847d85849ca77c659001ac4af30fd552[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

847d85849ca77c659001ac4af30fd552.bin
Size

29.7MB
MD5

847d85849ca77c659001ac4af30fd552
SHA1

a78126fd8b1e7174507ff68edd8dff7314140c2f
SHA256

5700d7284490742b0e2c609afc6d18ea09540a0e41c2ed30800a44bd70822d62
SHA512

6321a36a53887fcace4d744970c5771a0c56b6489ba4da595e7d6e3f8b913a3ef119f90352db66ac5116a695e19bd0b4800e7e77131b5a749d40922678f281f3
SSDEEP

786432:5Lz4++HJe5X90Mpq0TEFBw/VKg6SJ5g4xZv3Qn4VZ7Mt1u:5Lk+G8X9HJgIdKg665g4xmS7Mtw

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/GameAssembly.dll
unpack001/RAM.exe
unpack001/RAM_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
unpack001/RAM_Data/Plugins/x86_64/lib_burst_generated.dll

Files

847d85849ca77c659001ac4af30fd552.bin
.zip

Password: infected
GameAssembly.dll
.dll windows:6 windows x64

Password: infected

23b3b3aa9fdf356bc269e3f4f57831f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
GetCurrentProcessId
SwitchToThread
GetSystemInfo
VirtualAlloc
VirtualQuery
CreateFileMappingW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
RtlCaptureStackBackTrace
CreateFileW
DuplicateHandle
RaiseException
SetLastError
CreateThread
GetCurrentThread
GetCurrentThreadId
SetThreadPriority
GlobalAlloc
GlobalFree
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetStdHandle
DeleteFileW
DeleteVolumeMountPointW
FlushFileBuffers
GetFileAttributesExW
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLogicalDrives
ReadFile
SetEndOfFile
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
WriteFile
SetThreadErrorMode
GetOverlappedResult
GetNativeSystemInfo
FormatMessageW
CopyFileExW
MoveFileExW
ReplaceFileW
GetTimeZoneInformation
GetDynamicTimeZoneInformation
GetConsoleMode
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
QueryPerformanceCounter
QueryPerformanceFrequency
InitializeConditionVariable
IsDebuggerPresent
SleepConditionVariableCS
GetSystemTimes
GetSystemTimeAsFileTime
GetVersionExW
GetComputerNameW
GetLongPathNameW
GetTempPathW
GetModuleFileNameA
GetModuleFileNameW
WideCharToMultiByte
GetACP
GetLocaleInfoW
GetThreadLocale
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetFilePointer
SuspendThread
ResumeThread
GetThreadContext
VirtualFree
WriteConsoleW
SetStdHandle
GetProcessHeap
GetCommandLineW
GetCommandLineA
ReadConsoleW
GetConsoleOutputCP
RemoveDirectoryW
FindNextFileW
FindFirstFileExW
FindClose
CreateDirectoryW
GetOEMCP
IsValidCodePage
HeapQueryInformation
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
RtlUnwind
LCMapStringW
CompareStringW
HeapReAlloc
HeapAlloc
HeapFree
GetModuleHandleExW
ExitProcess
LoadLibraryExW
FreeLibrary
InterlockedFlushSList
RtlUnwindEx
TerminateProcess
IsProcessorFeaturePresent
GetCurrentDirectoryW
GetLastError
TlsFree
TlsSetValue
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
CreateEventW
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetStringTypeW
LCMapStringEx
MultiByteToWideChar
DecodePointer
EncodePointer
InitializeCriticalSectionEx
RtlPcToFileHeader
TlsGetValue
WakeAllConditionVariable
TlsAlloc

user32

MessageBoxA

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
GetUserNameW

ole32

CoUninitialize
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoGetApartmentType
CoInitializeEx
CoTaskMemAlloc

oleaut32

SysStringLen
SysFreeString
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayGetDim
SafeArrayDestroy
SafeArrayCreate

shell32

SHGetKnownFolderPath
SHGetFolderPathW

ws2_32

inet_ntop
inet_pton
getnameinfo
freeaddrinfo
getaddrinfo
WSAPoll
WSASend
WSARecv
socket
shutdown
setsockopt
WSAStartup
gethostname
recvfrom
ntohs
ntohl
listen
inet_ntoa
inet_addr
htons
htonl
getsockopt
getsockname
getpeername
ioctlsocket
connect
closesocket
bind
accept
__WSAFDIsSet
WSACleanup
select
send
gethostbyaddr
WSAIoctl
WSAGetLastError

iphlpapi

GetIfEntry
GetAdaptersAddresses
GetNetworkParams

dbghelp

SymInitialize
SymFromAddr

baselib

?Baselib_DynamicLibrary_FromNativeHandle@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@_KIPEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_Close@il2cpp_baselib@@YAXUBaselib_DynamicLibrary_Handle@1@@Z
?Baselib_DynamicLibrary_GetFunction@il2cpp_baselib@@YAPEAXUBaselib_DynamicLibrary_Handle@1@PEBDPEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_OpenUtf16@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@PEBGPEAUBaselib_ErrorState@1@@Z
?Baselib_ErrorState_Explain@il2cpp_baselib@@YAIPEBUBaselib_ErrorState@1@QEADIW4Baselib_ErrorState_ExplainVerbosity@1@@Z
?Baselib_Thread_YieldExecution@il2cpp_baselib@@YAXXZ
?Baselib_SystemSemaphore_TryTimedAcquire@il2cpp_baselib@@YA_NUBaselib_SystemSemaphore_Handle@1@I@Z
?Baselib_SystemSemaphore_TryAcquire@il2cpp_baselib@@YA_NUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_Thread_GetCurrentThreadId@il2cpp_baselib@@YA_JXZ
?Baselib_SystemSemaphore_FreeInplace@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_CreateInplace@il2cpp_baselib@@YA?AUBaselib_SystemSemaphore_Handle@1@PEAX@Z
?Baselib_SystemSemaphore_Acquire@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_Release@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@I@Z

