General

Malware Config

Signatures

Files

• Downloads.zip

  .zip
• 1111111111111111111111.exe

  .exe windows:5 windows x86

  0db8876464e8e995f3ae002d75c7bbeb

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  lstrlenW

  InterlockedExchange

  ResetEvent

  CreateEventW

  CancelIo

  TryEnterCriticalSection

  SetWaitableTimer

  CreateWaitableTimerW

  GetCurrentProcess

  GetProcessHeap

  OpenProcess

  GetModuleFileNameW

  GetCurrentProcessId

  LocalFree

  GetThreadContext

  SetThreadContext

  GetFileAttributesA

  GetExitCodeProcess

  CreateProcessA

  GetSystemDirectoryA

  VirtualAllocEx

  WriteProcessMemory

  ResumeThread

  FreeLibrary

  GetProcAddress

  VirtualProtect

  CreateMutexW

  FindFirstFileW

  SetUnhandledExceptionFilter

  SystemTimeToFileTime

  WideCharToMultiByte

  CreateDirectoryW

  GlobalLock

  WriteFile

  GlobalAlloc

  LoadLibraryW

  GetConsoleWindow

  FileTimeToSystemTime

  CreateFileW

  lstrcmpW

  GlobalUnlock

  GlobalFree

  FindClose

  GetLocalTime

  RemoveDirectoryW

  lstrcatW

  IsDebuggerPresent

  FindNextFileW

  GetFileTime

  DeleteFileW

  GetSystemTime

  SetFileAttributesW

  CreateThread

  FlushFileBuffers

  WriteConsoleW

  SetStdHandle

  LCMapStringW

  MultiByteToWideChar

  GetConsoleMode

  GetConsoleCP

  SetFilePointer

  RtlUnwind

  SetLastError

  SwitchToThread

  GetCurrentThreadId

  CloseHandle

  GetLastError

  CreateEventA

  Sleep

  WaitForSingleObject

  SetEvent

  DeleteCriticalSection

  EnterCriticalSection

  HeapCreate

  LeaveCriticalSection

  HeapDestroy

  InitializeCriticalSectionAndSpinCount

  InterlockedCompareExchange

  HeapFree

  InterlockedDecrement

  InterlockedIncrement

  HeapAlloc

  VirtualAlloc

  GlobalSize

  VirtualFree

  GetSystemTimeAsFileTime

  GetTickCount

  QueryPerformanceCounter

  GetStartupInfoW

  GetFileType

  SetHandleCount

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetStringTypeW

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetStdHandle

  ExitProcess

  IsProcessorFeaturePresent

  UnhandledExceptionFilter

  TerminateProcess

  RaiseException

  HeapSetInformation

  GetCommandLineW

  VirtualQuery

  GetSystemInfo

  GetModuleHandleW

  EncodePointer

  DecodePointer

  ExitThread

  HeapSize

  HeapReAlloc

  user32

  PeekMessageW

  TranslateMessage

  MsgWaitForMultipleObjects

  GetSystemMetrics

  ShowWindow

  GetDesktopWindow

  ReleaseDC

  GetInputState

  GetDC

  wsprintfW

  PostThreadMessageA

  DispatchMessageW

  gdi32

  CreateDIBSection

  GetDeviceCaps

  StretchBlt

  GetDIBits

  SetDIBColorTable

  DeleteObject

  SelectObject

  CreateCompatibleDC

  CreateCompatibleBitmap

  GetObjectW

  SetStretchBltMode

  DeleteDC

  advapi32

  RegOpenKeyExW

  RegDeleteValueW

  RegQueryValueExW

  RegCreateKeyW

  RegCloseKey

  RegSetValueExW

  shell32

  SHGetFolderPathW

  ole32

  CreateStreamOnHGlobal

  GetHGlobalFromStream

  ws2_32

  WSAEnumNetworkEvents

  WSAEventSelect

  WSACloseEvent

  WSACreateEvent

  WSASetLastError

  WSAResetEvent

  WSAWaitForMultipleEvents

  WSAGetLastError

  connect

  WSAStartup

  select

  htons

  setsockopt

  WSACleanup

  recv

  socket

  closesocket

  WSAIoctl

  send

  shutdown

  gethostbyname

  winmm

  timeGetTime

  gdiplus

  GdipGetImagePixelFormat

  GdipCreateBitmapFromStream

  GdipGetImagePalette

  GdiplusShutdown

  GdipSaveImageToStream

  GdipFree

  GdipGetImageHeight

  GdipCreateBitmapFromScan0

  GdipDeleteGraphics

  GdipGetImageGraphicsContext

  GdipBitmapUnlockBits

  GdiplusStartup

  GdipGetImageWidth

  GdipCloneImage

  GdipBitmapLockBits

  GdipGetImagePaletteSize

  GdipGetImageEncoders

  GdipCreateBitmapFromHBITMAP

  GdipDisposeImage

  GdipGetImageEncodersSize

  GdipAlloc

  GdipDrawImageI

  Sections

  .text

  Size: 89KB - Virtual size: 88KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 19KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 169KB - Virtual size: 185KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• 9VIcoCiitn.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 412KB - Virtual size: 411KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• Microsoft Windows.com

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Code Sign

  71:df:91:d2:f9:c0:f1:09:2c:60:98:e4:7c:d5:57:5e

  Certificate

  Issuer

  CN=chinaniubi,C=CN

  Not Before

  30-09-2023 20:58

  Not After

  30-09-2024 20:58

  Subject

  CN=chinaniubi,C=CN

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

  Certificate

  Issuer

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  03-05-2023 00:00

  Not After

  02-08-2034 23:59

  Subject

  CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

  Certificate

  Issuer

  CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

  Not Before

  02-05-2019 00:00

  Not After

  18-01-2038 23:59

  Subject

  CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  f9:63:10:a2:17:a2:99:ad:4f:7b:3e:f4:c9:20:f7:82:f0:d3:9e:e0:2a:52:58:97:46:e7:db:a2:ae:32:5f:4b

  Signer

  Actual PE Digest

  f9:63:10:a2:17:a2:99:ad:4f:7b:3e:f4:c9:20:f7:82:f0:d3:9e:e0:2a:52:58:97:46:e7:db:a2:ae:32:5f:4b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 1.7MB - Virtual size: 1.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• New.exe

