nikkeminiloader_oG7STxbESBb[.]wg[.]intl[.]exe

nikkeminiloader_oG7STxbESBb.wg.intl.exe

IMPHASH 9b5ef063ac31ccf7d26131466e9e89e5
SHA256 199791facc57a9df2b567ea40c70f05e53e9112e828f6834c2c16f724b943e12
MD5 335069badb99337b20a62cbda5cd5af1
SHA1 694bc2bf76ab2715824737433a0c7d4cc85e0dff
SHA512 19e5a93c87fe0a5991a365377db0954cb5aa46109c70f7082ec902c78336c5547607e1ea68d00760ac67b931a5025f8e1cb44e9409d33cea8e1df0324d9f59e7
SSDEEP 196608:J+cAa55JA3mNoZ26cgjzBcPBRPWmbcIs/a/2lwW1RGoVrr:J+cn55JPs/hzo3rAIoyawWFrr
TLSH
T17D9633D6A0C3D586F4B66E78009E8674E6532C1B86629C333964FD2B393B5F3C97B142
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

9d:82:79:ed:dc:04:0c:72:f6:75:65:d4:e5:a4:73:e0:2b:20:00:cd:c8:2c:c4:c0:8f:85:19:44:be:28:43:83

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Oct 22, 2026

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

02:b3:0d:79:00:a0:51:21:c0:d8:99:4e:d4:2d:73:a0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 25, 2024 - Dec 25, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

15049

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos IsDlgButtonChecked GetAsyncKeyState CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW CharNextA CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint PeekMessageW DispatchMessageW wvsprintfW SystemParametersInfoW wsprintfA CreatePopupMenu

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW GetLastError MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

LogConfig.ini

SHA256 e8a59173f505dbedf4dd37eec210e5e539a243e46f521a8ba8d2ec13fd99d29f
MD5 1e8cf5946a37d9a084be613554260815
SHA1 94b5aee19918d59c83785ac27de9c7c076f12091
SHA512 abe7ebaf55dbccb4fc8c1a39c36427f381568642dde0855208244133cae23dbca7a8776c3b67303673413ed6047574e22e349697bfb22fe5f9395bcf86f8a2cb
TLSH
T127B092223D888200A4261B20813886C650760926DAE56E54A8589C2F1822E0E09107AC
MD5 SHA1 SHA512 TLSH

Minidown.xml

SHA256 b3b95f6ff59b236709eb7c6a225e9fbfe8fea49982781c4d2fd7a2917bd03614
MD5 7c26f779b425213db1b69f2d532d3982
SHA1 1ddc571aa0003747a4c35f41e86f2f5219bc5f7c
SHA512 59055f838eaea3368705ef16c58783d27af949028ed0bd4294b7b9e1b01330b8be7141f9e71eddf2a3bb113b1d6fe1a514a230d0d9ae4ee4266ba1b1b243cfc6
TLSH
T1EA514BF5844A3C379CBE26DAACCDE35BA443EDE85531E90E5DC4F883D5EC0924A444B1
MD5 SHA1 SHA512 TLSH

bugreport.ini

SHA256 b829f2ca211c275d382268925c9c361aaf390eaa8180a194c371fd98add75864
MD5 32aa3f2f7c172e3391c3c4960f00fbf4
SHA1 fa24a54c00a2e38b634262befc57bfe29a1c4362
SHA512 2cb029f8edf04db5c46f314c3e214f3b971925f8dc983520ca87a5162eee74590a078d4600520b49ad8255724ef53decac8eb3ed9be8a6282fa0067820947a5c
TLSH
T12E01BDB88B2E971DCE844DB5183E25D291D843570B454D88809F2DEDDD57C1EE22A2D3
MD5 SHA1 SHA512 TLSH

error_code.json

SHA256 c327c425314d704ca7a74b829ba6ebd6d3f0151c825c444901e10f2cc81d7e99
MD5 8087f4c7799d5d32c1fafe0cadd5b613
SHA1 75462f478b2a0e203f8ed6f159e389dd75a82755
SHA512 8e69433fc6fa3d481acd5bad9557efe22689ac9ff0a24b04fad55cebf308a1b610282159eaa577b5b3b91a8a9f6512acd5c560c1363ad2c314810be32a874072
SSDEEP 6144:tMepVmAXSUcfoGwvcyvCjclMrK32BIcZJIQ3FDBBTvRu:cf5VJIQ3FDBBTvY
TLSH
T1AD845237C18C0D9BB8714A179D143896F6657B1F7A62A4EFB43C981D1FF2A1883098B7
MD5 SHA1 SHA512 SSDEEP TLSH