Exports

Exports

CloseNLSocket
CloseZStream
CreateNLSocket
CreateZStream
DllCanUnloadNow
DllGetActivationFactory
Flush
ReadEvents
ReadZStream
WriteZStream
il2cpp_add_internal_call
il2cpp_alloc
il2cpp_allocation_granularity
il2cpp_array_class_get
il2cpp_array_element_size
il2cpp_array_get_byte_length
il2cpp_array_length
il2cpp_array_new
il2cpp_array_new_full
il2cpp_array_new_specific
il2cpp_array_object_header_size
il2cpp_assembly_get_image
il2cpp_bounded_array_class_get
il2cpp_capture_memory_snapshot
il2cpp_class_array_element_size
il2cpp_class_enum_basetype
il2cpp_class_for_each
il2cpp_class_from_il2cpp_type
il2cpp_class_from_name
il2cpp_class_from_system_type
il2cpp_class_from_type
il2cpp_class_get_assemblyname
il2cpp_class_get_bitmap
il2cpp_class_get_bitmap_size
il2cpp_class_get_data_size
il2cpp_class_get_declaring_type
il2cpp_class_get_element_class
il2cpp_class_get_events
il2cpp_class_get_field_from_name
il2cpp_class_get_fields
il2cpp_class_get_flags
il2cpp_class_get_image
il2cpp_class_get_interfaces
il2cpp_class_get_method_from_name
il2cpp_class_get_methods
il2cpp_class_get_name
il2cpp_class_get_namespace
il2cpp_class_get_nested_types
il2cpp_class_get_parent
il2cpp_class_get_properties
il2cpp_class_get_property_from_name
il2cpp_class_get_rank
il2cpp_class_get_static_field_data
il2cpp_class_get_type
il2cpp_class_get_type_token
il2cpp_class_get_userdata_offset
il2cpp_class_has_attribute
il2cpp_class_has_parent
il2cpp_class_has_references
il2cpp_class_instance_size
il2cpp_class_is_abstract
il2cpp_class_is_assignable_from
il2cpp_class_is_blittable
il2cpp_class_is_enum
il2cpp_class_is_generic
il2cpp_class_is_inflated
il2cpp_class_is_interface
il2cpp_class_is_subclass_of
il2cpp_class_is_valuetype
il2cpp_class_num_fields
il2cpp_class_set_userdata
il2cpp_class_value_size
il2cpp_current_thread_get_frame_at
il2cpp_current_thread_get_stack_depth
il2cpp_current_thread_get_top_frame
il2cpp_current_thread_walk_frame_stack
il2cpp_custom_attrs_construct
il2cpp_custom_attrs_free
il2cpp_custom_attrs_from_class
il2cpp_custom_attrs_from_field
il2cpp_custom_attrs_from_method
il2cpp_custom_attrs_get_attr
il2cpp_custom_attrs_has_attr
il2cpp_debug_get_method_info
il2cpp_debugger_set_agent_options
il2cpp_domain_assembly_open
il2cpp_domain_get
il2cpp_domain_get_assemblies
il2cpp_exception_from_name_msg
il2cpp_field_get_flags
il2cpp_field_get_from_reflection
il2cpp_field_get_name
il2cpp_field_get_object
il2cpp_field_get_offset
il2cpp_field_get_parent
il2cpp_field_get_type
il2cpp_field_get_value
il2cpp_field_get_value_object
il2cpp_field_has_attribute
il2cpp_field_is_literal
il2cpp_field_set_value
il2cpp_field_set_value_object
il2cpp_field_static_get_value
il2cpp_field_static_set_value
il2cpp_format_exception
il2cpp_format_stack_trace
il2cpp_free
il2cpp_free_captured_memory_snapshot
il2cpp_gc_alloc_fixed
il2cpp_gc_collect
il2cpp_gc_collect_a_little
il2cpp_gc_disable
il2cpp_gc_enable
il2cpp_gc_foreach_heap
il2cpp_gc_free_fixed
il2cpp_gc_get_heap_size
il2cpp_gc_get_max_time_slice_ns
il2cpp_gc_get_used_size
il2cpp_gc_has_strict_wbarriers
il2cpp_gc_is_disabled
il2cpp_gc_is_incremental
il2cpp_gc_set_external_allocation_tracker
il2cpp_gc_set_external_wbarrier_tracker
il2cpp_gc_set_max_time_slice_ns
il2cpp_gc_set_mode
il2cpp_gc_start_incremental_collection
il2cpp_gc_wbarrier_set_field
il2cpp_gchandle_foreach_get_target
il2cpp_gchandle_free
il2cpp_gchandle_get_target
il2cpp_gchandle_new
il2cpp_gchandle_new_weakref
il2cpp_get_corlib
il2cpp_get_exception_argument_null
il2cpp_image_get_assembly
il2cpp_image_get_class
il2cpp_image_get_class_count
il2cpp_image_get_entry_point
il2cpp_image_get_filename
il2cpp_image_get_name
il2cpp_init
il2cpp_init_utf16
il2cpp_is_debugger_attached
il2cpp_is_vm_thread
il2cpp_method_get_class
il2cpp_method_get_declaring_type
il2cpp_method_get_flags
il2cpp_method_get_from_reflection
il2cpp_method_get_name
il2cpp_method_get_object
il2cpp_method_get_param
il2cpp_method_get_param_count
il2cpp_method_get_param_name
il2cpp_method_get_return_type
il2cpp_method_get_token
il2cpp_method_has_attribute
il2cpp_method_is_generic
il2cpp_method_is_inflated
il2cpp_method_is_instance
il2cpp_monitor_enter
il2cpp_monitor_exit
il2cpp_monitor_pulse
il2cpp_monitor_pulse_all
il2cpp_monitor_try_enter
il2cpp_monitor_try_wait
il2cpp_monitor_wait
il2cpp_native_stack_trace
il2cpp_object_get_class
il2cpp_object_get_size
il2cpp_object_get_virtual_method
il2cpp_object_header_size
il2cpp_object_new
il2cpp_object_unbox
il2cpp_offset_of_array_bounds_in_array_object_header
il2cpp_offset_of_array_length_in_array_object_header
il2cpp_override_stack_backtrace
il2cpp_profiler_install
il2cpp_profiler_install_allocation
il2cpp_profiler_install_enter_leave
il2cpp_profiler_install_fileio
il2cpp_profiler_install_gc
il2cpp_profiler_install_thread
il2cpp_profiler_set_events