  .exe windows:5 windows x86

  870b8e75c7190e202e9c6c81dff1040c

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  wsock32

  __WSAFDIsSet

  setsockopt

  ntohs

  recvfrom

  sendto

  htons

  select

  listen

  WSAStartup

  bind

  closesocket

  connect

  socket

  send

  WSACleanup

  ioctlsocket

  accept

  WSAGetLastError

  inet_addr

  gethostbyname

  gethostname

  recv

  version

  VerQueryValueW

  GetFileVersionInfoW

  GetFileVersionInfoSizeW

  winmm

  timeGetTime

  waveOutSetVolume

  mciSendStringW

  comctl32

  ImageList_Remove

  ImageList_SetDragCursorImage

  ImageList_BeginDrag

  ImageList_DragEnter

  ImageList_DragLeave

  ImageList_EndDrag

  ImageList_DragMove

  ImageList_ReplaceIcon

  ImageList_Create

  InitCommonControlsEx

  ImageList_Destroy

  mpr

  WNetCancelConnection2W

  WNetGetConnectionW

  WNetAddConnection2W

  WNetUseConnectionW

  wininet

  InternetReadFile

  InternetCloseHandle

  InternetOpenW

  InternetSetOptionW

  InternetCrackUrlW

  HttpQueryInfoW

  InternetConnectW

  HttpOpenRequestW

  HttpSendRequestW

  FtpOpenFileW

  FtpGetFileSize

  InternetOpenUrlW

  InternetQueryOptionW

  InternetQueryDataAvailable

  psapi

  EnumProcesses

  GetModuleBaseNameW

  GetProcessMemoryInfo

  EnumProcessModules

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  UnloadUserProfile

  LoadUserProfileW

  kernel32

  HeapAlloc

  Sleep

  GetCurrentThreadId

  RaiseException

  MulDiv

  GetVersionExW

  GetSystemInfo

  MultiByteToWideChar

  WideCharToMultiByte

  GetModuleHandleW

  QueryPerformanceCounter

  VirtualFreeEx

  OpenProcess

  VirtualAllocEx

  WriteProcessMemory

  ReadProcessMemory

  CreateFileW

  SetFilePointerEx

  ReadFile

  WriteFile

  FlushFileBuffers

  TerminateProcess

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  SetFileTime

  GetFileAttributesW

  FindFirstFileW

  FindClose

  DeleteFileW

  FindNextFileW

  lstrcmpiW

  MoveFileW

  CopyFileW

  CreateDirectoryW

  RemoveDirectoryW

  SetSystemPowerState

  QueryPerformanceFrequency

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  GetProcessHeap

  OutputDebugStringW

  GetLocalTime

  CompareStringW

  CompareStringA

  InterlockedIncrement

  InterlockedDecrement

  DeleteCriticalSection

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetStdHandle

  CreatePipe

  InterlockedExchange

  TerminateThread

  GetTempPathW

  GetTempFileNameW

  VirtualFree

  FormatMessageW

  GetExitCodeProcess

  SetErrorMode

  GetPrivateProfileStringW

  WritePrivateProfileStringW

  GetPrivateProfileSectionW

  WritePrivateProfileSectionW

  GetPrivateProfileSectionNamesW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  SystemTimeToFileTime

