Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
DRAGON QUEST XI S.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
DRAGON QUEST XI S.exe
Resource
win10v2004-20221111-en
Target
DRAGON QUEST XI S.exe
Size
96.8MB
MD5
c19da2f7270cc82d790e2a084f2152bf
SHA1
3540082ed41664ad721de17e40231ff7e1362700
SHA256
6c643291841429d1a507dc3ec256dcbb229c800310036641ed51dcab65e2f061
SHA512
32c38715582d174ce27e0a1bd36ec3066566e5a5ac6b7972a63f4490062c2896b3ac6ec056262f9fcd931b46ed2a67c8ed4444f30461382c8272e6e4f8d2e877
SSDEEP
393216:+o2y4O8ae7Gh0zWYsP6qdWnFuw21+FZRRXu+cS9c8VZYIDenws1ROIclG7eqY9Py:P4J2clPv1ewuY2jes
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
CN=SQUARE ENIX CO.\, LTD.,OU=Information Technology Division,O=SQUARE ENIX CO.\, LTD.,L=Shinjuku-ku,ST=Tokyo,C=JP
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
InternetSetOptionW
InternetGetConnectedState
InternetSetStatusCallbackW
InternetAttemptConnect
InternetReadFile
InternetConnectW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetCrackUrlW
InternetCloseHandle
InternetOpenW
InternetQueryOptionW
socket
WSAIoctl
__WSAFDIsSet
WSASetLastError
shutdown
WSAStartup
WSACleanup
WSAGetLastError
getaddrinfo
setsockopt
accept
bind
closesocket
connect
ioctlsocket
getpeername
getsockname
getsockopt
htonl
sendto
send
htons
freeaddrinfo
inet_pton
select
recvfrom
recv
gethostname
ntohs
ntohl
listen
SymRefreshModuleList
SymGetSymFromAddr64
SymFunctionTableAccess64
MiniDumpWriteDump
SymGetOptions
StackWalk64
SymSetOptions
SymInitializeW
SymGetLineFromAddr64
SymGetModuleBase64
SymGetModuleInfo64
waveOutGetNumDevs
timeBeginPeriod
timeGetTime
timeEndPeriod
timeGetDevCaps
Sleep
InitializeCriticalSection
SetCriticalSectionSpinCount
CreateFileW
DeleteFileW
WriteFile
CloseHandle
GetLocalTime
TlsAlloc
TlsFree
SetHandleInformation
VerSetConditionMask
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
GetFinalPathNameByHandleW
ReadFile
RemoveDirectoryW
SetFileAttributesW
SetFilePointer
SetFileTime
OutputDebugStringW
RaiseException
GetOverlappedResult
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
SetThreadPriority
CreateProcessW
GlobalMemoryStatusEx
GetSystemInfo
GetSystemDirectoryW
GetVersionExW
GetLogicalProcessorInformation
GetNativeSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadResource
LockResource
SizeofResource
FormatMessageW
FindResourceW
MoveFileW
VerifyVersionInfoW
FileTimeToSystemTime
GetCommandLineW
SetConsoleCtrlHandler
K32GetProcessMemoryInfo
RtlCaptureStackBackTrace
GetStdHandle
SetCurrentDirectoryW
GetCurrentDirectoryW
FlushFileBuffers
GetFullPathNameW
GetLongPathNameW
GetTempPathW
PeekNamedPipe
QueryPerformanceFrequency
ReleaseSemaphore
GetProcessTimes
GetExitCodeProcess
SwitchToThread
GetCurrentThread
OpenThread
SuspendThread
ResumeThread
GetThreadContext
CreateMutexW
GetSystemTimeAsFileTime
FreeLibrary
GetModuleHandleExW
LoadLibraryExW
SetThreadAffinityMask
SetThreadErrorMode
CreateSemaphoreW
LoadLibraryW
SetDllDirectoryW
GetComputerNameW
GetModuleHandleA
Process32FirstW
Process32NextW
GetProcessHandleCount
GetVersion