icon.ico

SHA256 9be42db6b26a51ba372a3f59c5eb4cdc1e1c4c5d1794193038fe779794222782
MD5 b1e04bb219068bf05bc7db427abf57b9
SHA1 7a86f84dc9e58bbd983cafade695ea825e7db4da
SHA512 4c086cbf06ab15e21972c620bb318a0e55e05198957b74d397a68cd298b4434b3721b049cef22c6f2935b8f1e96020e7478d183bb6316f601d9e5770d4badbc8
SSDEEP 6144:j/0SNIGX/jgg47NNdRIp3j0JMSCcD42xEbEP1oVV5tjuarNB8q8SzN9:rNIGvjAPd8YiaD4Xb5gSt8WN9
TLSH
T19074D0D270C350D9E8B78E7A412B48B451932DBD5961E863328DFF2B397B3E1486F429
MD5 SHA1 SHA512 SSDEEP TLSH

install_script.dat

SHA256 7cb08b8bae674a5e63fc20f82839809240ec3af436691312cb81555b2d89242c
MD5 b5dad05a4b0dc7effc40d425220266a6
SHA1 6826554a5c29d02ca38546547ae54110eeb5cc55
SHA512 dce11236b877fc6dcc63fbc14559a839c27186fde78df280e2e52b0c990beafc45dd3f3beee22e79b807e9e90d8bdb484fcd4efa94aea505fcdac4671fde055c
TLSH
T1B4512299ECB08E7794C8231C19094A0B63A152EB38403DCD736C548D5F2EBAF00F669D
MD5 SHA1 SHA512 TLSH

nikke_Miniloader.exe

IMPHASH 5ac3bbddbcdcea486e65242741b395fd
SHA256 e8e98a8882a1d2a03bef6ee54c7ee49cf6878cbaa8cdee8ba1816418fbdc991c
MD5 d41ec5d6d4d0c2ead4d78d9c41ae8302
SHA1 39ca3deac9eaae006328698acf2e30ab059c08e8
SHA512 1253dd125e751377bfa08a3ae9b6b0b954ec12a7c57bd2fc0b3451b7b03ab035aec71af9e6b5062a7a9a8e820cfeed75bc8f518bc6234765a50149263a2ba37f
SSDEEP 98304:as0pvKobt9A4IBBOz3pr6S3WQsNU99d4DyNJBZinhUt4veG7cUHPd3:aB6Oz5KUrNJBZ0Gt4W+cAP1
TLSH
T1C836BF327A8240B2E5A30270592AFFB9EDBFA9700736C5D342907F5D5D712C2563A36B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

53:df:2d:11:17:8f:dc:10:06:ac:f9:98:be:2a:69:30:54:c1:2b:85:10:5c:5a:b4:6e:47:56:12:5d:ca:b4:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Chains

Oct 22, 2026

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

SERIALNUMBER=201632879R,CN=PROXIMA BETA PTE. LIMITED,O=PROXIMA BETA PTE. LIMITED,L=Singapore,C=SG,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025347

Serial Number

02:b3:0d:79:00:a0:51:21:c0:d8:99:4e:d4:2d:73:a0

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 25, 2024 - Dec 25, 2027

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

1

Major OS version

5

Entry point

3191847

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\wegame_paas\miniloader_overseas\common\build\bin\ReleaseNoLogin\TGPMiniLoader\MiniLoader.pdb