  LocalFileTimeToFileTime

  GetDriveTypeW

  GetDiskFreeSpaceExW

  GetDiskFreeSpaceW

  GetVolumeInformationW

  SetVolumeLabelW

  CreateHardLinkW

  DeviceIoControl

  SetFileAttributesW

  GetShortPathNameW

  CreateEventW

  SetEvent

  GetEnvironmentVariableW

  SetEnvironmentVariableW

  GlobalLock

  GlobalUnlock

  GlobalAlloc

  GetFileSize

  GlobalFree

  GlobalMemoryStatusEx

  Beep

  GetComputerNameW

  GetWindowsDirectoryW

  GetSystemDirectoryW

  GetCurrentProcessId

  GetCurrentThread

  GetProcessIoCounters

  CreateProcessW

  SetPriorityClass

  LoadLibraryW

  VirtualAlloc

  LoadLibraryExW

  HeapFree

  WaitForSingleObject

  CreateThread

  DuplicateHandle

  GetLastError

  CloseHandle

  GetCurrentProcess

  GetProcAddress

  LoadLibraryA

  FreeLibrary

  GetModuleFileNameW

  GetFullPathNameW

  ExitProcess

  ExitThread

  GetSystemTimeAsFileTime

  SetCurrentDirectoryW

  IsDebuggerPresent

  GetCurrentDirectoryW

  ResumeThread

  GetStartupInfoW

  TlsGetValue

  TlsAlloc

  TlsSetValue

  TlsFree

  SetLastError

  HeapSize

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetModuleFileNameA

  HeapReAlloc

  HeapCreate

  SetHandleCount

  GetFileType

  GetStartupInfoA

  SetStdHandle

  GetConsoleCP

  GetConsoleMode

  LCMapStringW

  LCMapStringA

  RtlUnwind

  SetFilePointer

  GetTimeZoneInformation

  GetTimeFormatA

  GetDateFormatA

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  GetCommandLineW

  GetTickCount

  GetStringTypeA

  GetStringTypeW

  GetLocaleInfoA

  GetModuleHandleA

  WriteConsoleA

  GetConsoleOutputCP

  WriteConsoleW

  CreateFileA

  SetEndOfFile

  EnumResourceNamesW

  SetEnvironmentVariableA

  user32

  SetWindowPos

  GetCursorInfo

  RegisterHotKey

  ClientToScreen

  GetKeyboardLayoutNameW

  IsCharAlphaW

  IsCharAlphaNumericW

  IsCharLowerW

  IsCharUpperW

  GetMenuStringW

  GetSubMenu

  GetCaretPos

  IsZoomed

  MonitorFromPoint

  GetMonitorInfoW

  SetWindowLongW

  SetLayeredWindowAttributes

  FlashWindow

  GetClassLongW

  TranslateAcceleratorW

  IsDialogMessageW

  GetSysColor

  InflateRect

  DrawFocusRect

  DrawTextW

  FrameRect

  DrawFrameControl

  FillRect

  PtInRect

  DestroyAcceleratorTable

  CreateAcceleratorTableW

  SetCursor

  GetWindowDC

  GetSystemMetrics

  GetActiveWindow

  CharNextW

  wsprintfW

  RedrawWindow

  DrawMenuBar

  DestroyMenu

  SetMenu

  GetWindowTextLengthW

  CreateMenu

  IsDlgButtonChecked

  DefDlgProcW

  ReleaseCapture

  SetCapture

  WindowFromPoint

  CreateIconFromResourceEx

  mouse_event

  ExitWindowsEx

  SetActiveWindow

  FindWindowExW

  EnumThreadWindows

  SetMenuDefaultItem

  InsertMenuItemW

  IsMenu

  TrackPopupMenuEx

  GetCursorPos

  DeleteMenu

  CheckMenuRadioItem

  CopyImage

  GetMenuItemCount

  SetMenuItemInfoW

  GetMenuItemInfoW

  SetForegroundWindow

  IsIconic

  FindWindowW

  SystemParametersInfoW

  PeekMessageW

  SendInput

  GetAsyncKeyState

  SetKeyboardState

  GetKeyboardState

  GetKeyState

