0[.]1[.]2 Window (Demo)[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

0.1.2 Window (Demo).zip
Size

129.8MB
MD5

188a1aeb6e68150fb14f20a3330ee2c5
SHA1

27e0945d84710e784e169b3b3fb5b32ea1893af4
SHA256

59f75c225f1c361786b21fe5405bdaac06459317e7dd152fb1e0af059870ccfa
SHA512

b1ed4869305475dd6375716da95ce91b12c48abe71003084ef4e36076ab56e4cb4d3152732f2ba7b153077c55b28bcfe43f63ca4dd038d9c8ed8a63bd883bd5f
SSDEEP

3145728:ZZp+F8Rduqg4nIRCn5LzTDliCWIGjLNIBgzui3Wl8PdAsxzayuaUE5jEIy3:PdpNrLzThiCWbLuI3Wl8PdAsaGjty3

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/0.1.2 Window (Demo)/GameAssembly.dll
unpack001/0.1.2 Window (Demo)/My Rental Girlfriend.exe
unpack001/0.1.2 Window (Demo)/My Rental Girlfriend_Data/Plugins/lib_burst_generated.dll
unpack001/0.1.2 Window (Demo)/My Rental Girlfriend_Data/Plugins/x86_64/AVProMovieCapture.dll

Files

0.1.2 Window (Demo).zip
.zip
0.1.2 Window (Demo)/GameAssembly.dll
.dll windows:6 windows x64

078cdac089fdb603390013f231604e79

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

FlushFileBuffers
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetFullPathNameW
ReadFile
RemoveDirectoryW
SetEndOfFile
SetFilePointerEx
WriteFile
IsDebuggerPresent
CloseHandle
DuplicateHandle
RaiseException
GetLastError
SetLastError
CreatePipe
QueryPerformanceCounter
QueryPerformanceFrequency
GetOverlappedResult
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SetEvent
ResetEvent
ReleaseSemaphore
ReleaseMutex
SleepEx
WaitForSingleObjectEx
WaitForMultipleObjectsEx
CreateMutexW
CreateEventW
Sleep
CreateSemaphoreW
QueueUserAPC
GetCurrentProcess
GetCurrentProcessId
GetExitCodeProcess
SwitchToThread
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
GetSystemTimes
GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExW
GetNativeSystemInfo
VirtualAlloc
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
FreeLibrary
GetModuleFileNameW
FindFirstFileExW
GetProcAddress
LoadLibraryW
GlobalAlloc
GlobalFree
FormatMessageW
CopyFileW
MoveFileExW
GetComputerNameW
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetFileInformationByHandleEx
WideCharToMultiByte
GetACP
GetLocaleInfoW
GetThreadLocale
GetConsoleMode
K32GetProcessImageFileNameW
SetFilePointer
GetExitCodeThread
SuspendThread
ResumeThread
GetThreadContext
VirtualFree
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FindClose
DeleteFileW
CreateFileW
CreateDirectoryW
GetCurrentDirectoryW
GetCommandLineW
RtlUnwind
GetCommandLineA
FindNextFileA
FindFirstFileExA
SetStdHandle
GetOEMCP
IsValidCodePage
HeapQueryInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapFree
HeapAlloc
GetModuleFileNameA
GetConsoleCP
ReadConsoleW
GetModuleHandleExW
ExitProcess
SetEnvironmentVariableW
GetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
LoadLibraryExW
InterlockedFlushSList
RtlUnwindEx
RtlPcToFileHeader
TerminateProcess
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
LCMapStringW
CompareStringW
TlsFree
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
DecodePointer
EncodePointer
FindNextFileW
GetStdHandle
GetModuleHandleW
RtlCaptureStackBackTrace

user32

MessageBoxA

advapi32

GetUserNameW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom

ole32

CoCreateFreeThreadedMarshaler
CoGetContextToken
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx

oleaut32

SafeArrayCreate
SafeArrayDestroy
SafeArrayGetDim
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysFreeString
SafeArrayGetVartype
SysStringLen

shell32

SHGetFolderPathW
SHGetKnownFolderPath

ws2_32

shutdown
setsockopt
send
select
recvfrom
ntohs
ntohl
WSACleanup
inet_ntoa
socket
htons
htonl
getsockopt
getsockname
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
gethostbyaddr
gethostname
WSAStartup
inet_addr
WSAGetLastError
WSAIoctl
WSARecv
inet_ntop
inet_pton
getnameinfo
freeaddrinfo
getaddrinfo
WSAPoll
listen
WSASend

