2d267414a7b6514d7d090371bc375a58e04ccc95e65be1eb53473c234a7c6355[.]zip[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

2d267414a7b6514d7d090371bc375a58e04ccc95e65be1eb53473c234a7c6355.zip.zip
Size

35.7MB
MD5

a76555ca6aabf450b82c9143814e339e
SHA1

ff44103dccef58c980e1953c6d15ce258be71b55
SHA256

e573114ede77bcefa5e8c087e8802b40cee6d55bba68f93d95f41a465ef5195f
SHA512

a10dce336ff6a2e8781689c3be88a70b59ce59edc74c83d76f680c1384c769de8ea4d1835726c0cac45d348cc343f62433fad4a32ba2f80e59133ba2e91bc190
SSDEEP

786432:vnph36NuEIRXIp0oKt1KlQnjZIBHWozOCkmIxsLTxpSM7gjxxOGG6Om:vnuN32QvKt4lMjZI1WozKLifx0KYG6Om

Score

7^/10

upx vmprotect

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
static1/unpack002/SoftwareRG.dll	acprotect

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack002/SoftwareRG.dll	upx

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
static1/unpack002/main.exe	vmprotect

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Main.dll
unpack002/SoftwareRG.dll
unpack003/out.upx
unpack002/Xor_Plus/Settings/tga.bmd
unpack002/main.exe