iphlpapi

GetAdaptersInfo

kernel32

GetSystemTimeAsFileTime QueryPerformanceCounter GetSystemTime CreateFiber DeleteFiber SwitchToFiber TlsFree TlsSetValue TlsGetValue TlsAlloc ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode VerifyVersionInfoA LoadLibraryA GetSystemDirectoryA FormatMessageA WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle ExpandEnvironmentStringsA SleepEx lstrcmpiW lstrcpynW GlobalAlloc SystemTimeToFileTime LocalFileTimeToFileTime FormatMessageW VerSetConditionMask VerifyVersionInfoW MulDiv GetACP LockResource SizeofResource FreeResource LoadResource CreateTimerQueue UnregisterWaitEx QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore FindResourceW GlobalUnlock GlobalLock lstrlenW GetCurrentDirectoryW GetModuleFileNameA GetDriveTypeW HeapReAlloc HeapSize GetModuleHandleA GetExitCodeProcess GetProcessId ExitProcess Process32FirstW Process32NextW CreateToolhelp32Snapshot SetFileAttributesW OpenProcess GetEnvironmentVariableW OutputDebugStringA WritePrivateProfileStringW GetDiskFreeSpaceExW ReleaseMutex GetLocaleInfoW CreateMutexW GetUserDefaultUILanguage CopyFileW GetFileSize SwitchToThread SetEndOfFile FreeLibrary LoadLibraryW GetSystemDirectoryW GetVersionExW InterlockedIncrement SetLastError ReadFile GetFileAttributesExW GetFileAttributesW GetPrivateProfileIntW GetTickCount ResetEvent CreateThread TerminateThread SetEvent lstrcpyW LocalFree LocalAlloc InterlockedDecrement SetUnhandledExceptionFilter VirtualQuery WideCharToMultiByte GetModuleHandleW CreateProcessW GetProcessHeap GetCurrentProcessId DeleteCriticalSection VirtualAllocEx GetProcAddress DecodePointer GetLocalTime HeapAlloc RaiseException CloseHandle DeleteFileW OutputDebugStringW GetModuleHandleExW Sleep GetPrivateProfileStringW MultiByteToWideChar CreateEventW DuplicateHandle GetCurrentThreadId CreateFileW VirtualFree GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SignalObjectAndWait WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetTimeZoneInformation GetConsoleCP SetStdHandle VirtualAlloc GetSystemInfo HeapQueryInformation SetConsoleCtrlHandler SetFilePointerEx GetCommandLineW GetCommandLineA FreeLibraryAndExitThread ExitThread InterlockedFlushSList WaitForSingleObject FindClose SetFilePointer SetErrorMode InterlockedPushEntrySList RtlUnwind LCMapStringW GetCPInfo QueryPerformanceFrequency TryEnterCriticalSection GetStringTypeW InitializeSListHead GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetUserDefaultLCID GetTempFileNameW GetProfileIntW GetTempPathW GetWindowsDirectoryW FindResourceExW SystemTimeToTzSpecificLocalTime GetFileTime GetFileSizeEx FileTimeToLocalFileTime VirtualProtect GetCurrentThread GlobalFlags UnlockFile LockFile InitializeCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW TerminateProcess WriteFile GetCurrentProcess FindNextFileW EnterCriticalSection HeapFree WriteProcessMemory SearchPathW GetVolumeInformationW GetFullPathNameW FlushFileBuffers GlobalFindAtomW GlobalAddAtomW lstrcmpW GlobalDeleteAtom LoadLibraryExW EncodePointer FileTimeToSystemTime GlobalGetAtomNameW lstrcmpA CompareStringW ResumeThread SetThreadPriority GlobalSize LocalReAlloc GlobalFree GlobalHandle GlobalReAlloc ConvertFiberToThread FindFirstFileW CreateDirectoryW GetLastError ConvertThreadToFiber

