QtNythNetRpz[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

QtNythNetRpz.exe
Size

15.5MB
MD5

5cdbfc37c91bdde8f9221c111fc40f49
SHA1

392e2d5f4df5a5e5337636cc13d4e465381fc0f5
SHA256

9aca8955a6b3536fd51147d20fc4263c9a3bc300593fbf7f97397401167876e5
SHA512

c69df223e48a07c2794d5291261581e74b95bd5ba5af3d9ce376a0a5d12d0f68c4217ecbb9974bdf069c0300418f2c1ad28c78ad4b5c071e7830a25ba3616430
SSDEEP

98304:O3DQ3pF3qg5WXT5R2GZHmk35ZZGE2Swowlkh1jSHFVRcMC4hg9FChBw5+k7tnWqq:2DS1k5RFZGo5ZR2SL8VRcMC4hAsQbfze

Score

1^/10

Malware Config

Signatures

Files

QtNythNetRpz.exe
.exe windows x64

8ab722845b0e9b3e3159af57cbdc68bd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ws2_32

WSARecv
WSASocketW
connect
select
getsockopt
WSASend
setsockopt
WSACleanup
closesocket
htonl
ntohl
htons
WSASetLastError
WSAStringToAddressW
WSAGetLastError
WSAStartup
ioctlsocket

kernel32

GetCurrentProcessId
GetDynamicTimeZoneInformation
WriteFile
WriteConsoleA
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
GetStdHandle
GetConsoleMode
GetCurrentThreadId
WideCharToMultiByte
LocalFree
FormatMessageW
FormatMessageA
GetLastError
PostQueuedCompletionStatus
GetQueuedCompletionStatus
SetLastError
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
TlsFree
TlsAlloc
TlsSetValue
TlsGetValue
CloseHandle
WaitForSingleObject
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
VerifyVersionInfoA
VerSetConditionMask
QueueUserAPC
TerminateThread
WaitForMultipleObjects
MultiByteToWideChar
GetModuleHandleA
Sleep
GetProcAddress
VirtualFree
VirtualAlloc
LoadLibraryA
LoadLibraryExA
GetFileAttributesW
DeviceIoControl
GlobalLock
GlobalUnlock
GlobalAlloc
GetCurrentProcess
QueryPerformanceFrequency
QueryPerformanceCounter
FreeLibrary
VerifyVersionInfoW
CreateEventA
GetFullPathNameW
SetFileInformationByHandle
GetTempPathW
AreFileApisANSI
GetModuleHandleW
GetFileInformationByHandleEx
GetLocaleInfoEx
HeapFree
GetProcessHeap
ResetEvent
WaitForSingleObjectEx
WaitForMultipleObjectsEx
OpenEventA
CreateWaitableTimerA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
FindFirstFileW
FindClose
CreateFileW
ReadProcessMemory
GlobalFree
GetFileAttributesExW
GetSystemInfo
CreateFileA
InitializeCriticalSection

user32

GetDesktopWindow
RegisterClassExA
CreateWindowExA
UnregisterClassA
GetWindowRect
UpdateWindow
PeekMessageA
TranslateMessage
DispatchMessageA
ShowWindow
DestroyWindow
GetAsyncKeyState
SetLayeredWindowAttributes
SetWindowLongW
GetWindowLongW
SetWindowTextW
IsIconic
SetFocus
SetForegroundWindow
BringWindowToTop
SetWindowPos
PostQuitMessage
DefWindowProcA
OpenClipboard
GetClipboardData
CloseClipboard
EmptyClipboard
SetClipboardData
SetCursor
LoadCursorA
ClientToScreen
SetCursorPos
GetCursorPos
GetForegroundWindow
IsChild
ScreenToClient
WindowFromPoint
GetMonitorInfoA
EnumDisplayMonitors
GetClientRect
GetKeyState
GetCapture
SetWindowLongA
AdjustWindowRectEx
MonitorFromWindow
ReleaseDC
GetDC
ReleaseCapture
SetCapture

gdi32

GetDeviceCaps

advapi32

AdjustTokenPrivileges
SystemFunction036
RegOpenKeyExA
OpenProcessToken
RegCloseKey
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
LookupPrivilegeValueW
RegDeleteKeyA
RegOpenKeyA

msvcp140

??0?$codecvt@DDU_Mbstatet@@@std@@QEAA@_K@Z
?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
??1?$codecvt@DDU_Mbstatet@@@std@@MEAA@XZ
?do_length@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@_WDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?pubimbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Thrd_id
_Cnd_signal
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Cnd_destroy_in_situ
_Mtx_destroy_in_situ
_Xtime_get_ticks
_Mtx_init_in_situ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
??1_Locinfo@std@@QEAA@XZ
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Xbad_alloc@std@@YAXXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
_Query_perf_counter
_Query_perf_frequency
_Thrd_sleep
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?uncaught_exceptions@std@@YAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?pubsync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?sgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?do_max_length@codecvt_base@std@@MEBAHXZ
?do_in@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?do_out@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?do_encoding@codecvt_base@std@@MEBAHXZ
?do_length@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEBD1_K@Z
?do_unshift@?$codecvt@DDU_Mbstatet@@@std@@MEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z

d3d9

Direct3DCreate9

ntdll

RtlInitAnsiString
RtlInitUnicodeString
RtlAnsiStringToUnicodeString
NtQuerySystemInformation
NtUnloadDriver
NtLoadDriver

imm32

ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
memcmp
_CxxThrowException
memmove
memcpy
memset
__std_type_info_name
memchr
strstr
__std_type_info_compare
__C_specific_handler
_purecall
__std_exception_destroy
__std_exception_copy
__std_terminate