iphlpapi

GetIfEntry
GetAdaptersAddresses
GetNetworkParams

Exports

Exports

CloseZStream
CreateZStream
DllCanUnloadNow
DllGetActivationFactory
Flush
ReadZStream
UnityPalGetLocalTimeZoneData
UnityPalGetTimeZoneDataForID
UnityPalTimeZoneInfoGetTimeZoneIDs
UseUnityPalForTimeZoneInformation
WriteZStream
il2cpp_add_internal_call
il2cpp_alloc
il2cpp_allocation_granularity
il2cpp_array_class_get
il2cpp_array_element_size
il2cpp_array_get_byte_length
il2cpp_array_length
il2cpp_array_new
il2cpp_array_new_full
il2cpp_array_new_specific
il2cpp_array_object_header_size
il2cpp_assembly_get_image
il2cpp_bounded_array_class_get
il2cpp_capture_memory_snapshot
il2cpp_class_array_element_size
il2cpp_class_enum_basetype
il2cpp_class_for_each
il2cpp_class_from_il2cpp_type
il2cpp_class_from_name
il2cpp_class_from_system_type
il2cpp_class_from_type
il2cpp_class_get_assemblyname
il2cpp_class_get_bitmap
il2cpp_class_get_bitmap_size
il2cpp_class_get_data_size
il2cpp_class_get_declaring_type
il2cpp_class_get_element_class
il2cpp_class_get_events
il2cpp_class_get_field_from_name
il2cpp_class_get_fields
il2cpp_class_get_flags
il2cpp_class_get_image
il2cpp_class_get_interfaces
il2cpp_class_get_method_from_name
il2cpp_class_get_methods
il2cpp_class_get_name
il2cpp_class_get_namespace
il2cpp_class_get_nested_types
il2cpp_class_get_parent
il2cpp_class_get_properties
il2cpp_class_get_property_from_name
il2cpp_class_get_rank
il2cpp_class_get_static_field_data
il2cpp_class_get_type
il2cpp_class_get_type_token
il2cpp_class_get_userdata_offset
il2cpp_class_has_attribute
il2cpp_class_has_parent
il2cpp_class_has_references
il2cpp_class_instance_size
il2cpp_class_is_abstract
il2cpp_class_is_assignable_from
il2cpp_class_is_blittable
il2cpp_class_is_enum
il2cpp_class_is_generic
il2cpp_class_is_inflated
il2cpp_class_is_interface
il2cpp_class_is_subclass_of
il2cpp_class_is_valuetype
il2cpp_class_num_fields
il2cpp_class_set_userdata
il2cpp_class_value_size
il2cpp_current_thread_get_frame_at
il2cpp_current_thread_get_stack_depth
il2cpp_current_thread_get_top_frame
il2cpp_current_thread_walk_frame_stack
il2cpp_custom_attrs_construct
il2cpp_custom_attrs_free
il2cpp_custom_attrs_from_class
il2cpp_custom_attrs_from_method
il2cpp_custom_attrs_get_attr
il2cpp_custom_attrs_has_attr
il2cpp_debug_get_method_info
il2cpp_debugger_set_agent_options
il2cpp_domain_assembly_open
il2cpp_domain_get
il2cpp_domain_get_assemblies
il2cpp_exception_from_name_msg
il2cpp_field_get_flags
il2cpp_field_get_name
il2cpp_field_get_offset
il2cpp_field_get_parent
il2cpp_field_get_type
il2cpp_field_get_value
il2cpp_field_get_value_object
il2cpp_field_has_attribute
il2cpp_field_is_literal
il2cpp_field_set_value
il2cpp_field_set_value_object
il2cpp_field_static_get_value
il2cpp_field_static_set_value
il2cpp_format_exception
il2cpp_format_stack_trace
il2cpp_free
il2cpp_free_captured_memory_snapshot
il2cpp_gc_collect
il2cpp_gc_collect_a_little
il2cpp_gc_disable
il2cpp_gc_enable
il2cpp_gc_foreach_heap
il2cpp_gc_get_heap_size
il2cpp_gc_get_max_time_slice_ns
il2cpp_gc_get_used_size
il2cpp_gc_has_strict_wbarriers
il2cpp_gc_is_disabled
il2cpp_gc_is_incremental
il2cpp_gc_set_external_allocation_tracker
il2cpp_gc_set_external_wbarrier_tracker
il2cpp_gc_set_max_time_slice_ns
