GetSysInfo
InitD3D10H
InitD3D9H
ReleaseD3D9H
Overview
overview
6Static
static
SWZ-2.03/�...d9.dll
windows7-x64
1SWZ-2.03/�...d9.dll
windows10-2004-x64
3SWZ-2.03/�...an.dll
windows7-x64
1SWZ-2.03/�...an.dll
windows10-2004-x64
1SWZ-2.03/�...er.exe
windows7-x64
6SWZ-2.03/�...er.exe
windows10-2004-x64
6SWZ-2.03/�...en.exe
windows7-x64
SWZ-2.03/�...en.exe
windows10-2004-x64
数码资源网.url
windows7-x64
1数码资源网.url
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GWH_d3d9.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GWH_d3d9.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GWHookMan.dll
Resource
win7-20220901-en
Behavioral task
behavioral4
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GWHookMan.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GameWatcher.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
SWZ-2.03/【520传奇】守望者加速2.03/GameWatcher.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
SWZ-2.03/【520传奇】守望者加速2.03/Gwken.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
SWZ-2.03/【520传奇】守望者加速2.03/Gwken.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
数码资源网.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
数码资源网.url
Resource
win10v2004-20221111-en
Target
09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6
Size
663KB
MD5
66b7385938c5dd49bae67b1fa439db4d
SHA1
4c7860b8a2ec3676a5ec33cf0880ab0c8f106fd4
SHA256
09238e013da42b83602ad3eabd759f980292e6208d0d67f95051e2b29893f9b6
SHA512
66c837c98768a65aee402bafa6637684e247e15a5b6655b06d5b2575a1f406032c0a3f6b7684caa06ce1fca998b0a9638ce5e0c47fe412f3828f21e33fe24906
SSDEEP
12288:evxr7CgRWWmPOMEyAtACL7okarUaSvPUMWC7LD79zOyrTLQt5aGcM:sxregQWmOzySrL7ovr+vPUHChlrTUtR
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetModuleHandleA
GetLocalTime
GetCurrentProcessId
IsBadWritePtr
GetTickCount
LoadLibraryA
IsBadReadPtr
VirtualProtect
FlushFileBuffers
CloseHandle
CreateFileA
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
HeapAlloc
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
VirtualAlloc
HeapReAlloc
HeapSize
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetClientRect
OffsetRect
timeGetTime
Direct3DCreate9
GetSysInfo
InitD3D10H
InitD3D9H
ReleaseD3D9H
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PathCombineW
PathRemoveFileSpecW
EnterCriticalSection
GetModuleHandleA
DeleteCriticalSection
CloseHandle
CreateFileW
CreateEventA
LoadLibraryA
FreeLibrary
DeviceIoControl
GetModuleFileNameW
GetSystemDirectoryW
GetTickCount
GetModuleHandleW
LoadLibraryW
GetCurrentProcessId
GetProcAddress
InitializeCriticalSectionAndSpinCount
GetSystemTimeAdjustment
GetVersion
SetSystemTimeAdjustment
QueryPerformanceCounter
Sleep
VirtualProtect
IsBadReadPtr
IsBadWritePtr
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
LeaveCriticalSection
OpenProcess
InitializeCriticalSection
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
FormatMessageW
GetCurrentProcess
SetUnhandledExceptionFilter
SetStdHandle
GetLocaleInfoW
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
TerminateProcess
UnhandledExceptionFilter
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentThreadId
GetCommandLineA
RaiseException
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
GetStdHandle
GetModuleFileNameA
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
MultiByteToWideChar
InterlockedExchange
RtlUnwind
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
UnhookWindowsHookEx
CallNextHookEx
SetDoubleClickTime
GetDoubleClickTime
SetTimer
SetWindowsHookExW
LookupPrivilegeValueA
CloseServiceHandle
DeleteService
ControlService
StartServiceW
OpenServiceW
CreateServiceW
OpenSCManagerW
GetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
timeGetTime
GetProcessMemoryInfo
GetModuleBaseNameA
EnumProcessModules
?HookProc@@YGJHIJ@Z
GwDllRefresh
GwInitSysInfo
GwSdRefresh
GwSetText
Initialise
InstallHook
RemoveHook
SetTemperature
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
LoadLibraryA
ExitProcess
GetProcAddress
wsprintfA
MessageBoxA
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
RtlInitUnicodeString
RtlGetVersion
memcpy
KeServiceDescriptorTable
RtlCopyUnicodeString
ExAllocatePoolWithTag
RtlCompareUnicodeString
IofCompleteRequest
KeSetEvent
ObfDereferenceObject
KeWaitForSingleObject
MmGetSystemRoutineAddress
KeDelayExecutionThread
IoDeleteDevice
IoDeleteSymbolicLink
KeInitializeEvent
ObReferenceObjectByHandle
ExEventObjectType
IoCreateSymbolicLink
KeTickCount
KeBugCheckEx
_allmul
_alldiv
DbgPrint
ExFreePoolWithTag
ZwClose
ZwSetSecurityObject
ObOpenObjectByPointer
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
_wcsnicmp
RtlAddAccessAllowedAce
RtlLengthSid
memset
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
ZwOpenKey
ZwCreateKey
ZwQueryValueKey
ZwSetValueKey
RtlFreeUnicodeString
KeQueryPerformanceCounter
KfRaiseIrql
KeRaiseIrqlToDpcLevel
KfLowerIrql
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