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_register_onexit_function
abort
_get_narrow_winmain_command_line
_initterm
_initterm_e
_set_app_type
_invalid_parameter_noinfo_noreturn
terminate
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_c_exit
_seh_filter_exe
_initialize_onexit_table
_cexit
_errno
_crt_atexit
_exit
exit
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode
__stdio_common_vsprintf
__stdio_common_vsprintf_s
fgetc
ungetc
fread
_fseeki64
fgetpos
fsetpos
setvbuf
fflush
fputc
fwrite
fclose
_get_stream_buffer_pointers
__stdio_common_vsscanf
fseek
ftell
__acrt_iob_func
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
_wfopen

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64_s
_localtime64_s

api-ms-win-crt-heap-l1-1-0

malloc
calloc
free
_set_new_mode
_callnewh

api-ms-win-crt-math-l1-1-0

sinf
ceilf
acosf
cosf
_dclass
_ldclass
_fdclass
__setusermatherr
sqrtf
_dsign
fmodf

api-ms-win-crt-string-l1-1-0

strcmp
_stricmp
strncpy
isdigit
strncmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file

api-ms-win-crt-convert-l1-1-0

strtof
strtol

api-ms-win-crt-utility-l1-1-0

rand
qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func

Exports

Exports

??0?$codecvt_null@_W@archive@boost@@QEAA@_K@Z
??0?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@QEAA@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@QEAA@XZ
??0?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@QEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Uencrypted_msg@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Ufunctions_struct@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??0?$singleton@V?$extended_type_info_typeid@Uloader_struct@Server@@@serialization@boost@@@serialization@boost@@IEAA@XZ
??1?$codecvt_null@_W@archive@boost@@UEAA@XZ
??_F?$codecvt_null@_W@archive@boost@@QEAAXXZ
?do_always_noconv@?$codecvt_null@_W@archive@boost@@EEBA_NXZ
?do_encoding@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_in@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?do_max_length@?$codecvt_null@_W@archive@boost@@EEBAHXZ
?do_out@?$codecvt_null@_W@archive@boost@@EEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uencrypted_msg@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Uencrypted_msg@Server@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Ufunctions_struct@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Ufunctions_struct@Server@@@23@XZ
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uloader_struct@Server@@@serialization@boost@@@serialization@boost@@SAAEBV?$extended_type_info_typeid@Uloader_struct@Server@@@23@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEBV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEBV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@3@XZ
?get_const_instance@?$singleton@V?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@@serialization@boost@@SAAEBV?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@3@XZ
?get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAEAV?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@XZ
?get_mutable_instance@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAEAV?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ
?is_destroyed@?$singleton@V?$map@Vbinary_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$map@Vbinary_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PEBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_destroyed@?$singleton@V?$multiset@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PEBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ
?is_locked@singleton_module@serialization@boost@@QEAA_NXZ
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?load_object_data@?$iserializer@Vbinary_iarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_iarchive@234@PEAXI@Z
?lock@?1??get_lock@singleton_module@serialization@boost@@AEAAAEA_NXZ@4_NA
?lock@singleton_module@serialization@boost@@QEAAXXZ
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Uencrypted_msg@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Ufunctions_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?save_object_data@?$oserializer@Vbinary_oarchive@archive@boost@@Uloader_struct@Server@@@detail@archive@boost@@UEBAXAEAVbasic_oarchive@234@PEBX@Z
?unlock@singleton_module@serialization@boost@@QEAAXXZ

Sections

.text
Size: 762KB - Virtual size: 762KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.vm_sec
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vlizer
Size: 4.4MB - Virtual size: 14.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

8ab722845b0e9b3e3159af57cbdc68bd

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

kernel32

user32

gdi32

advapi32

msvcp140

d3d9

ntdll

imm32

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 762KB - Virtual size: 762KB

.rdata Size: 187KB - Virtual size: 186KB

.data Size: 21KB - Virtual size: 27KB

.pdata Size: 30KB - Virtual size: 30KB

.rsrc Size: 194KB - Virtual size: 194KB

.reloc Size: - Virtual size: 2KB

.vm_sec Size: 64KB - Virtual size: 64KB

.vlizer Size: 4.4MB - Virtual size: 14.2MB

.text
Size: 762KB - Virtual size: 762KB

.rdata
Size: 187KB - Virtual size: 186KB

.data
Size: 21KB - Virtual size: 27KB

.pdata
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 194KB - Virtual size: 194KB

.reloc
Size: - Virtual size: 2KB

.vm_sec
Size: 64KB - Virtual size: 64KB

.vlizer
Size: 4.4MB - Virtual size: 14.2MB