  VkKeyScanW

  LoadStringW

  DialogBoxParamW

  MessageBeep

  EndDialog

  SendDlgItemMessageW

  GetDlgItem

  SetWindowTextW

  CopyRect

  ReleaseDC

  GetDC

  EndPaint

  BeginPaint

  GetClientRect

  GetMenu

  DestroyWindow

  EnumWindows

  GetDesktopWindow

  IsWindow

  IsWindowEnabled

  IsWindowVisible

  EnableWindow

  InvalidateRect

  GetWindowThreadProcessId

  AttachThreadInput

  GetFocus

  GetWindowTextW

  ScreenToClient

  SendMessageTimeoutW

  EnumChildWindows

  CharUpperBuffW

  GetClassNameW

  GetParent

  GetDlgCtrlID

  SendMessageW

  MapVirtualKeyW

  PostMessageW

  GetWindowRect

  SetUserObjectSecurity

  GetUserObjectSecurity

  CloseDesktop

  CloseWindowStation

  OpenDesktopW

  SetProcessWindowStation

  GetProcessWindowStation

  OpenWindowStationW

  MessageBoxW

  DefWindowProcW

  MoveWindow

  AdjustWindowRectEx

  SetRect

  SetClipboardData

  EmptyClipboard

  CountClipboardFormats

  CloseClipboard

  GetClipboardData

  IsClipboardFormatAvailable

  OpenClipboard

  BlockInput

  GetMessageW

  LockWindowUpdate

  DispatchMessageW

  GetMenuItemID

  TranslateMessage

  SetFocus

  PostQuitMessage

  KillTimer

  CreatePopupMenu

  RegisterWindowMessageW

  SetTimer

  ShowWindow

  CreateWindowExW

  RegisterClassExW

  LoadIconW

  LoadCursorW

  GetSysColorBrush

  GetForegroundWindow

  MessageBoxA

  DestroyIcon

  UnregisterHotKey

  CharLowerBuffW

  MonitorFromRect

  keybd_event

  LoadImageW

  GetWindowLongW

  gdi32

  DeleteObject

  GetObjectW

  GetTextExtentPoint32W

  ExtCreatePen

  StrokeAndFillPath

  StrokePath

  EndPath

  SetPixel

  CloseFigure

  CreateCompatibleBitmap

  CreateCompatibleDC

  SelectObject

  StretchBlt

  GetDIBits

  LineTo

  AngleArc

  MoveToEx

  Ellipse

  PolyDraw

  BeginPath

  Rectangle

  GetDeviceCaps

  SetBkMode

  RoundRect

  SetBkColor

  CreatePen

  CreateSolidBrush

  SetTextColor

  CreateFontW

  GetTextFaceW

  GetStockObject

  CreateDCW

  GetPixel

  DeleteDC

  SetViewportOrgEx

  comdlg32

  GetSaveFileNameW

  GetOpenFileNameW

  advapi32

  RegEnumValueW

  RegDeleteValueW

  RegDeleteKeyW

  RegSetValueExW

  RegCreateKeyExW

  GetUserNameW

  RegConnectRegistryW

  RegEnumKeyExW

  CloseServiceHandle

  UnlockServiceDatabase

  LockServiceDatabase

  OpenSCManagerW

  InitiateSystemShutdownExW

  AdjustTokenPrivileges

  RegCloseKey

  RegQueryValueExW

  RegOpenKeyExW

  OpenThreadToken

  OpenProcessToken

  LookupPrivilegeValueW

  DuplicateTokenEx

  CreateProcessAsUserW

  CreateProcessWithLogonW

  InitializeSecurityDescriptor

  InitializeAcl

  GetLengthSid

  SetSecurityDescriptorDacl

  CopySid

  LogonUserW

  GetTokenInformation

  GetAclInformation

  GetAce

  AddAce

  GetSecurityDescriptorDacl

  shell32

  DragQueryPoint

  ShellExecuteExW

  SHGetFolderPathW

  DragQueryFileW

  SHEmptyRecycleBinW

  SHBrowseForFolderW

  SHFileOperationW

  SHGetPathFromIDListW

  SHGetDesktopFolder

  SHGetMalloc

  ExtractIconExW

  Shell_NotifyIconW

  ShellExecuteW