Files

2d267414a7b6514d7d090371bc375a58e04ccc95e65be1eb53473c234a7c6355.zip.zip
.zip

Password: infected
2d267414a7b6514d7d090371bc375a58e04ccc95e65be1eb53473c234a7c6355.zip
.zip
Config.ini
Data/Gate.bmd
Data/Interface/lo_webzen_logo.OZT
Data/Item/item.bmd
Data/Local/Credit.bmd
Data/Local/Eng/Dialog_eng.bmd
Data/Local/Eng/ItemSetOption_eng.bmd
Data/Local/Eng/Item_eng.bmd
Data/Local/Eng/JewelOfHarmonyOption_eng.bmd
Data/Local/Eng/JewelOfHarmonySmelt_eng.bmd
Data/Local/Eng/MoveReq_eng.bmd
Data/Local/Eng/NpcName_eng.txt
Data/Local/Eng/Quest_eng.bmd
Data/Local/Eng/Skill_eng.bmd
Data/Local/Eng/Slide_eng.bmd
Data/Local/Eng/Text_eng.bmd
Data/Local/Everyone.OZJ
.jpg
Data/Local/Filter.bmd
Data/Local/FilterName.bmd
Data/Local/ItemAddOption.bmd
Data/Local/ItemSetType.bmd
Data/Local/Loading01.OZJ
.jpg
Data/Local/Loading02.OZJ
.jpg
Data/Local/Loading03.OZJ
.jpg
Data/Local/MonsterSkill.bmd
Data/Local/Por/Dialog_por.bmd
Data/Local/Por/ItemSetOption_por.bmd
Data/Local/Por/Item_por.bmd
Data/Local/Por/JewelOfHarmonyOption_por.bmd
Data/Local/Por/JewelOfHarmonySmelt_por.bmd
Data/Local/Por/MoveReq_por.bmd
Data/Local/Por/NpcName_por.txt
Data/Local/Por/Quest_por.bmd
Data/Local/Por/Skill_por.bmd
Data/Local/Por/Slide_por.bmd
Data/Local/Por/Text_por.bmd
Data/Local/Spn/Dialog_spn.bmd
Data/Local/Spn/ItemSetOption_spn.bmd
Data/Local/Spn/Item_spn.bmd
Data/Local/Spn/JewelOfHarmonyOption_spn.bmd
Data/Local/Spn/JewelOfHarmonySmelt_spn.bmd
Data/Local/Spn/MoveReq_spn.bmd
Data/Local/Spn/NpcName_spn.txt
Data/Local/Spn/Quest_spn.bmd
Data/Local/Spn/Skill_spn.bmd
Data/Local/Spn/Slide_spn.bmd
Data/Local/Spn/Text_spn.bmd
Data/Local/WebzenLogo.OZJ
.jpg
Data/Local/mlftemp.wst
Data/Object1/vali.ozt
Data/Object1/vali.tga
Data/Object7/Bug01.bmd
Data/Object7/Chandelier2.ozj
.jpg
Data/Object7/EBuild0102.OZJ
.jpg
Data/Object7/EBuild0102_R.OZJ
.jpg
Data/Object7/EBuild04.OZJ
.jpg
Data/Object7/EBuild05.OZJ
.jpg
Data/Object7/EBuild06.OZJ
.jpg
Data/Object7/EBuild07.OZJ
.jpg
Data/Object7/EBuild08.ozj
.jpg
Data/Object7/EBuild0801.ozj
.jpg
Data/Object7/EBuild0801_R.ozj
.jpg
Data/Object7/EBuild09.OZJ
.jpg
Data/Object7/EBuild0901.OZJ
.jpg
Data/Object7/EBuild0909.OZJ
.jpg
Data/Object7/EBuild10.OZJ
.jpg
Data/Object7/Effec001_R.OZJ
.jpg
Data/Object7/Effectest_R.OZJ
.jpg
Data/Object7/GMmingwall.OZJ
.jpg
Data/Object7/Ghost_hand_R.OZJ
.jpg
Data/Object7/Ghosteffec02_R.OZJ
.jpg
Data/Object7/Ghosteffec_R.OZJ
.jpg
Data/Object7/Ghosthand_R.OZJ
.jpg
Data/Object7/GoblinBody3111.ozj
.jpg
Data/Object7/Goblintail021.ozj
.jpg
Data/Object7/H_Monstergidoong013.ozj
.jpg
Data/Object7/King_Tower01.ozj
.jpg
Data/Object7/King_Tower02.ozj
.jpg
Data/Object7/King_Tower03.ozj
.jpg
Data/Object7/King_Tower04.OZJ
.jpg
Data/Object7/King_Tower07.ozj
.jpg
Data/Object7/King_Tower08.ozt
Data/Object7/King_Tower09.ozt
Data/Object7/Kinglight_R.ozj
.jpg
Data/Object7/Light01.bmd
Data/Object7/Light02.bmd
Data/Object7/Light03.bmd
Data/Object7/Logink.ozt
Data/Object7/MOH_Skill_362.ozt
Data/Object7/MOH_Tel2_303.ozj
.jpg
Data/Object7/MOH_Tel_303.ozj
.jpg
Data/Object7/MUv2LgZanclair.ozt
Data/Object7/MarketRoof_04.OZJ
.jpg
Data/Object7/Mcanwall001.OZJ
Data/Object7/Mcanwall011.OZJ
Data/Object7/Mcloud_R.OZJ
.jpg
Data/Object7/MingEmpireFlag01.ozj
.jpg
Data/Object7/MingFlagBlue.OZT
Data/Object7/MingFlagGreen.ozt
Data/Object7/MingFlagRed.OZT
Data/Object7/MingFlag_Green02.ozt
Data/Object7/MingFlag_Red02.OZT
Data/Object7/MingFlag_blue02.OZT
Data/Object7/Objec61.bmd
Data/Object7/Object01.bmd
Data/Object7/Object02.bmd
Data/Object7/Object03.bmd
Data/Object7/Object04.bmd
Data/Object7/Object05.bmd
Data/Object7/Object055.bmd
Data/Object7/Object06.bmd
Data/Object7/Object07.bmd
Data/Object7/Object08.bmd
Data/Object7/Object09.bmd
Data/Object7/Object10.bmd
Data/Object7/Object100.bmd
Data/Object7/Object101.bmd
Data/Object7/Object101/Object101.smd
Data/Object7/Object101/angeflo_R.jpg
.jpg
Data/Object7/Object102.bmd
Data/Object7/Object103.bmd
Data/Object7/Object104.bmd
Data/Object7/Object105.bmd
Data/Object7/Object106.bmd
Data/Object7/Object107.bmd
Data/Object7/Object108.bmd
Data/Object7/Object109.bmd
Data/Object7/Object11.bmd
Data/Object7/Object110.bmd
Data/Object7/Object111.bmd
Data/Object7/Object112.bmd
Data/Object7/Object113.bmd
Data/Object7/Object114.bmd
Data/Object7/Object115.bmd
Data/Object7/Object116.bmd
Data/Object7/Object117.bmd
Data/Object7/Object118.bmd
Data/Object7/Object119.bmd
Data/Object7/Object12.bmd
Data/Object7/Object120.bmd
Data/Object7/Object121.bmd
Data/Object7/Object122.bmd
Data/Object7/Object123.bmd
Data/Object7/Object124.bmd
Data/Object7/Object125.bmd
Data/Object7/Object126.bmd
Data/Object7/Object127.bmd
Data/Object7/Object128.bmd
Data/Object7/Object129.bmd
Data/Object7/Object13.bmd
Data/Object7/Object130.bmd
Data/Object7/Object131.bmd
Data/Object7/Object132.bmd
Data/Object7/Object133.bmd
Data/Object7/Object134.bmd
Data/Object7/Object135.bmd
Data/Object7/Object136.bmd
Data/Object7/Object137.bmd
Data/Object7/Object138.bmd
Data/Object7/Object139.bmd
Data/Object7/Object14.bmd
Data/Object7/Object140.bmd
Data/Object7/Object141.bmd
Data/Object7/Object142.bmd
Data/Object7/Object143.bmd
Data/Object7/Object144.bmd
Data/Object7/Object145.bmd
Data/Object7/Object146.bmd
Data/Object7/Object147.bmd
Data/Object7/Object148.bmd
Data/Object7/Object149.bmd
Data/Object7/Object15.bmd
Data/Object7/Object150.bmd
Data/Object7/Object151.bmd
Data/Object7/Object152.bmd
Data/Object7/Object153.bmd
Data/Object7/Object154.bmd
Data/Object7/Object155.bmd
Data/Object7/Object156.bmd
Data/Object7/Object157.bmd
Data/Object7/Object158.bmd
Data/Object7/Object159.bmd
Data/Object7/Object16.bmd
