Extracted

• Ow2.exe

  .exe windows x64

  54a2beb60374430eea9f4a356cb9879c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  secur32

  LsaGetLogonSessionData

  LsaFreeReturnBuffer

  LsaEnumerateLogonSessions

  kernel32

  FreeLibrary

  GetFileInformationByHandleEx

  AddVectoredExceptionHandler

  SetThreadStackGuarantee

  HeapAlloc

  GetProcessHeap

  HeapFree

  HeapReAlloc

  CreateDirectoryW

  ReleaseSRWLockExclusive

  GetModuleHandleW

  SleepConditionVariableSRW

  SetLastError

  GetFinalPathNameByHandleW

  TryAcquireSRWLockExclusive

  GetQueuedCompletionStatusEx

  CreateIoCompletionPort

  SetFileCompletionNotificationModes

  GetSystemInfo

  WakeConditionVariable

  GetFileInformationByHandle

  GetModuleHandleA

  GetCurrentThread

  GetStdHandle

  GetConsoleMode

  WaitForSingleObject

  WriteConsoleW

  WaitForSingleObjectEx

  LoadLibraryA

  CreateMutexA

  GetCurrentProcess

  ReleaseMutex

  GetEnvironmentVariableW

  RtlLookupFunctionEntry

  FormatMessageW

  GetTempPathW

  CreateFileW

  SetFilePointerEx

  GetFullPathNameW

  FindNextFileW

  FindFirstFileW

  FindClose

  SetHandleInformation

  CreateThread

  ExitProcess

  QueryPerformanceFrequency

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  GetCurrentDirectoryW

  RtlCaptureContext

  AcquireSRWLockShared

  SetFileInformationByHandle

  DuplicateHandle

  CopyFileExW

  GetDriveTypeW

  GetVolumeInformationW

  GetDiskFreeSpaceExW

  DeviceIoControl

  OpenProcess

  ReadProcessMemory

  GetProcessTimes

  GetSystemTimes

  GetProcessIoCounters

  GetProcAddress

  VirtualQueryEx

  GetTickCount64

  GetLogicalDrives

  GlobalMemoryStatusEx

  PostQueuedCompletionStatus

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  SleepEx

  GetSystemDirectoryA

  GetTickCount

  Sleep

  MultiByteToWideChar

  WideCharToMultiByte

  MoveFileExA

  GetEnvironmentVariableA

  VerSetConditionMask

  VerifyVersionInfoW

  CreateFileA

  GetFileSizeEx

  ReadFile

  RtlVirtualUnwind

  FlushFileBuffers

  MapViewOfFile

  CreateFileMappingW

  FormatMessageA

  GetSystemTime

  SystemTimeToFileTime

  GetCurrentProcessId

  GetFileSize

  LockFileEx

  UnlockFile

  HeapDestroy

  HeapCompact

  LoadLibraryW

  DeleteFileW

  DeleteFileA

  FlushViewOfFile

  OutputDebugStringW

  GetFileAttributesExW

  GetFileAttributesA

  GetDiskFreeSpaceA

  GetTempPathA

  HeapSize

  HeapValidate

  UnmapViewOfFile

  GetFileAttributesW

  CreateMutexW

  UnlockFileEx

  SetEndOfFile

  GetFullPathNameA

  SetFilePointer

  LockFile

  OutputDebugStringA

  GetDiskFreeSpaceW

  WriteFile

  HeapCreate

  AreFileApisANSI

  InitializeCriticalSection

  TryEnterCriticalSection

  GetCurrentThreadId

  TerminateProcess

  LoadLibraryExW

  GetComputerNameExW

  GetUserPreferredUILanguages

  WakeAllConditionVariable

  GetLastError

  ReleaseSRWLockShared

  AcquireSRWLockExclusive

  SwitchToThread

  CloseHandle

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  LocalFree

  InitializeSListHead

  IsProcessorFeaturePresent

  advapi32

  CryptDestroyHash

  CryptHashData

  CryptCreateHash

  CryptGetHashParam

  CryptReleaseContext

  CryptAcquireContextA

  GetUserNameW

  LookupAccountSidW

  GetTokenInformation

  OpenProcessToken

  SystemFunction036

  RegQueryValueExW

  RegOpenKeyExW

  oleaut32

  SysFreeString

  SysAllocStringLen

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayAccessData

  SysAllocString

  SafeArrayDestroy

  SafeArrayUnaccessData

  VariantClear

  ws2_32

  htonl

  listen

  WSASetLastError

  ioctlsocket

  socket

  __WSAFDIsSet

  accept

  ntohs

  shutdown

  recv

  send

  getsockname

  WSASend

  WSARecv

  select

  getsockopt

  WSACleanup

  WSAStartup

  freeaddrinfo

  getaddrinfo

  setsockopt

  WSASocketW

  bind