user32

GetSystemMetrics LoadCursorW RegisterClassW GetClassInfoExW CallWindowProcW AdjustWindowRectEx GetMenu InflateRect SetCursor FillRect SetForegroundWindow GetPropW RegisterClassExW IsWindow SetPropW GetWindowPlacement GetMessageW CallNextHookEx PeekMessageW UnhookWindowsHookEx SetWindowTextW SendMessageW InvalidateRgn CreateAcceleratorTableW GetCaretBlinkTime GetGUIThreadInfo ClientToScreen MoveWindow MonitorFromPoint UpdateLayeredWindow GetWindowRgn GetParent SetRect CharPrevW CreateCaret ShowCaret HideCaret GetCaretPos SetCaretPos CreatePopupMenu AppendMenuW EnableMenuItem DestroyMenu IsWindowEnabled EqualRect GetWindowTextLengthW GetWindowTextW wsprintfA DestroyCursor CreateMenu SubtractRect TranslateMDISysAccel DefMDIChildProcW DefFrameProcW DrawMenuBar IsClipboardFormatAvailable SetCapture GetFocus IsZoomed DispatchMessageW TranslateMessage InvalidateRect GetSysColor ReleaseCapture PtInRect OffsetRect MonitorFromWindow GetMonitorInfoW MapWindowPoints GetSubMenu BringWindowToTop LoadImageW GetCursorPos DrawTextW SetWindowsHookExW PostThreadMessageW RegisterWindowMessageW DefWindowProcW DestroyWindow CreateWindowExW ShowWindow IntersectRect IsWindowVisible UnionRect IsRectEmpty GetUpdateRect EndPaint SetWindowPos GetWindowRect LoadMenuW PostQuitMessage KillTimer MessageBoxW GetClientRect ScreenToClient PostMessageW SetTimer SetParent SetWindowRgn GetKeyState CharNextW ReleaseDC GetDC GetActiveWindow FindWindowW UpdateWindow GetWindowLongW SetWindowLongW IsIconic CopyImage EnableWindow UnregisterClassW BeginPaint SetFocus TrackPopupMenu CharUpperBuffW GetUserObjectInformationW GetProcessWindowStation GetKeyNameTextW GetKeyboardLayout MapVirtualKeyExW DrawTextA GetWindowThreadProcessId GetLastActivePopup GetMenuStringW GetMenuState GetMenuItemID GetMenuItemCount InsertMenuW RemoveMenu ValidateRect GetSysColorBrush CheckMenuItem SetMenuItemBitmaps GetMenuCheckMarkDimensions SetMenuItemInfoW LoadBitmapW GetMessagePos GetMessageTime GetClassInfoW IsMenu IsChild SetWindowPlacement BeginDeferWindowPos DeferWindowPos EndDeferWindowPos GetDlgItem GetDlgCtrlID GetCapture SetMenu SetActiveWindow GetForegroundWindow RedrawWindow ScrollWindow SetScrollPos GetScrollPos SetScrollRange GetScrollRange ShowScrollBar RemovePropW CopyRect GetClassLongW GetClassNameW GetTopWindow LoadIconW SetScrollInfo GetScrollInfo WinHelpW CheckDlgButton IsDialogMessageW DestroyIcon CharUpperW GetDesktopWindow RealChildWindowFromPoint DrawTextExW GrayStringW TabbedTextOutW GetWindowDC GetMenuItemInfoW SystemParametersInfoW RegisterClipboardFormatW SendDlgItemMessageA SetRectEmpty CreateDialogIndirectParamW EndDialog GetNextDlgTabItem GetAsyncKeyState MapDialogRect TrackMouseEvent ShowOwnedPopups DeleteMenu GetNextDlgGroupItem WindowFromPoint DrawFocusRect DrawIconEx GetIconInfo MessageBeep EnableScrollBar InvertRect NotifyWinEvent GetMenuDefaultItem MapVirtualKeyW SetLayeredWindowAttributes EnumDisplayMonitors SetClassLongW OpenClipboard CloseClipboard SetClipboardData EmptyClipboard DrawStateW DrawEdge DrawFrameControl GetSystemMenu SetCursorPos CopyIcon FrameRect DrawIcon LoadAcceleratorsW TranslateAcceleratorW InsertMenuItemW UnpackDDElParam ReuseDDElParam GetComboBoxInfo WaitMessage IsCharLowerW ToUnicodeEx GetKeyboardState DestroyAcceleratorTable CopyAcceleratorTableW LockWindowUpdate SetMenuDefaultItem GetDoubleClickTime ModifyMenuW GetWindow

gdi32

GetTextExtentPointA CreatePatternBrush GdiFlush TextOutW GetTextExtentPoint32W GetCharABCWidthsW SetBkColor SetTextColor SetBkMode LineTo MoveToEx CreatePenIndirect CreateSolidBrush SetStretchBltMode StretchBlt CombineRgn ExtSelectClipRgn GetBitmapBits GetClipBox SelectClipRgn PtInRegion CreateRectRgn CreateDIBSection GetPixel PlayEnhMetaFile CreateCompatibleBitmap GetDeviceCaps GetEnhMetaFileHeader CreateDIBitmap GetTextMetricsW CloseEnhMetaFile CreateEnhMetaFileW SetWindowOrgEx Rectangle RestoreDC BitBlt SaveDC SetBitmapBits CreateCompatibleDC DeleteDC RemoveFontMemResourceEx CreatePen CreateFontIndirectW GetStockObject GetObjectW CreateRoundRectRgn DeleteObject CopyMetaFileW CreateDCW CreateBitmap CreateHatchBrush Escape ExcludeClipRect GetObjectType GetViewportExtEx GetWindowExtEx IntersectClipRect PtVisible RectVisible SelectPalette ScaleViewportExtEx SetLayout GetLayout SetPolyFillMode SetROP2 SetTextAlign ExtTextOutW OffsetWindowOrgEx SelectObject OffsetViewportOrgEx SetWindowExtEx SetViewportOrgEx CreateRectRgnIndirect SetMapMode GetTextFaceW GetViewportOrgEx GetWindowOrgEx SetPixelV SetPaletteEntries ExtFloodFill GetBoundsRect FrameRgn FillRgn RoundRect OffsetRgn GetRgnBox LPtoDP Polyline Polygon CreatePolygonRgn GetTextColor Ellipse CreateEllipticRgn SetDIBColorTable SetPixel GetTextCharsetInfo EnumFontFamiliesW GetBkColor RealizePalette GetSystemPaletteEntries GetPaletteEntries GetNearestPaletteIndex CreatePalette EnumFontFamiliesExW DPtoLP SetRectRgn PatBlt ScaleWindowExtEx SetViewportExtEx