Data/Object7/Object160.bmd
Data/Object7/Object161.bmd
Data/Object7/Object162.bmd
Data/Object7/Object163.bmd
Data/Object7/Object164.bmd
Data/Object7/Object165.bmd
Data/Object7/Object166.bmd
Data/Object7/Object167.bmd
Data/Object7/Object168.bmd
Data/Object7/Object169.bmd
Data/Object7/Object17.bmd
Data/Object7/Object170.bmd
Data/Object7/Object171.bmd
Data/Object7/Object18.bmd
Data/Object7/Object19.bmd
Data/Object7/Object20.bmd
Data/Object7/Object21.bmd
Data/Object7/Object22.bmd
Data/Object7/Object23.bmd
Data/Object7/Object24.bmd
Data/Object7/Object25.bmd
Data/Object7/Object26.bmd
Data/Object7/Object27.bmd
Data/Object7/Object28.bmd
Data/Object7/Object29.bmd
Data/Object7/Object30.bmd
Data/Object7/Object31.bmd
Data/Object7/Object32.bmd
Data/Object7/Object33.bmd
Data/Object7/Object34.bmd
Data/Object7/Object35.bmd
Data/Object7/Object36.bmd
Data/Object7/Object37.bmd
Data/Object7/Object38.bmd
Data/Object7/Object39.bmd
Data/Object7/Object40.bmd
Data/Object7/Object41.bmd
Data/Object7/Object42.bmd
Data/Object7/Object43.bmd
Data/Object7/Object44.bmd
Data/Object7/Object45.bmd
Data/Object7/Object46.bmd
Data/Object7/Object47.bmd
Data/Object7/Object48.bmd
Data/Object7/Object49.bmd
Data/Object7/Object50.bmd
Data/Object7/Object51.bmd
Data/Object7/Object52.bmd
Data/Object7/Object53.bmd
Data/Object7/Object54.bmd
Data/Object7/Object55.bmd
Data/Object7/Object56.bmd
Data/Object7/Object57.bmd
Data/Object7/Object58.bmd
Data/Object7/Object59.bmd
Data/Object7/Object60.bmd
Data/Object7/Object601.bmd
Data/Object7/Object61.bmd
Data/Object7/Object62.bmd
Data/Object7/Object63.bmd
Data/Object7/Object64.bmd
Data/Object7/Object65.bmd
Data/Object7/Object66.bmd
Data/Object7/Object67.bmd
Data/Object7/Object68.bmd
Data/Object7/Object69.bmd
Data/Object7/Object70.bmd
Data/Object7/Object71.bmd
Data/Object7/Object72.bmd
Data/Object7/Object73.bmd
Data/Object7/Object74.bmd
Data/Object7/Object75.bmd
Data/Object7/Object76.bmd
Data/Object7/Object77.bmd
Data/Object7/Object78.bmd
Data/Object7/Object78/Object78.smd
Data/Object7/Object78/angeflo_R.jpg
.jpg
Data/Object7/Object79.bmd
Data/Object7/Object80.bmd
Data/Object7/Object81.bmd
Data/Object7/Object82.bmd
Data/Object7/Object83.bmd
Data/Object7/Object84.bmd
Data/Object7/Object85.bmd
Data/Object7/Object86.bmd
Data/Object7/Object87.bmd
Data/Object7/Object88.bmd
Data/Object7/Object89.bmd
Data/Object7/Object90.bmd
Data/Object7/Object91.bmd
Data/Object7/Object92.bmd
Data/Object7/Object93.bmd
Data/Object7/Object94.bmd
Data/Object7/Object95.bmd
Data/Object7/Object96.bmd
Data/Object7/Object97.bmd
Data/Object7/Object98.bmd
Data/Object7/Object99.bmd
Data/Object7/Sea3BadakShodow_R.OZJ
.jpg
Data/Object7/Sea3MagicShop.OZJ
.jpg
Data/Object7/Sea3Weaponshop01.OZJ
.jpg
Data/Object7/Sea3Weaponshop02.OZJ
.jpg
Data/Object7/Sea3Weaponshop02.OZT
Data/Object7/Sea3Weaponshop03.OZJ
.jpg
Data/Object7/Sea3Weaponshop04.OZJ
.jpg
Data/Object7/Sea3Weaponshop05.OZJ
.jpg
Data/Object7/Sea3Weaponshop06.OZJ
.jpg
Data/Object7/Sea3Weaponshop08.OZJ
.jpg
Data/Object7/Sea3Weaponshop09.OZJ
.jpg
Data/Object7/Sea3Weaponshop11.OZJ
.jpg
Data/Object7/Sea3flower01.OZT
Data/Object7/Sea3flower02.OZT
Data/Object7/Sign01.bmd
Data/Object7/Spider_R.ozj
.jpg
Data/Object7/Stoneeffec.bmd
Data/Object7/TileGround03.OZJ
.jpg
Data/Object7/Tileeffec01_R.ozj
Data/Object7/Tree_a.OZT
Data/Object7/Treeange_R.OZJ
.jpg
Data/Object7/aidaworldwallC.OZJ
.jpg
Data/Object7/aidaworldwallCunder.OZJ
.jpg
Data/Object7/angeflo_R.OZJ
.jpg
Data/Object7/apple.OZJ
.jpg
Data/Object7/arrow.OZT
Data/Object7/art.OZJ
.jpg
Data/Object7/au_01.OZJ
.jpg
Data/Object7/au_02.OZJ
.jpg
Data/Object7/au_02.OZT
Data/Object7/au_03.OZJ
.jpg
Data/Object7/au_03.OZT
Data/Object7/au_04.OZJ
.jpg
Data/Object7/au_04.OZT
Data/Object7/au_05.OZJ
.jpg
Data/Object7/au_07.OZJ
.jpg
Data/Object7/au_09.OZJ
.jpg
Data/Object7/au_10.OZJ
.jpg
Data/Object7/au_11.OZJ
.jpg
Data/Object7/au_12.OZJ
.jpg
Data/Object7/au_5.OZT
Data/Object7/au_6.OZT
Data/Object7/aurora.OZJ
.jpg
Data/Object7/badge_01.OZJ
.jpg
Data/Object7/badge_02.ozt
Data/Object7/badge_03.OZT
Data/Object7/boiboit.OZJ
.jpg
Data/Object7/books.OZJ
.jpg
Data/Object7/bookshelf.OZJ
.jpg
Data/Object7/bostar1.OZJ
.jpg
Data/Object7/bostar2_R.OZJ
.jpg
Data/Object7/bostar3_R.OZJ
.jpg
Data/Object7/bostar4_R.OZJ
.jpg
Data/Object7/bottle.ozt
Data/Object7/branch01_line.OZT
Data/Object7/bridge_01.OZJ
.jpg
Data/Object7/cage2.OZJ
Data/Object7/cage2.OZT
Data/Object7/candle.OZJ
.jpg
Data/Object7/candle2.OZJ
.jpg
Data/Object7/cardahaldoor_001.OZJ
.jpg
Data/Object7/cardahaldoor_002.OZJ
.jpg
Data/Object7/castle001.OZJ
.jpg
Data/Object7/castle002.OZJ
.jpg
Data/Object7/castle003.OZJ
.jpg
Data/Object7/castle004.OZJ
.jpg
Data/Object7/castle006.OZJ
.jpg
Data/Object7/castle007.OZJ
.jpg
Data/Object7/castle008.OZJ
.jpg
Data/Object7/castle009.OZJ
.jpg
Data/Object7/castle010.OZJ
.jpg
Data/Object7/castle012.OZJ
.jpg
Data/Object7/castle014.OZJ
.jpg
Data/Object7/chain.ozt
Data/Object7/chair.OZJ
.jpg
Data/Object7/chair2.OZT
Data/Object7/cho_gate_a.OZJ
.jpg
Data/Object7/cho_gate_a_01.OZJ
.jpg
Data/Object7/cho_gate_a_03.OZJ
.jpg
Data/Object7/cho_status01_a.OZJ
.jpg
Data/Object7/cho_wall_05.OZJ
.jpg
Data/Object7/cho_wall_05_r.OZJ
.jpg
Data/Object7/cho_wall_06.OZJ
.jpg
Data/Object7/cho_wall_07.OZJ
.jpg
Data/Object7/cho_wall_c_01.OZJ
.jpg
Data/Object7/choef02_R.OZJ
.jpg
Data/Object7/choef03_R.OZJ
.jpg
Data/Object7/choef04_R.OZJ
.jpg .ps1
Data/Object7/chofountain01.OZJ
.jpg
Data/Object7/chofountain02.OZJ
.jpg
Data/Object7/chofountain03.OZJ
.jpg
Data/Object7/chogarden_01.OZT
Data/Object7/chogarden_02.OZT
Data/Object7/chogarden_04.OZJ
Data/Object7/chogarden_04.OZT