GlobalAlloc
GlobalLock
GlobalUnlock
GetLocaleInfoW
GetSystemDefaultLCID
GetConsoleScreenBufferInfo
SetConsoleScreenBufferSize
SetConsoleWindowInfo
SetConsoleTextAttribute
FreeConsole
AttachConsole
AllocConsole
WriteConsoleW
GetConsoleWindow
InitializeSRWLock
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeCriticalSectionAndSpinCount
GetFileSize
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObjectEx
GetTickCount64
FlushViewOfFile
LoadLibraryA
SetErrorMode
TlsSetValue
TlsGetValue
GetCurrentThreadId
QueryPerformanceCounter
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
GetFileType
MultiByteToWideChar
RtlVirtualUnwind
FlushConsoleInputBuffer
GetTickCount
GlobalMemoryStatus
WideCharToMultiByte
InitializeCriticalSectionEx
SleepEx
VerifyVersionInfoA
WaitForMultipleObjects
ExpandEnvironmentStringsA
GetComputerNameA
GetGeoInfoA
GetGeoInfoW
GetUserGeoID
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
VirtualQuery
LoadLibraryExA
TerminateThread
CreateEventExW
WaitForMultipleObjectsEx
CreateFileA
SetLastError
LocalAlloc
CreateSemaphoreA
FormatMessageA
OutputDebugStringA
CreateDirectoryA
LocalFree
lstrlenA
ExitProcess
ReleaseMutex
GetSystemTime
GetLastError
DeleteFileA
GetFileAttributesA
SetEndOfFile
MoveFileA
CreateEventA
GetThreadPriority
GetExitCodeThread
GetProcessAffinityMask
GetModuleFileNameA
SystemTimeToFileTime
CreateToolhelp32Snapshot
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
EnumDisplayMonitors
EnumDisplaySettingsW
LoadIconW
LoadCursorFromFileW
GetRawInputData
SystemParametersInfoW
GetRawInputDeviceInfoA
RegisterRawInputDevices
GetRawInputDeviceList
DestroyCursor
GetWindowInfo
LoadImageW
CreateIconIndirect
LoadCursorW
SetWindowLongW
GetWindowLongW
WindowFromPoint
ClientToScreen
ClipCursor
GetCursorPos
SetCursor
SetCursorPos
ShowCursor
AdjustWindowRectEx
GetClientRect
SetWindowRgn
EndPaint
BeginPaint
ReleaseDC
GetDC
GetForegroundWindow
SetActiveWindow
UpdateWindow
DrawStateW
IsWindowEnabled
EnableWindow
ReleaseCapture
SetCapture
ChangeDisplaySettingsW
MapVirtualKeyW
RegisterTouchWindow
CloseTouchInputHandle
GetTouchInputInfo
SendInput
GetAsyncKeyState
GetKeyState
GetFocus
GetActiveWindow
SetFocus
EmptyClipboard
EnumDisplayDevicesA
GetClipboardData
SetClipboardData
GetProcessWindowStation
GetUserObjectInformationW
CloseClipboard
OpenClipboard
IsZoomed
IsIconic
SetWindowPlacement
GetWindowPlacement
SetLayeredWindowAttributes
ShowWindow
DestroyWindow
IsWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
DefWindowProcW
SendMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
DisableProcessWindowsGhosting
GetKeyboardLayout
EnumDisplayDevicesW
GetWindowThreadProcessId
GetTopWindow
ScreenToClient
MessageBoxW
GetWindowRect
SetWindowTextW
SetForegroundWindow
SetDlgItemTextW
GetDlgItem
EndDialog
DialogBoxParamW
SetWindowPos
PostQuitMessage
UnregisterHotKey
RegisterHotKey
GetSystemMetrics
GetKeyboardLayoutNameW
MsgWaitForMultipleObjects
ChangeDisplaySettingsExW
GetCapture
PostMessageW
SetPixelFormat
SwapBuffers
SetBkColor
ChoosePixelFormat
CreateDCW
ExtEscape