il2cpp_gc_wbarrier_set_field
il2cpp_gchandle_foreach_get_target
il2cpp_gchandle_free
il2cpp_gchandle_get_target
il2cpp_gchandle_new
il2cpp_gchandle_new_weakref
il2cpp_get_corlib
il2cpp_get_exception_argument_null
il2cpp_image_get_assembly
il2cpp_image_get_class
il2cpp_image_get_class_count
il2cpp_image_get_entry_point
il2cpp_image_get_filename
il2cpp_image_get_name
il2cpp_init
il2cpp_init_utf16
il2cpp_is_debugger_attached
il2cpp_is_vm_thread
il2cpp_method_get_class
il2cpp_method_get_declaring_type
il2cpp_method_get_flags
il2cpp_method_get_from_reflection
il2cpp_method_get_name
il2cpp_method_get_object
il2cpp_method_get_param
il2cpp_method_get_param_count
il2cpp_method_get_param_name
il2cpp_method_get_return_type
il2cpp_method_get_token
il2cpp_method_has_attribute
il2cpp_method_is_generic
il2cpp_method_is_inflated
il2cpp_method_is_instance
il2cpp_monitor_enter
il2cpp_monitor_exit
il2cpp_monitor_pulse
il2cpp_monitor_pulse_all
il2cpp_monitor_try_enter
il2cpp_monitor_try_wait
il2cpp_monitor_wait
il2cpp_object_get_class
il2cpp_object_get_size
il2cpp_object_get_virtual_method
il2cpp_object_header_size
il2cpp_object_new
il2cpp_object_unbox
il2cpp_offset_of_array_bounds_in_array_object_header
il2cpp_offset_of_array_length_in_array_object_header
il2cpp_override_stack_backtrace
il2cpp_profiler_install
il2cpp_profiler_install_allocation
il2cpp_profiler_install_enter_leave
il2cpp_profiler_install_fileio
il2cpp_profiler_install_gc
il2cpp_profiler_install_thread
il2cpp_profiler_set_events
il2cpp_property_get_flags
il2cpp_property_get_get_method
il2cpp_property_get_name
il2cpp_property_get_parent
il2cpp_property_get_set_method
il2cpp_raise_exception
il2cpp_register_debugger_agent_transport
il2cpp_register_log_callback
il2cpp_resolve_icall
il2cpp_runtime_class_init
il2cpp_runtime_invoke
il2cpp_runtime_invoke_convert_args
il2cpp_runtime_object_init
il2cpp_runtime_object_init_exception
il2cpp_runtime_unhandled_exception_policy_set
il2cpp_set_commandline_arguments
il2cpp_set_commandline_arguments_utf16
il2cpp_set_config
il2cpp_set_config_dir
il2cpp_set_config_utf16
il2cpp_set_data_dir
il2cpp_set_default_thread_affinity
il2cpp_set_find_plugin_callback
il2cpp_set_memory_callbacks
il2cpp_set_temp_dir
il2cpp_shutdown
il2cpp_start_gc_world
il2cpp_stats_dump_to_file
il2cpp_stats_get_value
il2cpp_stop_gc_world
il2cpp_string_chars
il2cpp_string_intern
il2cpp_string_is_interned
il2cpp_string_length
il2cpp_string_new
il2cpp_string_new_len
il2cpp_string_new_utf16
il2cpp_string_new_wrapper
il2cpp_thread_attach
il2cpp_thread_current
il2cpp_thread_detach
il2cpp_thread_get_all_attached_threads
il2cpp_thread_get_frame_at
il2cpp_thread_get_stack_depth
il2cpp_thread_get_top_frame
il2cpp_thread_walk_frame_stack
il2cpp_type_equals
il2cpp_type_get_assembly_qualified_name
il2cpp_type_get_attrs
il2cpp_type_get_class_or_element_class
il2cpp_type_get_name
il2cpp_type_get_name_chunked
il2cpp_type_get_object
il2cpp_type_get_type
il2cpp_type_is_byref
il2cpp_type_is_pointer_type
il2cpp_type_is_static
il2cpp_unhandled_exception
il2cpp_unity_install_unitytls_interface
il2cpp_unity_liveness_calculation_begin
il2cpp_unity_liveness_calculation_end
il2cpp_unity_liveness_calculation_from_root
il2cpp_unity_liveness_calculation_from_statics
il2cpp_value_box