il2cpp_property_get_flags
il2cpp_property_get_get_method
il2cpp_property_get_name
il2cpp_property_get_parent
il2cpp_property_get_set_method
il2cpp_raise_exception
il2cpp_register_debugger_agent_transport
il2cpp_register_log_callback
il2cpp_resolve_icall
il2cpp_runtime_class_init
il2cpp_runtime_invoke
il2cpp_runtime_invoke_convert_args
il2cpp_runtime_object_init
il2cpp_runtime_object_init_exception
il2cpp_runtime_unhandled_exception_policy_set
il2cpp_set_commandline_arguments
il2cpp_set_commandline_arguments_utf16
il2cpp_set_config
il2cpp_set_config_dir
il2cpp_set_config_utf16
il2cpp_set_data_dir
il2cpp_set_default_thread_affinity
il2cpp_set_find_plugin_callback
il2cpp_set_memory_callbacks
il2cpp_set_temp_dir
il2cpp_shutdown
il2cpp_start_gc_world
il2cpp_stats_dump_to_file
il2cpp_stats_get_value
il2cpp_stop_gc_world
il2cpp_string_chars
il2cpp_string_intern
il2cpp_string_is_interned
il2cpp_string_length
il2cpp_string_new
il2cpp_string_new_len
il2cpp_string_new_utf16
il2cpp_string_new_wrapper
il2cpp_thread_attach
il2cpp_thread_current
il2cpp_thread_detach
il2cpp_thread_get_all_attached_threads
il2cpp_thread_get_frame_at
il2cpp_thread_get_stack_depth
il2cpp_thread_get_top_frame
il2cpp_thread_walk_frame_stack
il2cpp_type_equals
il2cpp_type_get_assembly_qualified_name
il2cpp_type_get_attrs
il2cpp_type_get_class_or_element_class
il2cpp_type_get_name
il2cpp_type_get_name_chunked
il2cpp_type_get_object
il2cpp_type_get_reflection_name
il2cpp_type_get_type
il2cpp_type_is_byref
il2cpp_type_is_pointer_type
il2cpp_type_is_static
il2cpp_unhandled_exception
il2cpp_unity_install_unitytls_interface
il2cpp_unity_liveness_allocate_struct
il2cpp_unity_liveness_calculation_from_root
il2cpp_unity_liveness_calculation_from_statics
il2cpp_unity_liveness_finalize
il2cpp_unity_liveness_free_struct
il2cpp_unity_set_android_network_up_state_func
il2cpp_value_box
jinfo_get_method
mini_get_interp_callbacks
mini_jit_info_table_find
mono_arch_clear_breakpoint
mono_arch_context_get_int_reg
mono_arch_context_set_int_reg
mono_arch_set_breakpoint
mono_arch_setup_resume_sighandler_ctx
mono_arch_skip_breakpoint
mono_arch_skip_single_step
mono_arch_start_single_stepping
mono_arch_stop_single_stepping
mono_array_element_size
mono_array_length
mono_class_get_byref_type
mono_class_get_checked
mono_class_get_context
mono_class_get_element_class
mono_class_get_flags
mono_class_get_image
mono_class_get_interfaces
mono_class_get_methods
mono_class_get_name
mono_class_get_namespace
mono_class_get_nested_types
mono_class_get_parent
mono_class_get_properties
mono_class_get_rank
mono_class_get_type
mono_class_get_type_token
mono_class_has_parent
mono_class_instance_size
mono_class_is_enum
mono_class_is_valuetype
mono_class_num_fields
mono_class_num_methods
mono_class_num_properties
mono_class_value_size
mono_debug_find_method
mono_debug_free_locals
mono_debug_il_offset_from_address
mono_debug_lookup_locals
mono_domain_foreach
mono_domain_get
mono_domain_get_assemblies_iter
mono_domain_get_corlib
mono_domain_is_unloading
mono_environment_exitcode_get
mono_environment_exitcode_set
mono_field_get_name
mono_field_get_offset
mono_field_get_parent
mono_field_get_type
mono_field_set_value
mono_find_prev_seq_point_for_native_offset
mono_free_method_signatures
mono_gc_register_root
mono_get_byte_class
mono_get_lmf_addr
mono_get_root_domain
mono_get_runtime_build_info
mono_get_string_class
mono_image_get_assembly
mono_image_get_entry_point
mono_image_get_filename
mono_image_get_guid
mono_image_get_name
mono_image_is_dynamic
mono_jit_find_compiled_method_with_jit_info
mono_jit_info_get_method
mono_jit_info_table_find
mono_marshal_method_from_wrapper
mono_metadata_free_mh
mono_metadata_generic_class_is_valuetype
mono_method_full_name
mono_method_get_class
mono_method_get_context
mono_method_get_declaring_generic_method
mono_method_get_flags
mono_method_get_generic_container
mono_method_get_header_checked
mono_method_get_name
mono_method_get_param_names
mono_method_get_token
mono_method_is_generic
mono_method_is_inflated
mono_object_get_type
mono_object_unbox_internal
mono_property_get_get_method
mono_property_get_name
mono_property_get_parent
mono_property_get_set_method
mono_restore_context
mono_runtime_is_shutting_down
mono_runtime_quit
mono_set_is_debugger_attached
mono_set_lmf
mono_string_chars
mono_string_free
mono_string_length
mono_string_new
mono_thread_attach
mono_thread_current
mono_thread_detach
mono_thread_get_main
mono_thread_set_name
mono_thread_state_init_from_current
mono_thread_state_init_from_monoctx
mono_thread_suspend_all_other_threads
mono_type_full_name
mono_type_generic_inst_is_valuetype
mono_type_get_attrs
mono_type_get_class
mono_type_get_name_full
mono_type_get_type
mono_type_is_byref
mono_type_is_generic_parameter
mono_type_is_reference
mono_type_is_struct
mono_type_size