advapi32

RegEnumKeyExW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey RegQueryValueExW RegOpenKeyW MapGenericMask DuplicateToken GetFileSecurityW OpenProcessToken GetNamedSecurityInfoW CryptEnumProvidersW CryptSignHashW CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptGenRandom CryptReleaseContext CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource LookupPrivilegeValueW AdjustTokenPrivileges AccessCheck BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW

shell32

SHGetPathFromIDListW SHBrowseForFolderW Shell_NotifyIconW SHGetFolderPathW SHGetFolderLocation DragQueryFileW SHGetFileInfoW SHGetSpecialFolderLocation SHGetDesktopFolder DragFinish SHAppBarMessage ShellExecuteW ShellExecuteExW

ole32

OleCreateMenuDescriptor OleDestroyMenuDescriptor OleTranslateAccelerator IsAccelerator OleGetClipboard CoInitializeEx CoDisconnectObject CoTaskMemAlloc CoLockObjectExternal CreateStreamOnHGlobal ReleaseStgMedium CLSIDFromString OleLockRunning RegisterDragDrop DoDragDrop OleDuplicateData StringFromGUID2 CLSIDFromProgID CoCreateInstance CoUninitialize CoCreateGuid CoInitialize CoTaskMemFree RevokeDragDrop

oleaut32

VariantCopy VariantTimeToSystemTime SystemTimeToVariantTime LoadTypeLi VarBstrFromDate SysAllocStringLen VariantInit SysStringLen VariantChangeType SysAllocString SysFreeString VariantClear

msimg32

TransparentBlt AlphaBlend

comctl32

_TrackMouseEvent InitCommonControlsEx ord17

shlwapi

PathAppendW StrCmpNIW StrCatW PathGetDriveNumberW PathFileExistsW PathBuildRootW StrCmpIW PathFindFileNameW PathRemoveExtensionW StrStrIW PathIsDirectoryW PathIsUNCW PathStripToRootW PathFindExtensionW StrFormatKBSizeW PathRemoveFileSpecW

uxtheme

DrawThemeText DrawThemeParentBackground OpenThemeData CloseThemeData DrawThemeBackground GetThemeColor GetCurrentThemeName GetWindowTheme IsAppThemed IsThemeBackgroundPartiallyTransparent GetThemeSysColor GetThemePartSize

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CertFreeCertificateContext CertCloseStore CertFindCertificateInStore CertOpenStore CertEnumCertificatesInStore CertGetCertificateContextProperty CertDuplicateCertificateContext

ws2_32

setsockopt ntohs htons getsockopt WSACleanup getpeername WSAGetLastError connect closesocket bind send recv WSASetLastError select __WSAFDIsSet socket WSAIoctl gethostname gethostbyname getaddrinfo freeaddrinfo accept listen recvfrom WSAStartup ntohl htonl sendto getsockname shutdown getnameinfo ioctlsocket