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

il2cpp
Size: 22.7MB - Virtual size: 22.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6.3MB - Virtual size: 6.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 717KB - Virtual size: 717KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
0.1.2 Window (Demo)/My Rental Girlfriend.exe
.exe windows:6 windows x64

fd60dddc87379c239e8ac49516966c3e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

unityplayer

UnityMain

kernel32

GetModuleHandleExW
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RaiseException
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
0.1.2 Window (Demo)/My Rental Girlfriend_Data/Plugins/lib_burst_generated.dll
.dll windows:6 windows x64

5ae2616ee957c7d5d50bf415014e8e5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetProcAddress
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
HeapAlloc
HeapFree
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
CreateFileW
CloseHandle
WriteConsoleW
RtlUnwindEx
InterlockedFlushSList
RaiseException

Exports

Exports

0c6ccfd2bba93d68e31208c014c56d05
0c96fb01b070c5126b22b8685cc3e444
567a7130f54553b988d02c0a5471243f
5760d72067eca5167840d7d4530073dd
9489cdcace9811f1ed31e365fa9d41a2
94d5c1f8e5738c317ab470f74caee94d
ace2aae5a27941878a3e799c113aa8ca
b5cdf7e8f004ac62ab5cf712781c2d56
burst.initialize
c235422c83e609b2fc8d36e7805d7083
cfea4edd4d3923f14bbd080d30d59a25
eeb7723452876b9aacdf4fedc32ae7e2
f8836ca6e4d6f549d52557a9dcf72086

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
0.1.2 Window (Demo)/My Rental Girlfriend_Data/Plugins/lib_burst_generated.txt
0.1.2 Window (Demo)/My Rental Girlfriend_Data/Plugins/x86_64/AVProMovieCapture.dll
.dll windows:6 windows x64

ecb136798bcedf819381f9818e558515

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

ResetEvent
WaitForMultipleObjects
SetEndOfFile
CloseHandle
DecodePointer
GetSystemTime
lstrcmpW
ConnectNamedPipe
CreateNamedPipeW
CreateFileW
HeapAlloc
HeapFree
GetProcessHeap
WaitForSingleObject
CreateEventExA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
SetEvent
LoadLibraryW
CreateEventW
VerifyVersionInfoW
VerSetConditionMask
WriteFile
Sleep
TryEnterCriticalSection
GetCurrentThreadId
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
GetLastError
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
OutputDebugStringW
EncodePointer
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitThread
ExitProcess
HeapReAlloc
HeapSize
LCMapStringW
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetStringTypeW
SetStdHandle
ReadFile
ReadConsoleW

ole32

CoUninitialize
CoTaskMemAlloc
CLSIDFromString
PropVariantClear
CoCreateInstance
CoTaskMemFree
CreateBindCtx
CoInitializeEx
GetRunningObjectTable
StringFromGUID2
CoInitialize
CoFreeUnusedLibraries
CreateItemMoniker

winmm

timeGetTime

msvfw32

ICClose
ICGetInfo
ICSendMessage
ICCompress
ICOpen
ICInfo

user32

wsprintfW
MessageBoxW
SetRectEmpty

advapi32

RegOpenKeyW
RegCloseKey
RegQueryValueExW

oleaut32

OleCreatePropertyFrame
SysStringLen
VariantClear
VariantInit

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualQuery

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExA

shlwapi

ord219

Exports

Exports

AddAmbisonicSourceInstance
ConfigureAudioCodec
ConfigureVideoCodec
CreateRecorderImages
CreateRecorderPipe
CreateRecorderVideo
Deinit
EncodeAudio
EncodeFrame
EncodeFrameWithAudio
EncodeMonoToAmbisonic
FreeRecorder
GetAudioCodecCount
GetAudioCodecMediaApi
GetAudioCodecName
GetAudioInputDeviceCount
GetAudioInputDeviceMediaApi
GetAudioInputDeviceName
GetContainerFileExtensions
GetEncodedSeconds
GetFreeResourcesEventFunc
GetNumDroppedEncoderFrames
GetNumDroppedFrames
GetNumEncodedFrames
GetPluginVersion
GetRenderEventFunc
GetVideoCodecCount
GetVideoCodecMediaApi
GetVideoCodecName
Init
IsConfigureAudioCodecSupported
IsConfigureVideoCodecSupported
IsFileWritingComplete
IsNewFrameDue
IsTrialVersion
Pause
RemoveAmbisonicSourceInstance
SetColourBuffer
SetMicrophoneRecordingHint
SetTexturePointer
Start
Stop
UnityPluginLoad
UnityRenderEvent
UnitySetGraphicsDevice
UpdateAmbisonicWeights