Data/Object7/chogarden_05.OZT
Data/Object7/chogate.ozj
.jpg
Data/Object7/chogate02.ozt
Data/Object7/chogate_03.ozj
.jpg
Data/Object7/chogatea02_R.OZJ
.jpg
Data/Object7/chostatue_02.OZJ
.jpg
Data/Object7/chostone_02.OZJ
.jpg
Data/Object7/chostone_03.OZJ
.jpg
Data/Object7/chostone_04.OZJ
.jpg
Data/Object7/chostone_05.OZJ
.jpg
Data/Object7/chostone_07.OZJ
.jpg
Data/Object7/chotree_01.OZJ
.jpg
Data/Object7/chotree_02.OZJ
.jpg
Data/Object7/chowall.OZJ
Data/Object7/chowall04.OZJ
.jpg
Data/Object7/chowall04_R.OZJ
.jpg
Data/Object7/chowall05.OZJ
.jpg
Data/Object7/chowall05_R.OZJ
.jpg
Data/Object7/chowall06.OZJ
.jpg
Data/Object7/chowall06_R.OZJ
.jpg
Data/Object7/chowall07.OZJ
.jpg
Data/Object7/chowall07_R.OZJ
.jpg
Data/Object7/chowall08.OZJ
.jpg
Data/Object7/chowall09.OZJ
.jpg
Data/Object7/chowall10.OZJ
.jpg
Data/Object7/chowall_02.OZJ
.jpg
Data/Object7/chowall_Snow.OZJ
.ps1
Data/Object7/chowallc01.OZJ
.jpg
Data/Object7/chowater01_R.OZJ
.jpg
Data/Object7/col.OZJ
.jpg
Data/Object7/core11.OZJ
.jpg
Data/Object7/core21.OZJ
.jpg
Data/Object7/core3.OZJ
.jpg
Data/Object7/corerune_R.OZJ
.jpg
Data/Object7/cr1_branch01.OZT
Data/Object7/cr1_branch06.OZT
Data/Object7/cr1_roof1.OZT
Data/Object7/cr1_shadow.OZT
Data/Object7/cr1_stone04.OZJ
.jpg
Data/Object7/cr1_tree01.OZJ
.jpg
Data/Object7/cr1_tree03.OZJ
.jpg
Data/Object7/cr_leg.OZJ
.jpg
Data/Object7/cr_legtungs.OZT
Data/Object7/cr_stone07.OZJ
.jpg
Data/Object7/cr_stone11.OZJ
.jpg
Data/Object7/cr_stonewolf.OZJ
.jpg
Data/Object7/cr_stonewolf_ba.OZJ
Data/Object7/cr_stonewolf_ba01.OZJ
Data/Object7/crdoor1.OZJ
.jpg
Data/Object7/crroof.OZJ
.jpg
Data/Object7/crwall.OZJ
.jpg
Data/Object7/crystal.OZJ
.jpg
Data/Object7/crystal_R.OZJ
.jpg
Data/Object7/desk.OZJ
.jpg
Data/Object7/desk_big.OZJ
.jpg
Data/Object7/dra0195.ozj
.jpg
Data/Object7/dra0294.ozj
.jpg
Data/Object7/drum.OZJ
.jpg
Data/Object7/drwt.OZJ
.jpg
Data/Object7/drwt_R.OZJ
.jpg
Data/Object7/eventwall05.OZJ
.jpg
Data/Object7/evstwall.OZJ
.jpg
Data/Object7/evwallde021.OZJ
.jpg
Data/Object7/evwallde03.OZJ
.jpg
Data/Object7/evwallde11.OZJ
.jpg
Data/Object7/face.OZJ
.jpg
Data/Object7/face2.OZJ
.jpg
Data/Object7/feather.OZT
Data/Object7/ferli1.ozj
.jpg
Data/Object7/ferline.OZJ
.jpg
Data/Object7/finger.OZJ
.jpg
Data/Object7/finger1.OZJ
.jpg
Data/Object7/flag.OZJ
.jpg
Data/Object7/flag.OZT
Data/Object7/flag_pole.OZJ
.jpg
Data/Object7/galdae02.OZT
Data/Object7/gggd01.OZT
Data/Object7/gggi01.OZJ
.jpg
Data/Object7/gggi02.OZJ
.jpg
Data/Object7/gggi04.OZJ
.jpg
Data/Object7/gggi05.OZJ
.jpg
Data/Object7/gidoong005.OZJ
.jpg
Data/Object7/gidoong005_R.OZJ
.jpg
Data/Object7/gidoongtest.OZT
Data/Object7/glass_R.OZJ
.jpg
Data/Object7/grass_01.OZT
Data/Object7/han_fftreebody.OZJ
.jpg
Data/Object7/han_fftreeleaf.OZT
Data/Object7/han_stbody3.OZJ
.jpg
Data/Object7/han_ststone.OZJ
.jpg
Data/Object7/hand1.OZJ
.jpg
Data/Object7/hend01.OZJ
.jpg
Data/Object7/hend01_R.OZJ
.jpg
Data/Object7/hend01f.OZJ
.jpg
Data/Object7/hend02.OZJ
.jpg
Data/Object7/hend02f.OZJ
.jpg
Data/Object7/hend02w.OZJ
.jpg
Data/Object7/hend02w_R.OZJ
.jpg
Data/Object7/horse_drawn_01.OZJ
.jpg
Data/Object7/htht01.OZJ
.jpg
Data/Object7/ice_block07.OZJ
.jpg
Data/Object7/icecarp01.OZJ
.jpg
Data/Object7/icecarp0101.OZJ
.jpg
Data/Object7/icecarp0301.OZJ
.jpg
Data/Object7/icecarp302.OZJ
.jpg
Data/Object7/icescarp01.OZJ
Data/Object7/icescarp0101.OZJ
Data/Object7/icescarp0301.OZJ
Data/Object7/icescarp0301_R.OZJ
.jpg
Data/Object7/icescarp0302.OZJ
Data/Object7/itp02.OZT
Data/Object7/jar_01.OZJ
.jpg
Data/Object7/joint.OZJ
.jpg
Data/Object7/ju01.OZJ
.jpg
Data/Object7/ju01_R.OZJ
.jpg
Data/Object7/kannpc01.OZJ
.jpg
Data/Object7/kannpc02.OZT
Data/Object7/kannpc03.OZT
Data/Object7/kannpc04_R.OZJ
.jpg
Data/Object7/light.OZT
Data/Object7/light2.OZJ
.jpg
Data/Object7/light3.OZJ
.jpg
Data/Object7/light_02.OZJ
.jpg
Data/Object7/machine04_R.OZJ
.jpg
Data/Object7/marinsballred_R.ozj
Data/Object7/maya01.OZT
Data/Object7/maya02.OZJ
.jpg
Data/Object7/maya02a.OZJ
.jpg
Data/Object7/maya02b.OZJ
.jpg
Data/Object7/maya02c.OZJ
.jpg
Data/Object7/maya03.OZJ
.jpg
Data/Object7/maya04.OZJ
.jpg
Data/Object7/maya05.OZJ
.jpg
Data/Object7/merchant_moster_b01.OZJ
.jpg
Data/Object7/mhousewall.OZJ
.jpg
Data/Object7/mhousewallB.OZT
Data/Object7/mhousewallC.OZT
Data/Object7/mushroom.OZJ
.jpg
Data/Object7/mz001_R.OZJ
.jpg
Data/Object7/n2007.OZJ
.jpg
Data/Object7/notice.OZJ
.jpg
Data/Object7/ob3.OZJ
.jpg
Data/Object7/ozzy1.ozj
.jpg
Data/Object7/ozzy3.ozj
.jpg
Data/Object7/ozzy4.OZT
Data/Object7/plate.OZJ
.jpg
Data/Object7/plate2.OZJ
.jpg
Data/Object7/pot.OZJ
.jpg
Data/Object7/pot2.OZJ
.jpg
Data/Object7/pot3.ozt
Data/Object7/potal_ground.ozj
Data/Object7/potal_groundred01.ozt
Data/Object7/potal_groundred02.ozt
Data/Object7/runeword_r.OZJ
.jpg
Data/Object7/saida-1.ozt
Data/Object7/sea3gate01.OZJ
.jpg
Data/Object7/sea3gate02.OZJ
.jpg
Data/Object7/sea3gate03.OZJ
.jpg
Data/Object7/sea3gate04.OZJ
.jpg
Data/Object7/sea3gate06.OZJ
.jpg
Data/Object7/sea3gate066.OZJ
.jpg
Data/Object7/sea3gate07.OZJ
.jpg
Data/Object7/sea3gate08.OZJ
.jpg
Data/Object7/sea3gatecircle.OZJ
.jpg
Data/Object7/sea3wall01.OZJ
.jpg
Data/Object7/sea3wall02.OZJ
.jpg
Data/Object7/sea3wall03.OZJ
.jpg
Data/Object7/sea3wall04.OZJ
.jpg
Data/Object7/sea3wall06.OZJ
.jpg
Data/Object7/sea3wall07.OZJ
.jpg
Data/Object7/secret.ozj
.jpg
Data/Object7/ship01.OZJ
.jpg
Data/Object7/ship03.OZJ
.jpg
Data/Object7/ship04.OZJ
.jpg
Data/Object7/ship05.OZJ
.jpg
Data/Object7/ship05.OZT
Data/Object7/ship06.OZJ
.jpg
Data/Object7/ship06.OZT
Data/Object7/ship07.OZJ
.jpg
Data/Object7/ship07.OZT
Data/Object7/so_flag.ozt
Data/Object7/so_jghwall01.ozj