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

il2cpp
Size: 12.1MB - Virtual size: 12.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 916KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 722KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 308KB - Virtual size: 307KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAM.exe
.exe windows:6 windows x64

Password: infected

ce1183cc150987a99aef5749f22af81e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

unityplayer

UnityMain

kernel32

HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Exports

Exports

AmdPowerXpressRequestHighPerformance
NvOptimusEnablement

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 552KB - Virtual size: 552KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAM_Data/Plugins/x86_64/KS_Diagnostics_Process.dll
.dll windows:6 windows x64

Password: infected

8ac95d4ef8d56e2b91d1ccfdedb9407e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
EventSetInformation
EventUnregister
RegCloseKey
EventActivityIdControl
EventRegister
EnumerateTraceGuidsEx
EventWriteTransfer
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
EventWrite
EventEnabled

bcrypt

BCryptGenRandom

kernel32

CreateFileW
SetLastError
FormatMessageW
GetLastError
CloseHandle
GetExitCodeProcess
GetProcessTimes
GetStdHandle
CreateProcessW
TerminateProcess
GetCurrentProcess
OpenProcess
K32EnumProcesses
DuplicateHandle
GetConsoleCP
GetConsoleOutputCP
CreatePipe
MultiByteToWideChar
WideCharToMultiByte
GetCPInfoExW
LocalFree
GetConsoleMode
GetFileType
ReadFile
ReadConsoleW
WriteFile
WriteConsoleW
CloseThreadpoolIo
GetTickCount64
GetCurrentProcessId
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
CompareStringEx
FindNLSStringEx
GetUserPreferredUILanguages
FindStringOrdinal
GetCurrentProcessorNumber
GetCurrentThread
WaitForSingleObject
Sleep
CreateThreadpoolWork
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
InitializeCriticalSection
InitializeConditionVariable
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WakeConditionVariable
WaitForMultipleObjectsEx
GetProcAddress
GetCPInfo
LocalAlloc
RaiseFailFastException
WaitForThreadpoolWaitCallbacks
CreateThreadpoolIo
StartThreadpoolIo
CancelThreadpoolIo
LocaleNameToLCID
LCMapStringEx
CompareStringOrdinal
GetLocaleInfoEx
EnumTimeFormatsEx
GetCalendarInfoEx
EnumCalendarInfoExEx
ResolveLocaleName
CancelIoEx
SleepConditionVariableCS
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FlushFileBuffers
FreeLibrary
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFullPathNameW
GetLongPathNameW
GetOverlappedResult
GetSystemDirectoryW
LoadLibraryExW
QueryUnbiasedInterruptTime
SetFileInformationByHandle
SetFilePointerEx
SetThreadErrorMode
GetDynamicTimeZoneInformation
GetTimeZoneInformation
SetEvent
ResetEvent
CreateEventExW
GetEnvironmentVariableW
CreateThread
ResumeThread
GetThreadPriority
SetThreadPriority
VerSetConditionMask
FlushProcessWriteBuffers
GetCurrentThreadId
WaitForSingleObjectEx
VirtualQuery
RtlVirtualUnwind
AddVectoredExceptionHandler
FlsAlloc
FlsGetValue
FlsSetValue
CreateEventW
SwitchToThread
SuspendThread
GetThreadContext
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
InitializeCriticalSectionEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
DebugBreak
SleepEx
GlobalMemoryStatusEx
GetTickCount
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
GetWriteWatch
ResetWriteWatch
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
K32GetProcessMemoryInfo
SetStdHandle
HeapReAlloc
HeapSize
GetStringTypeW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW

ole32

CoWaitForMultipleHandles
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoGetApartmentType
CoCreateGuid
CoTaskMemAlloc

user32

LoadStringW

Exports

Exports

AddExited
AddOutputDataReceived
BeginOutputReadLine
CancelOutputRead
CreateProcess
CreateProcessStartInfo
DisposeProcess
DisposeProcessStartInfo
Free
FreeGCHandle
GetArguments
GetCreateNoWindow
GetEnableRaisingEvents
GetFileName
GetProcessId
GetProcessName
GetProcesses
GetProcessesByName
GetProcessesByNameString
GetProcessesString
GetRedirectStandardOutput
GetUseShellExecute
GetWorkingDirectory
Kill
KillBool
RemoveExited
RemoveOutputDataReceived
SetArguments
SetCreateNoWindow
SetEnableRaisingEvents
SetFileName
SetRedirectStandardOutput
SetStartInfo
SetUseShellExecute
SetWorkingDirectory
Start
WaitForExit
WaitForExitMilliseconds

Sections

.text
Size: 480KB - Virtual size: 479KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.managed
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 161KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAM_Data/Plugins/x86_64/lib_burst_generated.dll
.dll windows:6 windows x64