Sections

.text
Size: 410KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 155KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
0.1.2 Window (Demo)/My Rental Girlfriend_Data/Resources/unity default resources
0.1.2 Window (Demo)/My Rental Girlfriend_Data/Resources/unity_builtin_extra
0.1.2 Window (Demo)/My Rental Girlfriend_Data/app.info
0.1.2 Window (Demo)/My Rental Girlfriend_Data/boot.config
0.1.2 Window (Demo)/My Rental Girlfriend_Data/globalgamemanagers
0.1.2 Window (Demo)/My Rental Girlfriend_Data/globalgamemanagers.assets
0.1.2 Window (Demo)/My Rental Girlfriend_Data/globalgamemanagers.assets.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/Metadata/global-metadata.dat
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/2.0/Browsers/Compat.browser
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/2.0/DefaultWsdlHelpGenerator.aspx
.js
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/2.0/machine.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/2.0/settings.map
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/2.0/web.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.0/Browsers/Compat.browser
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.0/DefaultWsdlHelpGenerator.aspx
.js
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.0/machine.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.0/settings.map
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.0/web.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.5/Browsers/Compat.browser
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.5/DefaultWsdlHelpGenerator.aspx
.js
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.5/machine.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.5/settings.map
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/4.5/web.config
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/browscap.ini
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/config
0.1.2 Window (Demo)/My Rental Girlfriend_Data/il2cpp_data/etc/mono/mconfig/config.xml
.xml
0.1.2 Window (Demo)/My Rental Girlfriend_Data/level0
0.1.2 Window (Demo)/My Rental Girlfriend_Data/level0.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/level1
0.1.2 Window (Demo)/My Rental Girlfriend_Data/level1.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/level2
0.1.2 Window (Demo)/My Rental Girlfriend_Data/resources.assets
0.1.2 Window (Demo)/My Rental Girlfriend_Data/resources.assets.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/resources.resource
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets0.assets
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets0.assets.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets0.resource
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets1.assets
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets1.assets.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets1.resource
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets2.assets
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets2.assets.resS
0.1.2 Window (Demo)/My Rental Girlfriend_Data/sharedassets2.resource
0.1.2 Window (Demo)/UnityCrashHandler64.exe
.exe windows:6 windows x64

4c171eb95098a673298b5922d38b1833

Code Sign

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/07/2018, 00:00

Not After

10/07/2021, 23:59

Subject

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c0:9d:1a:e1:12:45:e1:ef:78:21:bf:f5:ef:3e:cb:ba:b5:61:26:dd
Signer

Actual PE Digest

c0:9d:1a:e1:12:45:e1:ef:78:21:bf:f5:ef:3e:cb:ba:b5:61:26:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

SetWindowPos
OffsetRect
CreateIconFromResourceEx
LookupIconIdFromDirectoryEx
UnionRect
InflateRect
AdjustWindowRect
SendMessageW
DialogBoxParamA
SetWindowTextW
EndDialog
GetDlgItem
SendDlgItemMessageA
GetWindowLongA
LoadImageA
GetIconInfo
SetForegroundWindow

kernel32

VirtualProtect
GetVersionExW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
HeapQueryInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapFree
HeapAlloc
FreeLibraryAndExitThread
CloseHandle
RaiseException
GetCurrentThread
OpenThread
GetThreadTimes
GetModuleHandleA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
GetThreadPriority
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
VerSetConditionMask
FreeLibrary
GetModuleFileNameA
GetModuleHandleW
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableA
GetCurrentDirectoryA
GetFileAttributesA
OutputDebugStringA
GetLastError
SetLastError
WaitForSingleObject
CreateEventW
GetCurrentProcess
GetCurrentProcessId
SuspendThread
ResumeThread
GetThreadContext
ReadProcessMemory
InterlockedPopEntrySList
FormatMessageW
VerifyVersionInfoW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
SetEvent
WaitForMultipleObjectsEx
Sleep
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetProcessId
GetThreadId
OpenProcess
GetStdHandle
CreateFileW
DeleteFileW
GetDiskFreeSpaceExW
GetFileAttributesW
GetFileSize
ReadFile
GetTempPathW
GetSystemTime
GetSystemTimeAsFileTime
CopyFileExW
AllocConsole
SetErrorMode
GetCommandLineW
FileTimeToLocalFileTime
FindClose
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetFileTime
WriteFile
InitializeCriticalSection
CreateEventA
TerminateThread
GetExitCodeThread
GlobalMemoryStatusEx
GetSystemInfo
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LoadLibraryW
FileTimeToDosDateTime
lstrlenA
FindResourceA
EnumResourceNamesA
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSemaphore
TlsAlloc
TlsFree
VirtualAlloc
VirtualFree
GetModuleFileNameW
SetFilePointerEx
GetConsoleCP
GetConsoleMode
SetConsoleCtrlHandler
GetFileType
SetStdHandle
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
RtlPcToFileHeader
GetLocaleInfoW
QueryDepthSList
UnregisterWaitEx
LCMapStringW
CompareStringW
GetTickCount
TlsSetValue
TlsGetValue
DecodePointer
EncodePointer
GetCPInfo
LocalFree
VirtualQueryEx
DuplicateHandle
GetStringTypeW
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
ResetEvent