gdiplus

GdipGetFontCollectionFamilyCount GdipAlloc GdipFree GdipCreateFontFamilyFromName GdipCloneFontFamily GdipGetFontCollectionFamilyList GdipGetFamilyName GdipDeleteFontFamily GdipGetGenericFontFamilySansSerif GdipPrivateAddMemoryFont GdipDeleteFont GdipCreateFromHDC GdipDeleteGraphics GdipDeletePrivateFontCollection GdiplusShutdown GdiplusStartup GdipCreateFont GdipMeasureString GdipSetSmoothingMode GdipCreateBitmapFromHBITMAP GdipDrawImageI GdipBitmapUnlockBits GdipBitmapLockBits GdipCreateBitmapFromScan0 GdipCreateBitmapFromStream GdipGetImagePaletteSize GdipGetImagePalette GdipGetImagePixelFormat GdipGetImageGraphicsContext GdipRotateWorldTransform GdipTranslateWorldTransform GdipImageSelectActiveFrame GdipGetImageHeight GdipGetImageWidth GdipGetPropertyItem GdipGetPropertyItemSize GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDrawString GdipSetStringFormatLineAlign GdipSetStringFormatAlign GdipSetStringFormatFlags GdipSetStringFormatTrimming GdipDeleteStringFormat GdipStringFormatGetGenericTypographic GdipCloneStringFormat GdipSetInterpolationMode GdipSetTextRenderingHint GdipDrawPath ord1 GdipAddPathLine GdipDrawRectangleI GdipSetPenMode GdipFillRectangleI GdipCreatePath GdipDeletePath GdipAddPathEllipseI GdipSetClipPath GdipDrawImageRectI GdipCreatePen1 GdipDeletePen GdipDrawEllipseI GdipLoadImageFromStream GdipCloneImage GdipDisposeImage GdipCreateSolidFill GdipDeleteBrush GdipCloneBrush GdipNewPrivateFontCollection

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetOpenStatus ImmGetContext

winmm

PlaySoundW

wldap32

ord32 ord217 ord46 ord211 ord60 ord50 ord41 ord22 ord26 ord27 ord33 ord35 ord79 ord30 ord200 ord301 ord143

dbghelp

MiniDumpWriteDump

oleacc

LresultFromObject AccessibleObjectFromWindow CreateStdAccessibleObject

winspool.drv

OpenPrinterW ClosePrinter DocumentPropertiesW

Name

.text

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

960KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.QMGuid

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

351KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

245KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

res.zip

SHA256 f2ae513cebba47181f2b5ea2901942848662bed888ff304ba2ba9794fb1a96bd
MD5 b9d58115056ddc37beb601c37cf9f545
SHA1 88e857ef3badab955444c14b57451a4ea58f7e83
SHA512 dada6296300f9b30b500d2cdf7d93fd2a6ac7cda08d5087629c3ce282b97866fd0143f4cfb545548823c27ca097149f680d6bfb5a37c192913086a7218a4d92b
SSDEEP 49152:4eZmYrNqpTaJ2xTjYWIZw0P3GmVXr5l5BPDqiEmKZ9tZGngQkDIOEBwfFDqSMsgE:4IC+J2xQW143zVvLbmZKb0IOJqSXv441
TLSH
T172D533C763022894C3A4973BE57B1C63BA3D0496735C512D044E05F8E69AD6F0EB2EAF
MD5 SHA1 SHA512 SSDEEP TLSH

Hover_et.png

SHA256 3dd4f9513348d7e65e484ced3df7f51ad72f28b0c1922cdba3f3334b3b4539fa
MD5 d0f9c85a88cfaf4d90fbbe6ba0935ec8
SHA1 8868fa8f912eb012e88946f4805267ec8bb2156b
SHA512 1ffa741c7b58477447d6aa420ccd32d671a70a281dde120a6d31512449ea143957784625610ad509baacbf5ed81153426f6b5edd93151f5a0399d6c4d2ccf186
TLSH
T1A5E0C0DBB544DC40E784467286ED8324FC27048C7766AF5F0516A47FC406C9C9281556
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer

nikkeminiloader_oG7STxbESBb.wg.intl.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

LogConfig.ini

Minidown.xml

bugreport.ini

error_code.json

icon.ico

install_script.dat

nikke_Miniloader.exe

iphlpapi

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msimg32

comctl32

shlwapi

uxtheme

version

crypt32

ws2_32

gdiplus

imm32

winmm

wldap32

dbghelp

oleacc

winspool.drv

generic

res.zip

Hover_et.png

Normal_Popup.png

Normal_Popup_red.png

Normal_et.png

Tips.png

UISkinMinidown.xml

available.png

bg.png

browse_disabled.png

browse_hover.png

browse_normal.png

browse_pressed.png

browse_t_disabled.png

browse_t_hover.png

browse_t_normal.png

browse_t_pressed.png

cancel_hover.png

cancel_normal.png

check_disabled.png

check_hover.png

check_normal.png

check_pressed.png

check_selected.png

confirm_disabled.png

confirm_hover.png

confirm_normal.png

confirm_pressed.png

disk_space_need.png

disk_space_used.png

floor.png

gif.gif

iclose_hover.png

iclose_normal.png

install_disabled.png

install_hover.png