Password: infected

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Exports

Exports

122fae680333e8e2ba58f80110a0a78c
2b06055de97035295dc032db19a3a735
381a3a85c237f2f5ef34ba69d4bda072
5c5fd0d301a01238c271642848eb0bae
66b2bcfca35e34fcfd5d46be438048e2
6d933222c5b0c0c915d062861958d408
7194d9a68a20c1c6a01d3a365d4f21b9
7742443bc60e4cf32e2d83ea81ffbafd
8a514c2070867b45ad29e24d591c070e
8c2be93e18276203cbd918daa2748a10
9425db96a9fb33479746c6501570455e
a10c29fb1a626a4dab6bf90980926746
aece0ca012db7ae9f82cc8b3c490870a
b0197e8b2118e6410ef3f798b24a1e6e
burst.initialize
burst.initialize.externals.122fae680333e8e2ba58f80110a0a78c_avx2
burst.initialize.externals.122fae680333e8e2ba58f80110a0a78c_x64_sse2
burst.initialize.externals.2b06055de97035295dc032db19a3a735_avx2
burst.initialize.externals.2b06055de97035295dc032db19a3a735_x64_sse2
burst.initialize.externals.381a3a85c237f2f5ef34ba69d4bda072_avx2
burst.initialize.externals.381a3a85c237f2f5ef34ba69d4bda072_x64_sse2
burst.initialize.externals.5c5fd0d301a01238c271642848eb0bae_avx2
burst.initialize.externals.5c5fd0d301a01238c271642848eb0bae_x64_sse2
burst.initialize.externals.66b2bcfca35e34fcfd5d46be438048e2_avx2
burst.initialize.externals.66b2bcfca35e34fcfd5d46be438048e2_x64_sse2
burst.initialize.externals.6d933222c5b0c0c915d062861958d408_avx2
burst.initialize.externals.6d933222c5b0c0c915d062861958d408_x64_sse2
burst.initialize.externals.7194d9a68a20c1c6a01d3a365d4f21b9_avx2
burst.initialize.externals.7194d9a68a20c1c6a01d3a365d4f21b9_x64_sse2
burst.initialize.externals.7742443bc60e4cf32e2d83ea81ffbafd_avx2
burst.initialize.externals.7742443bc60e4cf32e2d83ea81ffbafd_x64_sse2
burst.initialize.externals.8a514c2070867b45ad29e24d591c070e_avx2
burst.initialize.externals.8a514c2070867b45ad29e24d591c070e_x64_sse2
burst.initialize.externals.8c2be93e18276203cbd918daa2748a10_avx2
burst.initialize.externals.8c2be93e18276203cbd918daa2748a10_x64_sse2
burst.initialize.externals.9425db96a9fb33479746c6501570455e_avx2
burst.initialize.externals.9425db96a9fb33479746c6501570455e_x64_sse2
burst.initialize.externals.a10c29fb1a626a4dab6bf90980926746_avx2
burst.initialize.externals.a10c29fb1a626a4dab6bf90980926746_x64_sse2
burst.initialize.externals.aece0ca012db7ae9f82cc8b3c490870a_avx2
burst.initialize.externals.aece0ca012db7ae9f82cc8b3c490870a_x64_sse2
burst.initialize.externals.b0197e8b2118e6410ef3f798b24a1e6e_avx2
burst.initialize.externals.b0197e8b2118e6410ef3f798b24a1e6e_x64_sse2
burst.initialize.externals.d4015a9e8b68219132a23f8b001d93e7_avx2
burst.initialize.externals.d4015a9e8b68219132a23f8b001d93e7_x64_sse2
burst.initialize.externals.f9554e48e09171c93d417c182c09c36b_avx2
burst.initialize.externals.f9554e48e09171c93d417c182c09c36b_x64_sse2
burst.initialize.statics.122fae680333e8e2ba58f80110a0a78c_avx2
burst.initialize.statics.122fae680333e8e2ba58f80110a0a78c_x64_sse2
burst.initialize.statics.2b06055de97035295dc032db19a3a735_avx2
burst.initialize.statics.2b06055de97035295dc032db19a3a735_x64_sse2
burst.initialize.statics.381a3a85c237f2f5ef34ba69d4bda072_avx2
burst.initialize.statics.381a3a85c237f2f5ef34ba69d4bda072_x64_sse2
burst.initialize.statics.5c5fd0d301a01238c271642848eb0bae_avx2
burst.initialize.statics.5c5fd0d301a01238c271642848eb0bae_x64_sse2
burst.initialize.statics.66b2bcfca35e34fcfd5d46be438048e2_avx2
burst.initialize.statics.66b2bcfca35e34fcfd5d46be438048e2_x64_sse2
burst.initialize.statics.6d933222c5b0c0c915d062861958d408_avx2
burst.initialize.statics.6d933222c5b0c0c915d062861958d408_x64_sse2
burst.initialize.statics.7194d9a68a20c1c6a01d3a365d4f21b9_avx2
burst.initialize.statics.7194d9a68a20c1c6a01d3a365d4f21b9_x64_sse2
burst.initialize.statics.7742443bc60e4cf32e2d83ea81ffbafd_avx2
burst.initialize.statics.7742443bc60e4cf32e2d83ea81ffbafd_x64_sse2
burst.initialize.statics.8a514c2070867b45ad29e24d591c070e_avx2
burst.initialize.statics.8a514c2070867b45ad29e24d591c070e_x64_sse2
burst.initialize.statics.8c2be93e18276203cbd918daa2748a10_avx2
burst.initialize.statics.8c2be93e18276203cbd918daa2748a10_x64_sse2
burst.initialize.statics.9425db96a9fb33479746c6501570455e_avx2
burst.initialize.statics.9425db96a9fb33479746c6501570455e_x64_sse2
burst.initialize.statics.a10c29fb1a626a4dab6bf90980926746_avx2
burst.initialize.statics.a10c29fb1a626a4dab6bf90980926746_x64_sse2
burst.initialize.statics.aece0ca012db7ae9f82cc8b3c490870a_avx2
burst.initialize.statics.aece0ca012db7ae9f82cc8b3c490870a_x64_sse2
burst.initialize.statics.b0197e8b2118e6410ef3f798b24a1e6e_avx2
burst.initialize.statics.b0197e8b2118e6410ef3f798b24a1e6e_x64_sse2
burst.initialize.statics.d4015a9e8b68219132a23f8b001d93e7_avx2
burst.initialize.statics.d4015a9e8b68219132a23f8b001d93e7_x64_sse2
burst.initialize.statics.f9554e48e09171c93d417c182c09c36b_avx2
burst.initialize.statics.f9554e48e09171c93d417c182c09c36b_x64_sse2
d4015a9e8b68219132a23f8b001d93e7
f9554e48e09171c93d417c182c09c36b

Sections

.text
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
RAM_Data/Resources/unity default resources
RAM_Data/Resources/unity_builtin_extra
RAM_Data/RuntimeInitializeOnLoads.json
RAM_Data/ScriptingAssemblies.json
RAM_Data/app.info
RAM_Data/boot.config
RAM_Data/globalgamemanagers
RAM_Data/globalgamemanagers.assets
RAM_Data/globalgamemanagers.assets.resS
RAM_Data/il2cpp_data/Metadata/global-metadata.dat
RAM_Data/il2cpp_data/Resources/mscorlib.dll-resources.dat
RAM_Data/level0
RAM_Data/sharedassets0.assets
RAM_Data/sharedassets0.assets.resS
UnityCrashHandler64.exe
.exe windows:6 windows x64

Password: infected

fe9c40f7a90a28f3ad70906de8c1e9ab

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/07/2021, 00:00

Not After

18/07/2024, 23:59

Subject

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

57:44:9e:23:9b:66:b2:c3:0a:d5:26:7d:29:d8:2f:d9:a9:5e:e6:c0
Signer

Actual PE Digest

57:44:9e:23:9b:66:b2:c3:0a:d5:26:7d:29:d8:2f:d9:a9:5e:e6:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

GetWindowLongA
DialogBoxParamA
EndDialog
SendMessageW
SendDlgItemMessageA
GetIconInfo
SetForegroundWindow
AdjustWindowRect
UnionRect
SetWindowTextW
GetDlgItem
LookupIconIdFromDirectoryEx
InflateRect
OffsetRect
CreateIconFromResourceEx
LoadImageA
SetWindowPos