dbghelp

SymRegisterFunctionEntryCallback64
SymLoadModuleEx

shell32

CommandLineToArgvW
SHCreateDirectoryExW

ole32

CoCreateGuid
CoTaskMemFree
CoInitializeEx

psapi

GetModuleFileNameExW
GetProcessMemoryInfo
GetPerformanceInfo

advapi32

GetUserNameW
GetUserNameA

wininet

HttpSendRequestA
HttpQueryInfoA
HttpOpenRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetCrackUrlA

gdi32

GetObjectA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
GetFileVersionInfoW
VerQueryValueA
VerQueryValueW
GetFileVersionInfoSizeW

Sections

.text
Size: 508KB - Virtual size: 507KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 179KB - Virtual size: 179KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 327KB - Virtual size: 326KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
0.1.2 Window (Demo)/UnityPlayer.dll
.dll windows:6 windows x64

c0dfe420a12f4fdf5804ef6296b9fa58

Code Sign

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/07/2018, 00:00

Not After

10/07/2021, 23:59

Subject

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:b8:5c:92:69:c3:b8:0b:60:58:04:b4:c1:db:c5:70:89:49:2a:73
Signer

Actual PE Digest

7b:b8:5c:92:69:c3:b8:0b:60:58:04:b4:c1:db:c5:70:89:49:2a:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

SetEndOfFile
SetFileAttributesW
SetFilePointer
SetFilePointerEx
SetFileTime
GetCurrentThreadId
OpenThread
SuspendThread
ResumeThread
LocalFree
FormatMessageW
CopyFileW
MoveFileExW
ReplaceFileW
SystemTimeToFileTime
Thread32First
Thread32Next
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetEnvironmentVariableA
GetCurrentDirectoryA
GetCurrentDirectoryW
GetFileAttributesA
DebugBreak
SetUnhandledExceptionFilter
SetLastError
GetErrorMode
TerminateProcess
CreateThread
GetThreadContext
ReadProcessMemory
GetModuleFileNameA
LocalAlloc
GetOverlappedResult
CancelIo
ResetEvent
GetTickCount
GetStartupInfoA
SetConsoleCtrlHandler
GetSystemInfo
SetDllDirectoryW
SleepEx
RaiseException
GetThreadTimes
SwitchToThread
SetThreadPriority
GetThreadPriority
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FormatMessageA
QueryPerformanceCounter
QueryPerformanceFrequency
GetWindowsDirectoryW
CreateIoCompletionPort
GetQueuedCompletionStatus
AttachConsole
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
ReleaseSemaphore
GetLocalTime
GetTimeZoneInformation
IsDebuggerPresent
CreateSemaphoreExW
TlsAlloc
TlsFree
GetNativeSystemInfo
VirtualQuery
GetFileSize
GetComputerNameW
LoadLibraryW
GetModuleHandleW
GetModuleFileNameW
VirtualFree
VirtualProtect
VirtualAlloc
GetProcessId
CreateProcessW
GetExitCodeProcess
WaitForMultipleObjects
CreateEventW
CreatePipe
SetHandleInformation
WriteConsoleW
GetDiskFreeSpaceExW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
ReadFile
IsValidCodePage
SetConsoleMode
SetStdHandle
GetProcessHeap
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapAlloc
HeapFree
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
GetDriveTypeW
ReadConsoleW
GetConsoleMode
GetConsoleCP
HeapQueryInformation
HeapSize
HeapReAlloc
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
RtlUnwindEx
UnregisterWaitEx
QueryDepthSList
GetVersionExW
FreeLibraryAndExitThread
UnregisterWait
RegisterWaitForSingleObject
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
DecodePointer
EncodePointer
DuplicateHandle
VerifyVersionInfoA
ExpandEnvironmentStringsA
InitializeCriticalSectionEx
GetTickCount64
GlobalMemoryStatus
GetFileType
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
CreateWaitableTimerA
SetWaitableTimer
OpenEventA
ReadConsoleInputW
FlushConsoleInputBuffer
SetThreadAffinityMask
GetStdHandle
OutputDebugStringA
GetTempPathW
WriteFile
FlushFileBuffers
CreateFileA
GetCommandLineW
GetLogicalProcessorInformationEx
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateFileW
CreateDirectoryW
ExpandEnvironmentStringsW
GetSystemTimeAsFileTime
GetSystemTime
GlobalLock
GlobalUnlock
GlobalAlloc
GetTempFileNameW
GetFileAttributesW
DeleteFileW
RemoveDirectoryW
GetFullPathNameW
GetACP
GetSystemDirectoryA
GlobalMemoryStatusEx
RtlUnwind
SetErrorMode
GetFileAttributesExW
CreateToolhelp32Snapshot
GetUserDefaultLocaleName
SetEnvironmentVariableW
GetSystemPowerStatus
LoadLibraryExW
GetCurrentThread
GetCurrentProcess
GetLastError
GetModuleHandleA
MultiByteToWideChar
WaitForSingleObject
Sleep
CreateEventA
WaitForSingleObjectEx
VerifyVersionInfoW
CloseHandle
CreateEventExW
WaitForMultipleObjectsEx
SetEvent
VerSetConditionMask
WideCharToMultiByte
LoadLibraryA
GetProcAddress
FreeLibrary
GetCurrentProcessId
TlsSetValue
TlsGetValue

