsize
_close
_read
_write
_lseeki64
_get_osfhandle
_open_osfhandle
_wcsdup
wcscat_s
ftell
sprintf_s
_mbscmp
_memicmp
_wgetenv
wcsncpy_s
_wsopen
__CxxFrameHandler3
acos
asin
atan
atan2
ceil
cos
cosh
exp
floor
floorf
fmod
log
pow
sin
sinh
sqrt
tan
tanh

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegOpenKeyExW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExW

kernel32

LeaveCriticalSection
EnterCriticalSection
LocalFree
LocalAlloc
GetVersion
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetLastError
UnhandledExceptionFilter
RtlVirtualUnwind
RtlCaptureContext
GetModuleFileNameA
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
GetFileSize
CreateFileA
GetSystemInfo
VirtualAlloc
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
LCMapStringW
GetFileAttributesW
SetFileAttributesW
CopyFileExW
DeleteFileW
GetFileType
DeviceIoControl
ExpandEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
SetFilePointer
FlushViewOfFile
MapViewOfFileEx
SetUnhandledExceptionFilter
RtlLookupFunctionEntry
DisableThreadLibraryCalls
CreateFileW
GetLastError
GetFileSizeEx
ReadFile
CloseHandle
WriteFile
WideCharToMultiByte
FreeLibrary
lstrcmpiA
MultiByteToWideChar
OutputDebugStringA
QueryPerformanceCounter
HeapCreate
HeapDestroy
HeapAlloc
GetProcessHeap
HeapFree
Sleep
TlsAlloc
TlsSetValue
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
LoadLibraryExW
GetProcAddress

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Genshin Impact/bin/d3dcsx_46.dll
.dll windows x64

Password: Setup

c10c7b3ea786f48e2cc49359624623ea

Code Sign

61:19:cc:93:00:01:00:00:00:66
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:32

Not After

10/01/2013, 20:32

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:05:19:96:00:00:00:00:00:1b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2011, 20:42

Not After

25/10/2012, 20:42

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:9E78-864B-039D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:49:55:00:00:00:00:00:0b
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

10/10/2011, 20:45

Not After

10/01/2013, 20:55

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

67:8c:5e:f1:15:46:5e:80:60:06:65:68:eb:38:41:a8:2e:df:de:f9:20:9f:cf:28:86:1c:76:76:c1:e7:93:55
Signer

Actual PE Digest

67:8c:5e:f1:15:46:5e:80:60:06:65:68:eb:38:41:a8:2e:df:de:f9:20:9f:cf:28:86:1c:76:76:c1:e7:93:55

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

04/11/2022, 15:46
Valid: false

13:85:c6:8d:6e:50:39:3d:2e:84:00:58:3e:0c:c3:8f:3b:43:76:00
Signer

Actual PE Digest

13:85:c6:8d:6e:50:39:3d:2e:84:00:58:3e:0c:c3:8f:3b:43:76:00

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

26/07/2012, 03:09
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

free
??0exception@@QEAA@AEBQEBDH@Z
malloc
_callnewh
_CxxThrowException
memcpy
_XcptFilter
_amsg_exit
_initterm
__C_specific_handler
memset
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
isleadbyte
_fileno
_snprintf
_itoa
wctomb
__badioinfo
__pioinfo
_isatty
_write
_lseeki64
_iob
_vscprintf
_purecall
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBV0@@Z
__CxxFrameHandler
_errno
_strtoui64
_vsnprintf
memmove
ceil
log
memcmp

kernel32

GetLastError
LoadLibraryExW
FreeLibrary
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
VirtualProtect
Sleep
DisableThreadLibraryCalls
GetProcAddress

Exports

Exports

D3DX11CreateFFT
D3DX11CreateFFT1DComplex
D3DX11CreateFFT1DReal
D3DX11CreateFFT2DComplex
D3DX11CreateFFT2DReal
D3DX11CreateFFT3DComplex
D3DX11CreateFFT3DReal
D3DX11CreateScan
D3DX11CreateSegmentedScan

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 780KB - Virtual size: 782KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Genshin Impact/key.txt
Genshin Impact/setup.exe
.exe windows x86