CreateCompatibleDC
DeleteDC
GetTextExtentPoint32W
CreateFontIndirectW
CreateBitmap
TextOutW
GetObjectW
CreateDIBSection
CreateRectRgn
CreateRoundRectRgn
DeleteObject
GetStockObject
PtInRegion
SelectObject
SetTextAlign
SetBkMode
SetTextColor
RegQueryValueExW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegOpenKeyExW
GetUserNameA
RegSetValueExW
GetUserNameW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW
ShellExecuteW
ord165
CoInitializeEx
RevokeDragDrop
RegisterDragDrop
ReleaseStgMedium
OleInitialize
CoInitialize
CoCreateGuid
StringFromGUID2
IIDFromString
OleUninitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
PropVariantClear
SysAllocString
SysFreeString
VariantCopy
GetAdaptersInfo
GetAdaptersAddresses
SetupDiOpenDevRegKey
CM_Get_Device_IDW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo
SetupDiGetClassDevsExW
SetupDiGetClassDevsW
DwmFlush
DwmIsCompositionEnabled
DwmGetCompositionTimingInfo
DwmSetWindowAttribute
ImmAssociateContext
ImmGetCompositionStringW
ImmGetContext
ImmDestroyContext
ImmCreateContext
ImmGetProperty
ImmGetIMEFileNameW
ImmGetDescriptionW
ImmSetCompositionWindow
ImmReleaseContext
ImmNotifyIME
ImmSetCandidateWindow
ord2
ord3
CreateDXGIFactory1
CreateDXGIFactory
D3DPERF_BeginEvent
D3DPERF_EndEvent
D3D11CreateDevice
X3DAudioCalculate
X3DAudioInitialize
CreateFX
wglGetCurrentDC
wglGetCurrentContext
wglDeleteContext
wglCreateContext
wglGetProcAddress
wglMakeCurrent
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
ord143
ord46
ord211
ord60
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
IdnToAscii
ord11
ord12
ord8
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?_Ios_base_dtor@ios_base@std@@CAXPEAV12@@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?uncaught_exception@std@@YA_NXZ
?_Random_device@std@@YAIXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
CallNtPowerInformation
BCryptGenRandom
GetUserNameExA
longjmp
__std_type_info_name
strchr
__CxxFrameHandler3
_CxxThrowException
__std_terminate
_set_purecall_handler
wcschr
wcsrchr
strstr
__std_type_info_compare
strrchr
memchr
memcmp
wcsstr
memset
memcpy
__intrinsic_setjmp
__RTDynamicCast
__std_exception_destroy
__std_exception_copy
_purecall
__vcrt_InitializeCriticalSectionEx
memmove
__C_specific_handler
_endthreadex
_beginthread
abort
_invalid_parameter_noinfo_noreturn
_errno
_invalid_parameter_noinfo
_beginthreadex
_endthread
_exit
_register_thread_local_exe_atexit_callback
raise
strerror
_c_exit
_initterm_e
exit
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
terminate
signal
_set_invalid_parameter_handler
_cexit
_crt_atexit
__sys_nerr
_register_onexit_function
_initialize_onexit_table
_getpid
_initialize_narrow_environment
_configure_narrow_argv
srand
rand
qsort
wcsncmp
iswdigit
strncpy
_wcsnicmp
strcmp
isspace
wcsncpy
strnlen
towlower
strncpy_s
strcpy_s
_strdup
isalnum
_strnicmp
isupper
isxdigit
_wcsupr
strpbrk
strtok
isdigit
wcslen
strncat_s
strcat_s
towupper
isgraph
toupper
_stricmp
isprint
iswalpha
iswxdigit
iswupper
iswlower
iswalnum
islower
strlen
memcpy_s
strncmp
iswspace