user32

EnumDisplaySettingsA
GetCaretBlinkTime
DestroyWindow
CreateWindowExW
ShowWindow
UpdateWindow
GetDesktopWindow
EnumDisplayDevicesA
MonitorFromWindow
ReleaseDC
AllowSetForegroundWindow
TrackMouseEvent
OpenClipboard
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
SetClipboardData
GetClipboardData
EmptyClipboard
IsClipboardFormatAvailable
SetCursor
LoadCursorA
DestroyCursor
EnumDisplaySettingsW
SetWindowLongA
AdjustWindowRectEx
GetWindowPlacement
GetDC
MsgWaitForMultipleObjects
EnumDisplayMonitors
GetMonitorInfoW
GetMonitorInfoA
DestroyIcon
LoadImageW
DefWindowProcW
SetWindowPos
GetClientRect
GetWindowRect
ScreenToClient
GetWindowLongA
SetWindowLongPtrA
GetParent
GetThreadDesktop
GetUserObjectInformationA
RegisterWindowMessageA
SendMessageTimeoutA
IsIconic
SetForegroundWindow
EnumWindows
UnregisterClassW
RegisterClassExW
DialogBoxParamW
EndDialog
SetDlgItemTextA
SetDlgItemTextW
SendDlgItemMessageW
MessageBoxA
CopyRect
OffsetRect
LoadIconA
GetKeyboardLayoutNameW
TranslateMessage
DispatchMessageA
GetMessagePos
GetMessageTime
GetMessageExtraInfo
RegisterDeviceNotificationW
UnregisterDeviceNotification
GetDoubleClickTime
IsWindowVisible
GetKeyState
GetAsyncKeyState
GetKeyNameTextW
MapVirtualKeyA
SetCapture
ReleaseCapture
GetSystemMetrics
MonitorFromRect
SetWindowLongPtrW
GetWindowLongPtrW
ClipCursor
ShowCursor
SetWindowTextW
ValidateRect
DragDetect
KillTimer
SetTimer
GetFocus
GetActiveWindow
SetFocus
RegisterClassW
PostQuitMessage
SendMessageW
PeekMessageA
GetMessageA
GetRawInputDeviceList
RegisterRawInputDevices
GetRawInputDeviceInfoW
GetRawInputData
SystemParametersInfoW
PtInRect
ClientToScreen
GetCursorPos
SetCursorPos

version

GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA

ole32

CoCreateFreeThreadedMarshaler
CoInitialize
CoUninitialize
PropVariantCopy
CoTaskMemFree
PropVariantClear
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoSetProxyBlanket

shlwapi

SHDeleteKeyW
PathCanonicalizeW

setupapi

SetupDiEnumDeviceInfo
SetupDiGetClassDevsA
SetupDiDestroyDeviceInfoList
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

advapi32

RegCloseKey
CryptImportKey
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
RegSetValueExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyW
GetUserNameA
GetTokenInformation
GetSidSubAuthority
OpenProcessToken
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
CryptEncrypt
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam

gdi32

ChoosePixelFormat
SetPixelFormat
GetDeviceCaps
SwapBuffers

shell32

ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW

opengl32

wglCreateContext
wglGetCurrentDC
wglDeleteContext
wglGetCurrentContext
wglGetProcAddress
wglMakeCurrent

winmm

waveInGetNumDevs
waveOutGetPosition
waveOutReset
waveOutWrite
waveInGetDevCapsA
waveOutPrepareHeader
waveInOpen
waveInClose
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveInReset
waveOutUnprepareHeader
timeEndPeriod
timeBeginPeriod
timeGetTime
waveOutGetNumDevs
waveOutGetDevCapsA
waveInGetDevCapsW
waveOutClose
waveOutOpen
waveOutGetDevCapsW