.jpg
Data/Object7/so_jghwall02.ozj
.jpg
Data/Object7/so_ktree01.OZT
Data/Object7/so_ktree02.OZJ
.jpg
Data/Object7/so_ktree03.OZT
Data/Object7/so_ktree04.OZJ
.jpg
Data/Object7/so_ktree05.OZT
Data/Object7/sokep02_R_Keky.ozj
Data/Object7/sokep03_R.OZJ
.jpg
Data/Object7/song_k202w1.OZJ
.jpg
Data/Object7/song_k3metal0103.OZJ
.jpg
Data/Object7/song_m02.OZJ
.jpg
Data/Object7/song_tree01.OZJ
.jpg
Data/Object7/song_tree02.OZJ
.jpg
Data/Object7/song_tree04.OZT
Data/Object7/song_tree05.OZT
Data/Object7/songm05_R.OZJ
.jpg
Data/Object7/songm06_R.OZJ
.jpg
Data/Object7/sos3arr.OZT
Data/Object7/sos3at03.OZJ
.jpg
Data/Object7/sos3ateff_R.OZJ
.jpg
Data/Object7/sos3atw01_R.OZJ
.jpg
Data/Object7/sos3bev01.OZJ
.jpg
Data/Object7/sos3bev02.OZJ
.jpg
Data/Object7/sos3bev03.OZJ
.jpg
Data/Object7/sos3bev_R.OZJ
.jpg
Data/Object7/sos3bevcy_R.OZJ
.jpg
Data/Object7/sos3bi.OZT
Data/Object7/sos3bi01.bmd
Data/Object7/sos3bi02.OZT
Data/Object7/sos3br.OZJ
.jpg
Data/Object7/sos3br02.OZJ
.jpg
Data/Object7/sos3cr01.OZJ
.jpg
Data/Object7/sos3cr02.OZJ
.jpg
Data/Object7/sos3crr02.OZJ
.jpg .ps1
Data/Object7/sos3fol.OZT
Data/Object7/sos3mo01.OZJ
.jpg
Data/Object7/sos3mo03.OZJ
.jpg .ps1
Data/Object7/sos3mo04.OZJ
.jpg
Data/Object7/sos3mo05.OZJ
.jpg
Data/Object7/sos3ssa01.OZJ
.jpg
Data/Object7/standwall01.OZJ
.jpg
Data/Object7/standwall02.OZJ
.jpg
Data/Object7/standwall03.OZJ
.jpg
Data/Object7/standwall04.OZJ
.jpg
Data/Object7/statue.OZJ
.jpg
Data/Object7/statue2.OZJ
.jpg
Data/Object7/statueDDown82.ozj
.jpg
Data/Object7/statueDSW052.ozj
.jpg
Data/Object7/statueDeye_R.ozj
.jpg
Data/Object7/statueDup72.ozj
.jpg
Data/Object7/steel_barred_a.OZT
Data/Object7/steel_barred_b.OZJ
.jpg
Data/Object7/ston01.OZJ
.jpg
Data/Object7/ston02.OZJ
.jpg
Data/Object7/stonD.ozj
.jpg
Data/Object7/stone_statue02.OZJ
.jpg
Data/Object7/stonewall022.OZJ
.jpg
Data/Object7/suhobody00_R.OZJ
.jpg
Data/Object7/suhobody01.OZJ
.jpg
Data/Object7/suhobody02.OZJ
.jpg
Data/Object7/suhobody03.OZJ
.jpg
Data/Object7/sungmulbadak_R.OZJ
.jpg
Data/Object7/sungmulline_R.OZJ
.jpg
Data/Object7/sungmultile.OZT
Data/Object7/sungmultile_R.OZJ
.jpg
Data/Object7/sunlight_R.OZJ
.jpg
Data/Object7/t_04.OZT
Data/Object7/test12_H.OZJ
.jpg
Data/Object7/test3.OZJ
.jpg
Data/Object7/test4.OZJ
.jpg
Data/Object7/teste.ozt
Data/Object7/testtt_R.OZJ
.jpg
Data/Object7/ti02.OZJ
.jpg
Data/Object7/ti03.OZJ
.jpg
Data/Object7/ti04.OZJ
.jpg
Data/Object7/tile_01.OZJ
.jpg
Data/Object7/tile_02.OZJ
.jpg
Data/Object7/tile_03.OZJ
.jpg
Data/Object7/tile_ston04.OZJ
.jpg
Data/Object7/tile_ston05.OZJ
.jpg
Data/Object7/tile_ston06.OZJ
.jpg
Data/Object7/tile_ston07.OZT
Data/Object7/tile_wood01.OZJ
.jpg
Data/Object7/tile_wood02.OZJ
.jpg
Data/Object7/tile_wood03.OZJ
.jpg
Data/Object7/totem0451.OZJ
.jpg
Data/Object7/totem222.OZJ
.jpg
Data/Object7/totem_03.OZJ
.jpg
Data/Object7/totemeye.OZJ
.jpg
Data/Object7/treasure_chest.OZJ
.jpg
Data/Object7/tree.OZJ
.jpg
Data/Object7/tree_01.OZJ
.jpg
Data/Object7/tree_01.OZT
Data/Object7/tree_02.OZT
Data/Object7/tree_03.OZJ
.jpg
Data/Object7/tree_04.OZJ
.jpg
Data/Object7/tree_04.OZT
Data/Object7/tree_06.OZT
Data/Object7/tree_08.OZT
Data/Object7/tree_09.OZT
Data/Object7/tree_a1.OZT
Data/Object7/tree_b.OZJ
.jpg
Data/Object7/typhoonall.bmd
Data/Object7/u2u3.OZJ
.jpg
Data/Object7/urbanwall3.OZJ
.jpg
Data/Object7/urbanwall4.OZJ
.jpg
Data/Object7/urbanwater_R.OZJ
.jpg
Data/Object7/wall_01.OZJ
.jpg
Data/Object7/walleffe_R.OZJ
.jpg
Data/Object7/water.OZJ
.jpg
Data/Object7/waterfall_r.OZJ
.jpg
Data/Object7/wind_R.OZJ
.jpg
Data/Object7/winecup.OZJ
.jpg
Data/Object7/woodc01.OZJ
.jpg
Data/Object7/wwo.ozj
.jpg
Data/Object7/xiu.ozp
Data/Object7/xiu.ozt
Data/Object7/yellow_jewel.OZJ
.jpg
Data/Player/Player.bmd
Data/Skill/skill.bmd
Data/World1/(Server)Terrion1.att
Data/World1/Copia de encterrain1.obj
Data/World1/EncTerrain1.128KB.att
Data/World1/EncTerrain1.att
Data/World1/EncTerrain1.att1
Data/World1/EncTerrain1.map
Data/World1/EncTerrain1.obj
Data/World1/EncTerrain1_SERVER.att
Data/World1/EncTerrain7.att
Data/World1/EncTerrainTest1.att
Data/World1/EncTerrainTest12.att
Data/World1/Thumbs.db
Data/World1/encterrain.att
Data/World7/(Server)Terrain7.att
Data/World7/AlphaTile01.OZT
Data/World7/AlphaTileGround01.OZT
Data/World7/AlphaTileGround03.OZT
Data/World7/EncTerrain7.128KB.att
Data/World7/EncTerrain7.64KB.att
Data/World7/EncTerrain7.att
Data/World7/EncTerrain7.map
Data/World7/EncTerrain7.obj
Data/World7/Map.OZJ
.jpg
Data/World7/Object150.bmd
Data/World7/Terrain.map
Data/World7/Terrain.obj
Data/World7/Terrain7.att
Data/World7/TerrainHeight.OZB
Data/World7/TerrainLight.OZJ
Data/World7/TerrainLight.bmp
Data/World7/TerrainLight.jpg
.jpg
Data/World7/TerrainLight.ozb
Data/World7/TileGrass01.OZJ
.jpg
Data/World7/TileGrass01.OZT
.ps1
Data/World7/TileGrass01.jpg
.jpg
Data/World7/TileGrass01.tga
.ps1
Data/World7/TileGrass02.OZJ
.jpg
Data/World7/TileGrass02.OZT
.ps1
Data/World7/TileGround01.OZJ
.jpg
Data/World7/TileGround02.OZJ
.jpg
Data/World7/TileGround03.OZJ
.jpg
Data/World7/TileGround08.OZJ
.jpg
Data/World7/TileRock01.OZJ
.jpg
Data/World7/TileRock02.OZJ
.jpg
Data/World7/TileRock03.OZJ
.jpg
Data/World7/TileRock04.OZJ
.jpg
Data/World7/TileRock05.OZJ
.jpg
Data/World7/TileRock06.OZJ
.jpg
Data/World7/TileRock07.OZJ
.jpg
Data/World7/TileRock07.OZT
Data/World7/TileWater01.OZJ
.jpg
Data/World7/TileWood01.OZJ
.jpg
Data/World7/leaf01.OZJ
.jpg
Data/World7/leaf01.OZT
Data/World7/leaf01.tga
Data/World7/leaf02.OZJ
.jpg
Data/World7/logochaoZanclair.ozt
Data/World7/map1.OZJ
.jpg
Data/World7/rain01.OZT
Data/World7/rain02.OZT
Data/World7/rain03.OZT
Main.dll
.dll windows:5 windows x86