  DragFinish

  ole32

  OleSetMenuDescriptor

  MkParseDisplayName

  OleSetContainedObject

  CoInitialize

  CoUninitialize

  CoCreateInstance

  CreateStreamOnHGlobal

  CoTaskMemAlloc

  CoTaskMemFree

  CLSIDFromString

  StringFromCLSID

  IIDFromString

  StringFromIID

  OleInitialize

  CreateBindCtx

  CLSIDFromProgID

  CoInitializeSecurity

  CoCreateInstanceEx

  CoSetProxyBlanket

  OleUninitialize

  oleaut32

  SafeArrayAllocData

  SafeArrayAllocDescriptorEx

  SysAllocString

  OleLoadPicture

  SafeArrayGetVartype

  SafeArrayDestroyData

  SafeArrayAccessData

  VarR8FromDec

  VariantTimeToSystemTime

  VariantClear

  VariantCopy

  VariantInit

  SafeArrayDestroyDescriptor

  LoadRegTypeLi

  GetActiveObject

  SafeArrayUnaccessData

  Sections

  .text

  Size: 512KB - Virtual size: 512KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 54KB - Virtual size: 54KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 26KB - Virtual size: 105KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 8KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• SBLlgcMqPg.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 688KB - Virtual size: 688KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• hh.chm

  .chm
• nY4Ke1JkQH.exe

  .exe windows:4 windows x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 210KB - Virtual size: 210KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• qnr.dll

  .dll windows:6 windows x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Exports

  Exports

  TMethodImplementationIntercept

  __dbk_fcall_wrapper

  dbkFCallWrapperAddr

  Sections

  .text

  Size: 354KB - Virtual size: 1.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .itext

  Size: 4KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 13KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .bss

  Size: - Virtual size: 27KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .idata

  Size: 2KB - Virtual size: 8KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .didata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .edata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rdata

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 65KB - Virtual size: 132KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 9KB - Virtual size: 40KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .aspack

  Size: 5KB - Virtual size: 8KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .adata

  Size: - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• ˫װ.exe

  .exe windows:6 windows x64

  ac865fcff68a82396f1f8f985d0c0476

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:b0:0b:37:6d:bd:ae:f8:34:42:5b:d1:23:8e:98:8b

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  28-02-2023 00:00

  Not After

  27-02-2025 23:59

  Subject

  CN=Wargaming Group Limited,O=Wargaming Group Limited,L=Nicosia,C=CY

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9e:62:44:0c:bb:9d:47:b0:da:8c:d8:84:c1:79:5e:26:82:70:fa:3f:2c:19:fa:4c:75:c4:7c:e4:a6:09:6c:56