kernel32

InterlockedPopEntrySList
DuplicateHandle
VirtualProtect
GetVersionExW
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
HeapQueryInformation
HeapSize
HeapReAlloc
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FreeLibraryAndExitThread
GetConsoleOutputCP
GetConsoleMode
SetConsoleCtrlHandler
GetFileType
SetStdHandle
GetModuleHandleExW
ExitProcess
SetWaitableTimer
GetModuleHandleA
GetLastError
GetCurrentThread
WaitForSingleObjectEx
CloseHandle
RaiseException
GetProcAddress
SleepEx
GetThreadTimes
CreateWaitableTimerExW
OpenThread
TryEnterCriticalSection
EnterCriticalSection
SetThreadPriority
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentThreadId
ResumeThread
GetThreadPriority
CreateThread
SwitchToThread
DeleteCriticalSection
CreateDirectoryW
ReadFile
GetModuleFileNameA
FindFirstFileW
GetFileSizeEx
FindFirstFileExW
TlsSetValue
SetLastError
RtlCaptureContext
GetFullPathNameW
FindNextFileW
GetCurrentProcess
WriteFile
OutputDebugStringA
RemoveDirectoryW
RtlVirtualUnwind
SetFileTime
GetModuleFileNameW
RtlLookupFunctionEntry
SetFilePointer
SetEndOfFile
GetEnvironmentVariableA
FindClose
CreateFileW
GetFileAttributesW
QueryDepthSList
GetCurrentDirectoryA
SetFileAttributesW
CreateEventW
MultiByteToWideChar
GetFileAttributesA
GetFileAttributesExW
GetDiskFreeSpaceExW
LoadLibraryA
DeleteFileW
LoadLibraryW
GetThreadContext
SetFilePointerEx
MoveFileExW
ReplaceFileW
ReadProcessMemory
SystemTimeToFileTime
FreeLibrary
CopyFileW
WideCharToMultiByte
TlsGetValue
GetTempFileNameW
GetSystemTime
FlushFileBuffers
HeapFree
Thread32Next
Thread32First
WaitForSingleObject
CreateToolhelp32Snapshot
FormatMessageW
HeapAlloc
LocalFree
VerSetConditionMask
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
VerifyVersionInfoW
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
GetTempPathW
WaitForMultipleObjectsEx
OpenProcess
Sleep
SetEvent
GetThreadId
GetFileSize
CreateProcessW
CopyFileExW
AllocConsole
GetExitCodeProcess
SizeofResource
GetCommandLineW
EnumResourceNamesA
InitializeCriticalSection
SetErrorMode
FindResourceA
GetExitCodeThread
TerminateThread
LockResource
LoadResource
CreateEventA
LoadLibraryExW
CreateSemaphoreExW
VirtualFree
ReleaseSemaphore
VirtualAlloc
TlsAlloc
QueryPerformanceFrequency
TlsFree
QueryPerformanceCounter
IsDebuggerPresent
RtlPcToFileHeader
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTickCount
GetCPInfo
DecodePointer
EncodePointer
GetStringTypeW
InitializeSListHead
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnregisterWaitEx
UnhandledExceptionFilter
ResetEvent
SuspendThread
GetProcessId

dbghelp

SymRegisterFunctionEntryCallback64
SymLoadModuleEx

shell32

CommandLineToArgvW
SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoCreateGuid
CoTaskMemFree
CoInitializeEx

shlwapi

PathCanonicalizeW

psapi

GetModuleFileNameExW

advapi32

GetUserNameA

wininet

InternetCloseHandle
InternetCrackUrlA
InternetOpenA
InternetConnectA
HttpSendRequestA
HttpOpenRequestA
HttpQueryInfoA

gdi32

GetObjectA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 556KB - Virtual size: 555KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UnityPlayer.dll
.dll windows:6 windows x64

Password: infected

1683d1c92355e1075176c8a050bc7c72

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/07/2021, 00:00

Not After

18/07/2024, 23:59

Subject

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c5:46:c7:38:e6:65:02:a8:65:9c:d3:42:1f:ba:3f:69:42:9c:f3:92
Signer

Actual PE Digest

c5:46:c7:38:e6:65:02:a8:65:9c:d3:42:1f:ba:3f:69:42:9c:f3:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetProcessId
OutputDebugStringA
WaitForMultipleObjects
GetExitCodeProcess
SetErrorMode
WriteFile
CreateEventW
GetSystemPowerStatus
GlobalMemoryStatusEx
CreateToolhelp32Snapshot
GetTempPathW
GetUserDefaultLocaleName
GetSystemDirectoryA
CreateFileA
GetComputerNameW
GlobalLock
GlobalUnlock
GlobalAlloc
GetTempFileNameW
DeleteFileW
K32GetProcessMemoryInfo
Thread32First
Thread32Next
GetNativeSystemInfo
VirtualQuery
GetSystemTimeAsFileTime
LocalFree
GetFileAttributesExW
CreateFileW
CreateDirectoryW
RemoveDirectoryW
SetFileAttributesW
CopyFileW
MoveFileExW
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointerEx
SetFilePointer
ReadFile
SetEndOfFile
GetFileSizeEx
ReplaceFileW
GetFullPathNameW
GetSystemTime
SystemTimeToFileTime
SetFileTime
GetDiskFreeSpaceExW
SuspendThread
ExpandEnvironmentStringsW
CreateMutexA
RtlCaptureContext
SetUnhandledExceptionFilter
GetErrorMode
GetModuleFileNameA
GetFileAttributesA
GetEnvironmentVariableA
GetCurrentDirectoryA
GetThreadContext
RtlLookupFunctionEntry
RtlVirtualUnwind
ReadProcessMemory
LocalAlloc
GetCurrentDirectoryW
DebugBreak
GetTickCount
GetOverlappedResult
ResetEvent
CancelIo
GetModuleFileNameW
GetWindowsDirectoryW
InitializeCriticalSection
DeleteCriticalSection
DeleteProcThreadAttributeList
LeaveCriticalSection
AttachConsole
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
GetLocalTime
CreatePipe
ReleaseSemaphore
CreateSemaphoreExW
TlsAlloc
TlsFree
IsDebuggerPresent
GetStdHandle
SetThreadAffinityMask
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
GetFileSize
CreateWaitableTimerA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
GetSystemDirectoryW
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
UnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
CreateTimerQueue
SignalObjectAndWait
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibraryAndExitThread
GetVersionExW
DuplicateHandle
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
RtlUnwind
GetModuleHandleW
SwitchToThread
GetCurrentThreadId
GetThreadPriority
SetThreadPriority
ResumeThread
CreateThread
GetThreadTimes
HeapSize
HeapReAlloc
UpdateProcThreadAttribute
GetProcessHeap
HeapAlloc
InitializeProcThreadAttributeList
GetCommandLineW
OutputDebugStringW
GetLogicalProcessorInformationEx
LoadLibraryExW
WaitForMultipleObjectsEx
CreateEventExW
ExitThread
QueryPerformanceFrequency
QueryPerformanceCounter
VerifyVersionInfoW
VerSetConditionMask
HeapQueryInformation
ExitProcess
GetModuleHandleExW
GetConsoleOutputCP
GetConsoleMode
GetFileType
ReadConsoleW
FlushFileBuffers
CreateProcessW
GetTimeZoneInformation
OpenThread
GetModuleHandleA
GetCurrentThread
HeapFree
LoadLibraryA
GetCurrentProcess
TerminateProcess
SetConsoleCtrlHandler
WaitForSingleObject
GetStartupInfoA
SetLastError
EnterCriticalSection
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
GetFileAttributesW
RaiseException
SleepEx
SetWaitableTimer
SetEvent
CreateWaitableTimerExW
Sleep
WaitForSingleObjectEx
CloseHandle
CreateEventA
SetHandleInformation
FormatMessageW
GetProcAddress
FreeLibrary
LoadLibraryW
SetDllDirectoryW
WideCharToMultiByte
GetCurrentProcessId
MultiByteToWideChar
VirtualProtect
VirtualFree
VirtualAlloc
GetSystemInfo
GetLastError
TlsGetValue
FormatMessageA
TlsSetValue
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