b9659bde98879a463944190ca3fec8bf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

CreateFileA
ReadFile
CloseHandle
GetFileSize
OpenMutexA
CreateMutexA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
VirtualProtect
GetSystemDirectoryA
GetVolumeInformationA
ExitProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
DecodePointer
EncodePointer
IsProcessorFeaturePresent
CreateThread
GetCurrentThreadId
SetThreadPriority
GetCurrentProcess
SetProcessWorkingSetSize
GetPrivateProfileStringA
GetPrivateProfileIntA
GetTickCount
GetSystemInfo
Sleep

user32

CallWindowProcA
SetWindowPos
AdjustWindowRect
SetWindowLongA
SetWindowsHookExA
GetSystemMetrics
MessageBoxA
GetAsyncKeyState
CallNextHookEx
GetForegroundWindow
SetWindowTextA
wsprintfA
ShowWindow
LoadImageA
MoveWindow
EnumDisplaySettingsA
ChangeDisplaySettingsA
IsWindowVisible

gdi32

SelectObject
GetTextExtentPointA
CreateFontA

advapi32

RegQueryValueExA
RegSetValueExA
RegOpenKeyExA
RegCloseKey

shell32

Shell_NotifyIconA

msvcp100

?_Xlength_error@std@@YAXPBD@Z

ws2_32

ntohs
getpeername

opengl32

glColor3f
glDisable
glShadeModel
glClearColor
glFogfv
glFogf
glHint
glTexParameterf
glEnable
glColor4f
glFogi

msvcr100

_CIcos
__CxxFrameHandler3
_CxxThrowException
_CIsqrt
memcpy
floor
_CIlog
_CIsin
??2@YAPAXI@Z
memset
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_crt_debugger_hook
__CppXcptFilter
?terminate@@YAXXZ
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
??3@YAXPAX@Z
fopen_s
malloc
fclose
fread
free
strncpy_s
_stricmp
strcpy_s
??_V@YAXPAX@Z
vsprintf_s
_localtime64_s
_tzset
strftime
_unlock
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z

Exports

Exports

EntryProc

Sections

.text
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 135KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ServerInfo.sse
SoftwareRG.dll
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

SoftwareRG

Sections

UPX0
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.dll windows:5 windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xor.dll
.dll windows:5 windows x86

7de6b68c59408165e9d822c4a1a49a7a

Code Sign

01
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/01/2004, 00:00

Not After

31/12/2028, 23:59

Subject

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:0e:a2:4a:c8:fa:21:3d:df:e4:83:a2:d1:97:23:de
Certificate

Issuer

CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

Not Before

13/03/2023, 00:00

Not After

12/03/2024, 23:59

Subject

CN=Roger Alexander Gonzalez Castillo,O=Roger Alexander Gonzalez Castillo,ST=Portuguesa,C=VE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

cb:7b:96:ed:69:d1:f3:87:7d:83:4a:c0:9e:ea:d7:d2:43:a4:21:98
Signer

Actual PE Digest

cb:7b:96:ed:69:d1:f3:87:7d:83:4a:c0:9e:ea:d7:d2:43:a4:21:98

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetThreadPriority
GetCurrentProcessId
QueryPerformanceFrequency
QueryPerformanceCounter
WaitForMultipleObjects
WinExec
CreateProcessA
CreateMutexA
ReadProcessMemory
GetExitCodeThread
GetCurrentThreadId
TerminateProcess
HeapFree
GetProcessHeap
HeapAlloc
SetProcessWorkingSetSize
GetFullPathNameA
VirtualProtect
SetUnhandledExceptionFilter
GetSystemInfo
VirtualQueryEx
CreatePipe
InterlockedCompareExchange
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
InterlockedExchange
DecodePointer
EncodePointer
HeapSize
HeapReAlloc
HeapDestroy
Thread32Next
GetCurrentProcess
ResumeThread
OpenThread
Thread32First
DeviceIoControl
GetLocalTime
GetTickCount
Process32Next
Process32First
CreateToolhelp32Snapshot
GetFileSize
ExitProcess
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
LoadLibraryA
GetProcAddress
TerminateThread
OpenProcess
SetFileAttributesA
GetWindowsDirectoryA
CreateThread
ReadFile
CloseHandle
CreateFileA
GetFileAttributesExA
Sleep