  Signer

  Actual PE Digest

  9e:62:44:0c:bb:9d:47:b0:da:8c:d8:84:c1:79:5e:26:82:70:fa:3f:2c:19:fa:4c:75:c4:7c:e4:a6:09:6c:56

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CreateProcessA

  lstrcmpiA

  GetProcessHeap

  GetComputerNameW

  ExitProcess

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  WakeAllConditionVariable

  SleepConditionVariableSRW

  InitializeSListHead

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  FormatMessageA

  TryAcquireSRWLockExclusive

  WideCharToMultiByte

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  EncodePointer

  DecodePointer

  QueryPerformanceFrequency

  MultiByteToWideChar

  LCMapStringEx

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeSRWLock

  GetProcAddress

  GetStringTypeW

  GetCPInfo

  SetLastError

  Beep

  AcquireSRWLockShared

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStdHandle

  GetFileType

  GetModuleHandleExW

  VirtualFree

  GetEnvironmentVariableW

  GetACP

  GetSystemDirectoryA

  FreeLibrary

  LoadLibraryA

  LoadLibraryW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  RtlUnwindEx

  InterlockedPushEntrySList

  RtlPcToFileHeader

  RaiseException

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExW

  GetModuleFileNameW

  SetConsoleCtrlHandler

  ReadFile

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  SetStdHandle

  GetConsoleOutputCP

  CreateDirectoryW

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  FlushFileBuffers

  GetFileSizeEx

  SetFilePointerEx

  HeapReAlloc

  GetTimeZoneInformation

  HeapSize

  GetCurrentDirectoryW

  GetFullPathNameW

  WriteConsoleW

  SetEndOfFile

  LoadResource

  HeapAlloc

  CloseHandle

  Process32Next

  LockResource

  CreateFileA

  GetLastError

  GetTickCount64

  Sleep

  CreateToolhelp32Snapshot

  SetCurrentDirectoryA

  FreeResource

  FindResourceA

  CreateMutexW

  WriteFile

  HeapFree

  Process32First

  ReleaseSRWLockShared

  SizeofResource

  RtlUnwind

  user32

  MessageBoxW

  GetUserObjectInformationW

  GetProcessWindowStation

  MessageBoxA

  ntdll

  RtlLookupFunctionEntry

  RtlCaptureContext

  RtlVirtualUnwind

  advapi32

  CryptSignHashW

  CryptCreateHash

  CryptDecrypt

  CryptExportKey

  CryptGetUserKey

  CryptGetProvParam

  CryptSetHashParam

  CryptDestroyKey

  CryptAcquireContextW

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextA

  CryptEnumProvidersW

  CryptDestroyHash

  bcrypt

  BCryptGenRandom

  crypt32

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  ws2_32

  socket

  shutdown

  inet_addr

  setsockopt

  ioctlsocket

  getsockopt

  ntohs

  select

  gethostbyname

  WSAStartup

  WSACleanup

  connect

  htonl

  htons

  WSAGetLastError

  inet_ntoa

  gethostbyaddr

  getservbyport

  getservbyname

  WSASetLastError

  recv

  send

  closesocket

  Sections

  .text

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 533KB - Virtual size: 721KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 111KB - Virtual size: 111KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• ٷѰװ.exe

  .exe windows:6 windows x64

  ac865fcff68a82396f1f8f985d0c0476

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:b0:0b:37:6d:bd:ae:f8:34:42:5b:d1:23:8e:98:8b

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  28-02-2023 00:00

  Not After

  27-02-2025 23:59

  Subject

  CN=Wargaming Group Limited,O=Wargaming Group Limited,L=Nicosia,C=CY

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  03:f6:b9:ed:3e:77:74:2c:e0:d1:93:0f:24:c4:6d:4f:05:f9:78:59:f4:88:1e:43:7a:32:e5:42:eb:76:11:dd

  Signer

  Actual PE Digest

  03:f6:b9:ed:3e:77:74:2c:e0:d1:93:0f:24:c4:6d:4f:05:f9:78:59:f4:88:1e:43:7a:32:e5:42:eb:76:11:dd