  WSACloseEvent

  WSACreateEvent

  connect

  WSAGetLastError

  recvfrom

  WSAEnumNetworkEvents

  WSAIoctl

  WSAEventSelect

  WSAResetEvent

  closesocket

  WSAWaitForMultipleEvents

  htons

  getpeername

  pdh

  PdhRemoveCounter

  PdhCollectQueryData

  PdhCloseQuery

  PdhOpenQueryA

  PdhGetFormattedCounterValue

  PdhAddEnglishCounterW

  crypt32

  CryptStringToBinaryA

  CertFreeCertificateChain

  CertFindCertificateInStore

  CryptDecodeObjectEx

  CertAddCertificateContextToStore

  CryptUnprotectData

  CertFindExtension

  CertGetNameStringA

  CryptQueryObject

  CertCreateCertificateChainEngine

  PFXImportCertStore

  CertGetCertificateChain

  CertFreeCertificateChainEngine

  CertOpenStore

  CertEnumCertificatesInStore

  CertFreeCertificateContext

  CertDuplicateCertificateContext

  CertGetEnhancedKeyUsage

  CertCloseStore

  user32

  GetMonitorInfoW

  EnumDisplaySettingsExW

  EnumDisplayMonitors

  gdi32

  CreateCompatibleDC

  CreateCompatibleBitmap

  SelectObject

  StretchBlt

  GetDIBits

  GetObjectW

  DeleteObject

  CreateDCW

  GetDeviceCaps

  DeleteDC

  SetStretchBltMode

  shell32

  SHGetKnownFolderPath

  CommandLineToArgvW

  ole32

  CoTaskMemFree

  CoInitializeSecurity

  CoUninitialize

  CoInitializeEx

  CoCreateInstance

  CoSetProxyBlanket

  bcrypt

  BCryptOpenAlgorithmProvider

  BCryptCloseAlgorithmProvider

  BCryptGenRandom

  ntdll

  NtQuerySystemInformation

  NtDeviceIoControlFile

  NtCancelIoFileEx

  RtlGetVersion

  RtlNtStatusToDosError

  NtQueryInformationProcess

  NtCreateFile

  iphlpapi

  FreeMibTable

  GetIfTable2

  GetIfEntry2

  netapi32

  NetUserEnum

  NetUserGetLocalGroups

  NetApiBufferFree

  powrprof

  CallNtPowerInformation

  psapi

  GetModuleFileNameExW

  GetPerformanceInfo

  EnumProcessModulesEx

  vcruntime140

  strstr

  memset

  strrchr

  strchr

  memchr

  __C_specific_handler

  memcmp

  memcpy

  __CxxFrameHandler3

  __current_exception

  __current_exception_context

  memmove

  api-ms-win-crt-string-l1-1-0

  strcmp

  strcpy

  strncmp

  wcslen

  strlen

  strspn

  strcspn

  _strdup

  strncpy

  strpbrk

  api-ms-win-crt-heap-l1-1-0

  _msize

  free

  realloc

  calloc

  malloc

  _set_new_mode

  api-ms-win-crt-runtime-l1-1-0

  __sys_nerr

  _initialize_onexit_table

  _register_onexit_function

  __sys_errlist

  _crt_atexit

  _register_thread_local_exe_atexit_callback

  _cexit

  __p___argv

  __p___argc

  terminate

  _exit

  exit

  _initterm_e

  _initterm

  _get_initial_narrow_environment

  _initialize_narrow_environment

  _configure_narrow_argv

  abort

  _set_app_type

  _seh_filter_exe

  _endthreadex

  _c_exit

  _wassert

  _beginthreadex

  _errno

  api-ms-win-crt-convert-l1-1-0

  strtol

  strtoul

  wcstombs

  strtoll

  atoi

  api-ms-win-crt-stdio-l1-1-0

  __p__commode

  __stdio_common_vsprintf

  _read

  _write

  fflush

  fwrite

  _close

  _lseeki64

  fseek

  fread

  fgets

  _set_fmode

  ftell

  _open

  fputc

  fopen

  feof

  __acrt_iob_func

  __stdio_common_vsscanf

  fclose

  fputs

  api-ms-win-crt-utility-l1-1-0

  _rotl64

  qsort

  api-ms-win-crt-time-l1-1-0

  _localtime64_s

  _time64

  strftime

  _gmtime64

  api-ms-win-crt-filesystem-l1-1-0

  _access

  _unlink

  _fstat64

  _stat64

  api-ms-win-crt-math-l1-1-0

  log

  _fdopen

  __setusermatherr

  _dclass

  api-ms-win-crt-locale-l1-1-0

  _configthreadlocale

  Sections

  .text

  Size: 3.4MB - Virtual size: 3.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.6MB - Virtual size: 1.6MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 30KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 98KB - Virtual size: 98KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 40KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