user32

GetWindowThreadProcessId
SendMessageA
EnumWindows
FindWindowExA
SetTimer
GetWindowTextA
GetClassNameA
GetWindowTextW
GetWindowTextLengthW
BlockInput
EndPaint
DestroyWindow
RegisterClassExA
DrawTextA
GetClientRect
BeginPaint
SetWindowLongA
UnregisterClassA
GetWindowLongA
CreateWindowExA
DefWindowProcA
SetLayeredWindowAttributes
ShowWindow
LoadImageA
wsprintfA
MessageBoxA
GetForegroundWindow
SetWindowsHookExA
GetMessageA
TranslateMessage
DispatchMessageA
UnhookWindowsHookEx
CallNextHookEx
GetSystemMetrics
ReleaseDC
GetDC
GetMonitorInfoA
EnumDisplayMonitors
GetTopWindow
IsWindowVisible
GetWindow
LoadCursorA
UpdateWindow

gdi32

ExtTextOutA
GetStockObject
GetObjectA
SetBkMode
TextOutA
StretchBlt
CreateFontA
SetTextColor
BitBlt
DeleteDC
GetDIBits
DeleteObject
SelectObject
CreateCompatibleDC
SetBkColor
CreateCompatibleBitmap

advapi32

GetTokenInformation
OpenProcessToken
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
RegSetValueExA
RegOpenKeyExA

msvcp100

?_Xinvalid_argument@std@@YAXPBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
_Stolx
?ws@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1facet@locale@std@@UAE@XZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??0facet@locale@std@@IAE@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Xbad@tr1@std@@YAXW4error_type@regex_constants@12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@XZ
_Strxfrm
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z
?tolower@?$ctype@D@std@@QBEDD@Z
?_Xmem@tr1@std@@YAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
_Stoulx
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_BADOFF@std@@3_JB
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?id@?$codecvt@DDH@std@@2V0locale@2@A
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QBE?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AAVios_base@2@DPBUtm@@PBD3@Z

gdiplus

GdipGetImageEncodersSize
GdiplusStartup
GdiplusShutdown
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSaveImageToFile

ws2_32

socket
htons
WSAStartup
connect
recv
send
WSACloseEvent
WSACleanup
inet_addr
closesocket

psapi

GetDeviceDriverFileNameA
EnumProcessModules
GetModuleFileNameExA
EnumDeviceDrivers
EnumProcesses
GetModuleFileNameExW

msvcr100

?what@exception@std@@UBEPBDXZ
_mkdir
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
_amsg_exit
_initterm_e
_initterm
_encoded_null
_malloc_crt
_onexit
_lock
__dllonexit
_unlock
__CxxFrameHandler3
memset
memcpy
ldiv
_strdup
_vsnprintf_s
realloc
printf
strncpy
strrchr
strchr
_stricmp
asctime
_localtime64
_time64
_purecall
toupper
strcpy_s
remove
vsprintf_s
_vscprintf
strstr
free
malloc
fopen_s
fread
isalnum
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
fclose
memchr
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
memcpy_s
fgetc
ungetc
fwrite
fputc
_unlock_file
_lock_file
sprintf
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
??1exception@std@@UAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
memmove
??_V@YAXPAX@Z
??3@YAXPAX@Z

iphlpapi

GetAdaptersInfo

wininet

InternetOpenA
FtpGetFileA
InternetConnectA
FtpCreateDirectoryA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
FtpPutFileA

Exports

Exports

DETECT_ALL_BYPASS
EntryProc

Sections

.text
Size: 192KB - Virtual size: 192KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.,Ah
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Xor_Plus/Settings/Special.xml
Xor_Plus/Settings/tga.bmd
.dll windows:5 windows x86

0f89a47f0224c020c24a48970c19d976

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetCurrentProcessId
GetProcessId
CreateFileMappingA
MapViewOfFile
GetProcAddress
GetModuleHandleA
GetCurrentThread
CloseHandle
GetLastError
InterlockedCompareExchange
GetCurrentProcess
GetCurrentThreadId
SuspendThread
ResumeThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
SetLastError
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapAlloc
RaiseException
IsProcessorFeaturePresent
RtlUnwind
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
LoadLibraryW
WriteFile
GetModuleFileNameW
HeapSize
LCMapStringW
MultiByteToWideChar
GetStringTypeW

Exports

Exports

GameGuardVerity

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Xor_Plus/Settings/tga.ozn
Xor_Plus/Splash/Progress-Bar.bmp
Xor_Plus/Splash/Xor-Ban.bmp
Xor_Plus/Splash/Xor-Welc.bmp
Xor_Plus/Splash/Xor-hack.bmp
main.exe
.exe windows:5 windows x86

92a3cac6f97e636dfdd4b4aac2e6a694

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

imm32

ImmGetCompositionStringA
ImmGetCompositionWindow
ImmSetCompositionWindow
ImmGetDefaultIMEWnd
ImmSetConversionStatus
ImmGetContext
ImmGetDescriptionA
ImmGetIMEFileNameA
ImmGetConversionStatus
ImmReleaseContext

dsound

ord1
ord2

opengl32

glColor3f
glEnd
glVertex3fv
glTexCoord2f
glBegin
glColor3fv
glGetIntegerv
glGetString
glAlphaFunc
glFogf
glFogfv
glEnable
glDisable
glClearColor
glTexImage2D
glBindTexture
glVertex3f
glDepthMask
glPolygonMode
glFrontFace
glStencilFunc
glColorMask
glVertex2f
glDepthFunc
glStencilOp
glTexEnvf
glPixelStorei
glTexParameteri
glDeleteTextures
glIsTexture
glColor4ub
glLoadIdentity
glMatrixMode
glPopMatrix
glClear
glTranslatef
glRotatef
glPushMatrix
wglDeleteContext
wglMakeCurrent
wglCreateContext
glScalef
glGenTextures
glTexEnvi
glReadPixels
glGetFloatv
glBlendFunc
glViewport
glFogi
glFlush
glColor4f

glu32

gluOrtho2D
gluPerspective

winmm

mmioAscend
mmioOpenA
mmioClose
timeGetTime
mmioDescend
mmioRead
timeGetDevCaps
timeBeginPeriod
mmioWrite
timeEndPeriod