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  Imports

  kernel32

  CreateProcessA

  lstrcmpiA

  GetProcessHeap

  GetComputerNameW

  ExitProcess

  ReleaseSRWLockExclusive

  AcquireSRWLockExclusive

  WakeAllConditionVariable

  SleepConditionVariableSRW

  InitializeSListHead

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  FormatMessageA

  TryAcquireSRWLockExclusive

  WideCharToMultiByte

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  DeleteCriticalSection

  EncodePointer

  DecodePointer

  QueryPerformanceFrequency

  MultiByteToWideChar

  LCMapStringEx

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeSRWLock

  GetProcAddress

  GetStringTypeW

  GetCPInfo

  SetLastError

  Beep

  AcquireSRWLockShared

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  GetStdHandle

  GetFileType

  GetModuleHandleExW

  VirtualFree

  GetEnvironmentVariableW

  GetACP

  GetSystemDirectoryA

  FreeLibrary

  LoadLibraryA

  LoadLibraryW

  FindClose

  FindFirstFileW

  FindNextFileW

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  RtlUnwindEx

  InterlockedPushEntrySList

  RtlPcToFileHeader

  RaiseException

  InitializeCriticalSectionAndSpinCount

  LoadLibraryExW

  GetModuleFileNameW

  SetConsoleCtrlHandler

  ReadFile

  CreateFileW

  GetDriveTypeW

  GetFileInformationByHandle

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  FileTimeToSystemTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  SetStdHandle

  GetConsoleOutputCP

  CreateDirectoryW

  FindFirstFileExW

  IsValidCodePage

  GetOEMCP

  GetCommandLineA

  GetCommandLineW

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  FlushFileBuffers

  GetFileSizeEx

  SetFilePointerEx

  HeapReAlloc

  GetTimeZoneInformation

  HeapSize

  GetCurrentDirectoryW

  GetFullPathNameW

  WriteConsoleW

  SetEndOfFile

  LoadResource

  HeapAlloc

  CloseHandle

  Process32Next

  LockResource

  CreateFileA

  GetLastError

  GetTickCount64

  Sleep

  CreateToolhelp32Snapshot

  SetCurrentDirectoryA

  FreeResource

  FindResourceA

  CreateMutexW

  WriteFile

  HeapFree

  Process32First

  ReleaseSRWLockShared

  SizeofResource

  RtlUnwind

  user32

  MessageBoxW

  GetUserObjectInformationW

  GetProcessWindowStation

  MessageBoxA

  ntdll

  RtlLookupFunctionEntry

  RtlCaptureContext

  RtlVirtualUnwind

  advapi32

  CryptSignHashW

  CryptCreateHash

  CryptDecrypt

  CryptExportKey

  CryptGetUserKey

  CryptGetProvParam

  CryptSetHashParam

  CryptDestroyKey

  CryptAcquireContextW

  ReportEventW

  RegisterEventSourceW

  DeregisterEventSource

  CryptGenRandom

  CryptReleaseContext

  CryptAcquireContextA

  CryptEnumProvidersW

  CryptDestroyHash

  bcrypt

  BCryptGenRandom

  crypt32

  CertOpenStore

  CertCloseStore

  CertEnumCertificatesInStore

  CertFindCertificateInStore

  CertDuplicateCertificateContext

  CertFreeCertificateContext

  CertGetCertificateContextProperty

  ws2_32

  socket

  shutdown

  inet_addr

  setsockopt

  ioctlsocket

  getsockopt

  ntohs

  select

  gethostbyname

  WSAStartup

  WSACleanup

  connect

  htonl

  htons

  WSAGetLastError

  inet_ntoa

  gethostbyaddr

  getservbyport

  getservbyname

  WSASetLastError

  recv

  send

  closesocket

  Sections

  .text

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1.9MB - Virtual size: 1.9MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 533KB - Virtual size: 721KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 111KB - Virtual size: 111KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 348B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 2.3MB - Virtual size: 2.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 40KB - Virtual size: 39KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