_wcsicmp
wcsncpy_s
isalpha
tolower
_open
__stdio_common_vfprintf
_fileno
_setmode
fputs
__stdio_common_vsprintf_s
__stdio_common_vsnprintf_s
fopen
_lseeki64
fputc
__stdio_common_vsprintf
ferror
feof
_wfopen
fwrite
_set_fmode
__stdio_common_vsscanf
fseek
fopen_s
__p__commode
_write
_close
fgets
__acrt_iob_func
ftell
__stdio_common_vfwprintf
_fseeki64
fread
fclose
__stdio_common_vswprintf_s
__stdio_common_vswprintf
fflush
setvbuf
_read
tan
_fpclass
sqrtf
atan2
atan2f
log10f
exp
roundf
exp2
expf
asinf
log10
fmodf
powf
_finite
tanf
log2f
atanf
__setusermatherr
log
sqrt
cosf
modff
floor
ldexp
fabs
sinf
ceil
frexp
modf
acosf
truncf
_isnan
pow
logf
sinhf
floorf
cos
sin
wcstoul
_strtoui64
atol
strtoll
_wtof
wcstod
strtoul
_wtoi
strtod
_strtoi64
_wtoi64
_wcstoui64
atoi
strtol
_gmtime64
_time64
malloc
free
calloc
realloc
_set_new_mode
getenv
_stat64i32
_fstat64
_stat64
_getch
_configthreadlocale
HidD_GetAttributes
HidP_GetValueCaps
HidP_GetCaps
HidD_GetProductString
HidD_GetManufacturerString
HidD_SetFeature
HidD_GetFeature
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetSerialNumberString
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
PrintScriptCallstack
agsDeInit
agsDriverExtensionsDX11_BeginUAVOverlap
agsDriverExtensionsDX11_DeInit
agsDriverExtensionsDX11_EndUAVOverlap
agsDriverExtensionsDX11_GetMaxClipRects
agsDriverExtensionsDX11_IASetPrimitiveTopology
agsDriverExtensionsDX11_Init
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirect
agsDriverExtensionsDX11_MultiDrawIndexedInstancedIndirectCountIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirect
agsDriverExtensionsDX11_MultiDrawInstancedIndirectCountIndirect
agsDriverExtensionsDX11_NumPendingAsyncCompileJobs
agsDriverExtensionsDX11_SetClipRects
agsDriverExtensionsDX11_SetDepthBounds
agsDriverExtensionsDX11_SetDiskShaderCacheEnabled
agsDriverExtensionsDX11_SetMaxAsyncCompileThreadCount
agsDriverExtensionsDX11_SetViewBroadcastMasks
agsGetCrossfireGPUCount
agsInit
agsSetDisplayMode
opus_decode
opus_decode_float
opus_decoder_create
opus_decoder_ctl
opus_decoder_destroy
opus_decoder_get_nb_samples
opus_decoder_get_size
opus_decoder_init
opus_encode
opus_encode_float
opus_encoder_create
opus_encoder_ctl
opus_encoder_destroy
opus_encoder_get_size
opus_encoder_init
opus_get_version_string
opus_multistream_decode
opus_multistream_decode_float
opus_multistream_decoder_create
opus_multistream_decoder_ctl
opus_multistream_decoder_destroy
opus_multistream_decoder_get_size
opus_multistream_decoder_init
opus_multistream_packet_pad
opus_multistream_packet_unpad
opus_packet_get_bandwidth
opus_packet_get_nb_channels
opus_packet_get_nb_frames
opus_packet_get_nb_samples
opus_packet_get_samples_per_frame
opus_packet_pad
opus_packet_parse
opus_packet_unpad
opus_pcm_soft_clip
opus_repacketizer_cat
opus_repacketizer_create
opus_repacketizer_destroy
opus_repacketizer_get_nb_frames
opus_repacketizer_get_size
opus_repacketizer_init
opus_repacketizer_out
opus_repacketizer_out_range
opus_strerror
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