user32

GetAsyncKeyState
MapVirtualKeyExA
GetKeyboardLayout
GetRawInputDeviceInfoW
GetMessageExtraInfo
GetKeyState
MapVirtualKeyA
GetKeyboardLayoutNameW
ToUnicode
MapVirtualKeyW
GetKeyNameTextW
RegisterRawInputDevices
GetRawInputDeviceList
GetRawInputData
GetRawInputBuffer
GetCursorPos
PtInRect
EnumDisplaySettingsA
GetDC
SetWindowLongA
LoadIconW
GetWindowPlacement
AdjustWindowRectEx
GetForegroundWindow
EnumDisplaySettingsW
GetWindowLongA
DispatchMessageA
TranslateMessage
SystemParametersInfoW
UnregisterDeviceNotification
RegisterDeviceNotificationW
SetCapture
ReleaseCapture
GetSystemMetrics
RegisterClassExW
ScreenToClient
DialogBoxParamW
EndDialog
SetDlgItemTextW
SetDlgItemTextA
LoadIconA
SendDlgItemMessageW
OffsetRect
CopyRect
SendMessageTimeoutA
SetForegroundWindow
EnumWindows
GetUserObjectInformationA
GetThreadDesktop
DestroyIcon
DestroyCursor
TrackMouseEvent
SetCursor
LoadCursorA
LoadImageW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
AllowSetForegroundWindow
ReleaseDC
GetDesktopWindow
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
UpdateWindow
SendMessageW
GetMessageA
SetWindowTextW
DragDetect
ShowWindow
GetActiveWindow
GetParent
ValidateRect
IsIconic
MonitorFromRect
SetWindowLongPtrA
IsWindowVisible
SetCursorPos
ClientToScreen
ClipCursor
MonitorFromWindow
ShowCursor
GetClientRect
MoveWindow
GetWindowRect
GetMonitorInfoW
SetFocus
GetFocus
SetWindowPos
EnumDisplayMonitors
EnumDisplayDevicesA
GetMonitorInfoA
PostQuitMessage
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
DestroyWindow
UnregisterClassW
RegisterClassW
CreateWindowExW
KillTimer
MessageBoxA
SetTimer
PeekMessageA
MsgWaitForMultipleObjects
GetCaretBlinkTime
GetDoubleClickTime
RegisterWindowMessageA

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

ole32

CoTaskMemAlloc
PropVariantClear
StringFromGUID2
CoUninitialize
CoSetProxyBlanket
CoInitialize
CoCreateFreeThreadedMarshaler
CoCreateInstance
CoCreateGuid
PropVariantCopy
CoTaskMemFree

shlwapi

SHDeleteKeyW
PathCanonicalizeW

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiEnumDeviceInfo

advapi32

RegCreateKeyW
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
GetUserNameA
OpenProcessToken
GetTokenInformation
GetSidSubAuthority
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
CryptAcquireContextW
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegOpenKeyExW

gdi32

ChoosePixelFormat
SetPixelFormat
GetDeviceCaps
SwapBuffers

shell32

ShellExecuteW
SHGetKnownFolderPath
SHFileOperationW
CommandLineToArgvW
SHGetFolderPathW

opengl32

wglGetCurrentContext
wglGetProcAddress
wglDeleteContext
wglMakeCurrent
wglGetCurrentDC
wglCreateContext

winmm

waveOutGetNumDevs
waveOutGetDevCapsA
waveOutGetDevCapsW
timeGetTime
waveOutClose
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite
waveOutReset
waveOutGetPosition
waveInGetNumDevs
waveInGetDevCapsA
timeBeginPeriod
timeEndPeriod
waveInPrepareHeader
waveInUnprepareHeader
waveInAddBuffer
waveInStart
waveOutOpen
waveInGetDevCapsW
waveInOpen
waveInClose
waveInReset

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit
VariantChangeType

imm32

ImmSetCompositionStringW
ImmNotifyIME
ImmGetCompositionStringW
ImmAssociateContextEx
ImmAssociateContext
ImmGetConversionStatus
ImmReleaseContext
ImmGetContext

winhttp

WinHttpGetIEProxyConfigForCurrentUser
WinHttpOpen
WinHttpCloseHandle
WinHttpGetProxyForUrl

bcrypt

BCryptGenRandom

hid

HidP_GetData
HidP_MaxDataListLength
HidD_GetSerialNumberString
HidD_GetManufacturerString
HidD_GetProductString
HidD_FreePreparsedData
HidD_GetPreparsedData
HidD_GetHidGuid
HidP_SetUsages
HidP_SetUsageValue
HidP_GetButtonCaps
HidP_GetValueCaps
HidD_GetAttributes
HidP_GetCaps

dxgi

CreateDXGIFactory

crypt32

CertFreeCertificateContext
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertAddEncodedCertificateToStore
CertOpenStore
CertCloseStore

ws2_32

gethostname
getsockname
connect
WSAGetLastError
ntohs
closesocket
WSACleanup
WSAStartup
bind
htonl
inet_addr
htons
WSAIoctl
WSASetLastError
accept
WSAAsyncGetHostByName
shutdown
select
__WSAFDIsSet
ioctlsocket
setsockopt
sendto
send
listen
recvfrom
recv
WSASocketA
getaddrinfo
freeaddrinfo
ntohl
gethostbyname
getprotobyname
getpeername
getsockopt
WSAWaitForMultipleEvents
WSASocketW
WSACreateEvent
WSACloseEvent
gethostbyaddr
WSASendDisconnect
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACancelAsyncRequest
socket

dwmapi

DwmSetWindowAttribute
DwmGetWindowAttribute

Exports

Exports

UnityMain

Sections

.text
Size: 23.4MB - Virtual size: 23.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 298KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
baselib.dll
.dll windows:6 windows x64