oleaut32

VariantClear
VariantInit
SysAllocString
SysFreeString
VariantChangeType

imm32

ImmGetConversionStatus
ImmSetCompositionStringW
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmGetContext
ImmNotifyIME
ImmReleaseContext

winhttp

WinHttpGetIEProxyConfigForCurrentUser

bcrypt

BCryptGenRandom

hid

HidD_GetManufacturerString
HidP_SetUsageValue
HidP_SetUsages
HidP_GetData
HidP_MaxDataListLength
HidP_GetValueCaps
HidP_GetButtonCaps
HidD_GetHidGuid
HidD_GetPreparsedData
HidD_FreePreparsedData
HidD_GetProductString
HidD_GetAttributes
HidD_GetSerialNumberString
HidP_GetCaps

crypt32

CertAddEncodedCertificateToStore
CertGetCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertCloseStore
CertOpenStore

ws2_32

WSASocketA
WSAGetLastError
WSASetLastError
send
select
recv
ntohs
inet_addr
htons
getsockname
ioctlsocket
connect
closesocket
bind
accept
recvfrom
sendto
setsockopt
shutdown
socket
gethostname
WSAStartup
WSACleanup
WSAIoctl
getaddrinfo
freeaddrinfo
getnameinfo
ntohl
getpeername
gethostbyname
getprotobyname
WSARecvFrom
WSACloseEvent
WSACreateEvent
WSASocketW
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSASetEvent
htonl
WSAAsyncGetHostByName
WSACancelAsyncRequest
gethostbyaddr
WSASendDisconnect
getsockopt
listen
__WSAFDIsSet

Exports

Exports

UnityMain

Sections

.text
Size: 20.2MB - Virtual size: 20.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 254KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1014KB - Virtual size: 1013KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

078cdac089fdb603390013f231604e79

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shell32

ws2_32

iphlpapi

Exports

Exports

Sections

.text Size: 2.3MB - Virtual size: 2.3MB

il2cpp Size: 22.7MB - Virtual size: 22.7MB

.rdata Size: 6.3MB - Virtual size: 6.3MB

.data Size: 1.9MB - Virtual size: 4.9MB

.pdata Size: 1.4MB - Virtual size: 1.4MB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 717KB - Virtual size: 717KB

fd60dddc87379c239e8ac49516966c3e

Headers

DLL Characteristics

File Characteristics

Imports

unityplayer

kernel32

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 39KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 552KB - Virtual size: 552KB

.reloc Size: 2KB - Virtual size: 1KB

5ae2616ee957c7d5d50bf415014e8e5e

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 120KB - Virtual size: 120KB

.rdata Size: 74KB - Virtual size: 73KB

.data Size: 2KB - Virtual size: 6KB

.pdata Size: 3KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 148B

.reloc Size: 2KB - Virtual size: 1KB

ecb136798bcedf819381f9818e558515

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

winmm

msvfw32

user32

advapi32

oleaut32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

shlwapi

Exports

Exports

Sections

.text Size: 410KB - Virtual size: 409KB

.rdata Size: 139KB - Virtual size: 139KB

.text
Size: 2.3MB - Virtual size: 2.3MB

il2cpp
Size: 22.7MB - Virtual size: 22.7MB

.rdata
Size: 6.3MB - Virtual size: 6.3MB

.data
Size: 1.9MB - Virtual size: 4.9MB

.pdata
Size: 1.4MB - Virtual size: 1.4MB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 717KB - Virtual size: 717KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 552KB - Virtual size: 552KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 120KB - Virtual size: 120KB

.rdata
Size: 74KB - Virtual size: 73KB

.data
Size: 2KB - Virtual size: 6KB

.pdata
Size: 3KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 148B

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 410KB - Virtual size: 409KB

.rdata
Size: 139KB - Virtual size: 139KB

.data
Size: 12KB - Virtual size: 155KB

.pdata
Size: 25KB - Virtual size: 24KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 5KB - Virtual size: 4KB

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

c0:9d:1a:e1:12:45:e1:ef:78:21:bf:f5:ef:3e:cb:ba:b5:61:26:dd
Signer

.text
Size: 508KB - Virtual size: 507KB

.rdata
Size: 179KB - Virtual size: 179KB

.data
Size: 10KB - Virtual size: 26KB

.pdata
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 327KB - Virtual size: 326KB

.reloc
Size: 5KB - Virtual size: 5KB

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:b8:5c:92:69:c3:b8:0b:60:58:04:b4:c1:db:c5:70:89:49:2a:73
Signer