kernel32

TerminateThread
CreateThread
OpenMutexA
EnterCriticalSection
LeaveCriticalSection
lstrcatA
OpenEventA
WaitForSingleObject
ReleaseMutex
GetComputerNameA
lstrcmpA
ExitProcess
VirtualAlloc
VirtualFree
VirtualProtect
LoadLibraryExA
GetTempFileNameA
GetTempPathA
HeapFree
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
GetCurrentThreadId
GetTickCount
Sleep
lstrlenA
CloseHandle
WriteFile
SetFilePointer
CreateFileA
DeleteFileA
ReadFile
GetLocalTime
GetSystemDirectoryA
lstrcmpiA
GetVersionExA
QueryPerformanceCounter
SetProcessAffinityMask
SetThreadPriority
SetPriorityClass
GetProcessAffinityMask
GetThreadPriority
GetPriorityClass
GetCurrentThread
GetCurrentProcess
QueryPerformanceFrequency
OutputDebugStringA
FlushFileBuffers
GetProcAddress
LoadLibraryA
GlobalMemoryStatus
GlobalUnlock
GlobalLock
GetCommandLineA
GetFileSize
GetLastError
GetPrivateProfileStringA
GetCurrentDirectoryA
CopyFileA
SetFileAttributesA
Process32Next
TerminateProcess
OpenProcess
Process32First
CreateToolhelp32Snapshot
WinExec
FindFirstFileA
FindClose
CreateMutexA
GetModuleFileNameA
GetFileAttributesA
MoveFileA
IsBadReadPtr
CreateEventA
CreateProcessA
WaitForMultipleObjects
GetExitCodeProcess
GetModuleHandleA
ResetEvent
ResumeThread
SetEndOfFile
DeleteCriticalSection
InitializeCriticalSection
SetEvent
WideCharToMultiByte
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
FindNextFileA
RemoveDirectoryA
CreateDirectoryA
GetThreadContext
lstrcpynA
GetCurrentProcessId
Module32First
Module32Next
SetUnhandledExceptionFilter
IsValidLocale
IsValidCodePage
GetLocaleInfoA
EnumSystemLocalesA
GetUserDefaultLCID
SetHandleCount
GetFileType
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
LCMapStringW
GetEnvironmentStringsW
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetConsoleCtrlHandler
GetLocaleInfoW
DuplicateHandle
SetStdHandle
CreatePipe
GetStdHandle
PeekNamedPipe
lstrcpyA
InterlockedExchange
RtlUnwind
InterlockedDecrement
InterlockedIncrement
GetTimeZoneInformation
GetSystemTime
GetStartupInfoA
GetVersion
GetSystemTimeAsFileTime
RaiseException
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
HeapReAlloc
HeapSize
GetCPInfo
GetACP
GetOEMCP
FatalAppExitA
MultiByteToWideChar
LCMapStringA
FreeLibrary
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA

user32

GetFocus
UnregisterHotKey
RegisterHotKey
GetAsyncKeyState
GetKeyboardLayout
GetKeyboardLayoutNameA
GetClipboardData
SendMessageA
wsprintfA
GetWindowRect
SetWindowPos
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetDesktopWindow
MessageBoxA
OpenClipboard
CallWindowProcA
GetWindowLongA
GetCaretPos
GetWindowTextA
SetWindowTextA
ShowWindow
ReleaseDC
GetDC
SetWindowLongA
PostMessageA
SetFocus
IsWindowVisible
GetScrollPos
SetScrollPos
SetTimer
ShowCursor
ChangeDisplaySettingsA
SystemParametersInfoA
ReleaseCapture
SetCapture
DefWindowProcA
PostQuitMessage
EndPaint
BeginPaint
DestroyWindow
RegisterClassA
LoadCursorA
LoadIconA
SetForegroundWindow
GetSystemMetrics
AdjustWindowRect
IsIconic
DispatchMessageA
TranslateMessage
CreateWindowExA
CloseClipboard
GetMessageA
PeekMessageA
UpdateWindow
EnumDisplaySettingsA
SetCursorPos
SetRect
OffsetRect
PtInRect
GetDoubleClickTime
ScreenToClient
GetCursorPos
GetActiveWindow
IntersectRect
wvsprintfA
FindWindowA

gdi32

ChoosePixelFormat
CreateFontA
SetBkMode
SwapBuffers
SelectObject
SetPixelFormat
TextOutA
SetTextColor
DeleteObject
DeleteDC
CreateDIBSection
CreateCompatibleDC
SetBkColor
GetTextExtentPoint32A
GetStockObject
GetTextExtentPointA
BitBlt

advapi32

CryptReleaseContext
RegDeleteKeyA
CryptGetHashParam
CryptDeriveKey
CryptDecrypt
CryptImportKey
CryptCreateHash
CryptHashData
CryptVerifySignatureA
CryptDestroyHash
CryptDestroyKey
InitializeSecurityDescriptor
GetUserNameA
RegDeleteValueA
RegEnumValueA
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
SetSecurityDescriptorDacl
RegCloseKey
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

shell32

ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

ws2_32

gethostbyname
WSAAsyncSelect
setsockopt
socket
shutdown
recv
WSASend
WSAStartup
WSACleanup
send
WSAGetLastError
inet_addr
htons
connect
closesocket

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wzaudio

wzAudioStop
wzAudioPlay
wzAudioGetStreamOffsetRange
wzAudioDestroy
wzAudioOption
wzAudioCreate

Sections

.text
Size: - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 119.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 607KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

b9659bde98879a463944190ca3fec8bf

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcp100

ws2_32

opengl32

msvcr100

Exports

Exports

Sections

.text Size: 69KB - Virtual size: 68KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 1.1MB - Virtual size: 1.7MB

.rsrc Size: 135KB - Virtual size: 135KB

.reloc Size: 11KB - Virtual size: 10KB

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

UPX0 Size: - Virtual size: 40KB

UPX1 Size: 14KB - Virtual size: 16KB

.rsrc Size: 1024B - Virtual size: 4KB

Headers

DLL Characteristics

File Characteristics

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 3KB - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 436B

.reloc Size: 2KB - Virtual size: 1KB

7de6b68c59408165e9d822c4a1a49a7a

Code Sign

01Certificate

Key Usages

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0aCertificate

Extended Key Usages

Key Usages

62:0e:a2:4a:c8:fa:21:3d:df:e4:83:a2:d1:97:23:deCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

cb:7b:96:ed:69:d1:f3:87:7d:83:4a:c0:9e:ea:d7:d2:43:a4:21:98Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

msvcp100

gdiplus

ws2_32

psapi

msvcr100

iphlpapi

.text
Size: 69KB - Virtual size: 68KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 1.1MB - Virtual size: 1.7MB

.rsrc
Size: 135KB - Virtual size: 135KB

.reloc
Size: 11KB - Virtual size: 10KB

UPX0
Size: - Virtual size: 40KB

UPX1
Size: 14KB - Virtual size: 16KB

.rsrc
Size: 1024B - Virtual size: 4KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 2KB - Virtual size: 1KB

01
Certificate

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Certificate

62:0e:a2:4a:c8:fa:21:3d:df:e4:83:a2:d1:97:23:de
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

cb:7b:96:ed:69:d1:f3:87:7d:83:4a:c0:9e:ea:d7:d2:43:a4:21:98
Signer

.text
Size: 192KB - Virtual size: 192KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 1.1MB - Virtual size: 1.1MB

.,Ah
Size: 2.4MB - Virtual size: 2.4MB

.reloc
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB

.text
Size: - Virtual size: 2.9MB

.rdata
Size: - Virtual size: 58KB

.data
Size: - Virtual size: 119.0MB

.vmp0
Size: - Virtual size: 607KB

.vmp1
Size: 1.5MB - Virtual size: 1.5MB

.reloc
Size: 4KB - Virtual size: 260B

.rsrc
Size: 12KB - Virtual size: 8KB