Password: Setup

b11acca9560fed16383fa71b92439615

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
CreateSemaphoreW
DeleteCriticalSection
EnterCriticalSection
FreeConsole
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
QueryPerformanceCounter
ReleaseSemaphore
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte

msvcrt

___mb_cur_max_func
__doserrno
__getmainargs
__initenv
__lconv_init
__p__acmdln
__p__fmode
__pioinfo
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_errno
_fdopen
_filelengthi64
_fileno
_fileno
_fstat64
_initterm
_iob
_lseeki64
_onexit
_read
_strnicmp
_write
_write
abort
atoi
calloc
exit
fclose
fflush
fgetpos
fopen
fprintf
fputc
fputs
fread
free
fsetpos
fwrite
getc
getwc
isspace
iswctype
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
putc
putwc
realloc
setlocale
setvbuf
signal
sprintf
strchr
strcmp
strcoll
strerror
strftime
strlen
strncmp
strtoul
strxfrm
towlower
towupper
ungetc
ungetwc
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm

Sections

.text
Size: 672KB - Virtual size: 671KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 143KB - Virtual size: 142KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

/14
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/29
Size: 161KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/41
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/55
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/67
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/80
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/91
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/102
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: Setup

Password: Setup

99d7cc498283cadd34be8cf722d22e7f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

88:f9:9e:fa:be:71:20:9c:83:f2:69:bd:a7:9b:53:d1:9d:76:7e:14:f7:39:2b:48:47:64:85:38:aa:0e:00:3eSigner

Signature Validations

Verification

23/10/2019, 22:08 Valid: false

0b:ad:32:a6:50:a1:2b:74:b1:14:71:bf:cb:10:49:40:f8:e8:34:eaSigner

Signature Validations

Verification

23/10/2019, 22:08 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

winmm

kernel32

user32

gdi32

advapi32

shell32

ole32

iphlpapi

crypt32

wintrust

secur32

winhttp

wldap32

normaliz

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

Exports

Exports

Sections

.text Size: 6.9MB - Virtual size: 6.9MB

.rdata Size: 2.0MB - Virtual size: 2.0MB

.data Size: 104KB - Virtual size: 703KB

.pdata Size: 366KB - Virtual size: 366KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

51:02:9b:3b:9c:b4:8f:a0:76:fa:2d:a8:7a:91:db:42
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

88:f9:9e:fa:be:71:20:9c:83:f2:69:bd:a7:9b:53:d1:9d:76:7e:14:f7:39:2b:48:47:64:85:38:aa:0e:00:3e
Signer

23/10/2019, 22:08
Valid: false

0b:ad:32:a6:50:a1:2b:74:b1:14:71:bf:cb:10:49:40:f8:e8:34:ea
Signer

23/10/2019, 22:08
Valid: false

.text
Size: 6.9MB - Virtual size: 6.9MB

.rdata
Size: 2.0MB - Virtual size: 2.0MB

.data
Size: 104KB - Virtual size: 703KB

.pdata
Size: 366KB - Virtual size: 366KB

_RDATA
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 71KB - Virtual size: 70KB

.reloc
Size: 69KB - Virtual size: 69KB

.text
Size: 94KB - Virtual size: 93KB

.rdata
Size: 3.7MB - Virtual size: 3.7MB

.data
Size: 11KB - Virtual size: 19KB

.pdata
Size: 5KB - Virtual size: 4KB

text
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 6KB - Virtual size: 6KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 790B

61:19:cc:93:00:01:00:00:00:66
Certificate

61:0d:af:8d:00:00:00:00:00:28
Certificate

61:33:26:1a:00:00:00:00:00:31
Certificate

61:16:68:34:00:00:00:00:00:1c
Certificate

61:05:49:55:00:00:00:00:00:0b
Certificate

61:0c:52:4c:00:00:00:00:00:03
Certificate

c8:a5:88:b8:70:2a:c1:fa:26:78:15:11:d3:c6:d4:09:b4:e6:f7:67:5b:12:45:44:b8:2b:33:11:b3:ce:e6:a4
Signer

04/11/2022, 15:46
Valid: false

94:b7:db:a1:d6:23:eb:bb:4f:3a:76:6a:d3:92:75:ff:c9:d1:e7:8e
Signer

26/07/2012, 03:09
Valid: false