Password: infected

db9c6dbbb87b8c007ce6d9eae665e766

Code Sign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

14/07/2021, 00:00

Not After

18/07/2024, 23:59

Subject

CN=Unity Technologies ApS,OU=Developer Services,O=Unity Technologies ApS,L=København,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

23:ab:2a:8a:0a:ec:02:00:f3:04:88:5b:0d:32:88:81:a4:5c:c6:1b
Signer

Actual PE Digest

23:ab:2a:8a:0a:ec:02:00:f3:04:88:5b:0d:32:88:81:a4:5c:c6:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

setsockopt
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
select
shutdown
listen
WSACloseEvent
WSACreateEvent
WSASocketW
getsockname
send
connect
WSAWaitForMultipleEvents
recvfrom
recv
getsockopt
sendto
ioctlsocket
WSAGetLastError

kernel32

InitializeSListHead
WriteConsoleW
GetStringTypeW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapQueryInformation
ReadFile
GetFileSizeEx
CreateSemaphoreExW
VirtualFree
ReleaseSemaphore
WriteFile
VirtualAlloc
SetEndOfFile
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
ResumeThread
FormatMessageW
GetLastError
WaitForSingleObjectEx
TlsAlloc
QueryPerformanceFrequency
CloseHandle
GetNativeSystemInfo
RaiseException
LoadLibraryW
CreateThread
SwitchToThread
GetProcAddress
SetFilePointerEx
GetThreadId
GetModuleHandleW
FreeLibrary
TlsFree
QueryPerformanceCounter
VirtualQuery
IsDebuggerPresent
FlushFileBuffers
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
Sleep
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsGetValue
TlsSetValue
GetSystemTimeAsFileTime
GetTickCount
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
EncodePointer
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualProtect
DuplicateHandle
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
HeapSize
RtlUnwindEx
RtlPcToFileHeader
GetModuleHandleExW
ExitProcess
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetStdHandle
GetFileType
GetConsoleOutputCP
GetConsoleMode
HeapReAlloc

Exports

Exports

??0AbortShim@il2cpp_baselib@@QEAA@P6A_NW4Baselib_ErrorCode@1@PEAX@Z1@Z
??0Thread@il2cpp_baselib@baselib@@QEAA@$$QEAV012@@Z
??0Thread@il2cpp_baselib@baselib@@QEAA@XZ
??1Thread@il2cpp_baselib@baselib@@QEAA@XZ
??4AbortShim@il2cpp_baselib@@QEAAAEAV01@$$QEAV01@@Z
??4AbortShim@il2cpp_baselib@@QEAAAEAV01@AEBV01@@Z
??4Thread@il2cpp_baselib@baselib@@QEAAAEAV012@$$QEAV012@@Z
??6il2cpp_baselib@@YAAEAVomemstream@0@AEAV10@AEBW4Baselib_ErrorCode@0@@Z
?Baselib_Debug_IsDebuggerAttached@il2cpp_baselib@@YA_NXZ
?Baselib_DynamicLibrary_Close@il2cpp_baselib@@YAXUBaselib_DynamicLibrary_Handle@1@@Z
?Baselib_DynamicLibrary_FromNativeHandle@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@_KIPEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_GetFunction@il2cpp_baselib@@YAPEAXUBaselib_DynamicLibrary_Handle@1@PEBDPEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_OpenProgramHandle@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_OpenUtf16@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@PEBGPEAUBaselib_ErrorState@1@@Z
?Baselib_DynamicLibrary_OpenUtf8@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@PEBDPEAUBaselib_ErrorState@1@@Z
?Baselib_ErrorState_Explain@il2cpp_baselib@@YAIPEBUBaselib_ErrorState@1@QEADIW4Baselib_ErrorState_ExplainVerbosity@1@@Z
?Baselib_ErrorState_FormatAndStoreExtraInformation@il2cpp_baselib@@YA_KPEBDPEAD@Z
?Baselib_FileIO_AsyncClose@il2cpp_baselib@@YAXUBaselib_FileIO_AsyncFile@1@@Z
?Baselib_FileIO_AsyncOpen@il2cpp_baselib@@YA?AUBaselib_FileIO_AsyncFile@1@UBaselib_FileIO_EventQueue@1@PEBD_KW4Baselib_FileIO_Priority@1@@Z
?Baselib_FileIO_AsyncRead@il2cpp_baselib@@YAXUBaselib_FileIO_AsyncFile@1@QEAUBaselib_FileIO_ReadRequest@1@_K2W4Baselib_FileIO_Priority@1@@Z
?Baselib_FileIO_EventQueue_Create@il2cpp_baselib@@YA?AUBaselib_FileIO_EventQueue@1@XZ
?Baselib_FileIO_EventQueue_Dequeue@il2cpp_baselib@@YA_KUBaselib_FileIO_EventQueue@1@QEAUBaselib_FileIO_EventQueue_Result@1@_KI@Z
?Baselib_FileIO_EventQueue_Free@il2cpp_baselib@@YAXUBaselib_FileIO_EventQueue@1@@Z
?Baselib_FileIO_EventQueue_Shutdown@il2cpp_baselib@@YAXUBaselib_FileIO_EventQueue@1@I@Z
?Baselib_FileIO_SyncClose@il2cpp_baselib@@YAXUBaselib_FileIO_SyncFile@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncFileFromNativeHandle@il2cpp_baselib@@YA?AUBaselib_FileIO_SyncFile@1@_KI@Z
?Baselib_FileIO_SyncFlush@il2cpp_baselib@@YAXUBaselib_FileIO_SyncFile@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncGetFileSize@il2cpp_baselib@@YA_KUBaselib_FileIO_SyncFile@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncOpen@il2cpp_baselib@@YA?AUBaselib_FileIO_SyncFile@1@PEBDIPEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncRead@il2cpp_baselib@@YA_KUBaselib_FileIO_SyncFile@1@_KPEAX1PEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncSetFileSize@il2cpp_baselib@@YAXUBaselib_FileIO_SyncFile@1@_KPEAUBaselib_ErrorState@1@@Z
?Baselib_FileIO_SyncWrite@il2cpp_baselib@@YA_KUBaselib_FileIO_SyncFile@1@_KPEBX1PEAUBaselib_ErrorState@1@@Z
?Baselib_Memory_AlignedAllocate@il2cpp_baselib@@YAPEAX_K0@Z
?Baselib_Memory_AlignedFree@il2cpp_baselib@@YAXPEAX@Z
?Baselib_Memory_AlignedReallocate@il2cpp_baselib@@YAPEAXPEAX_K1@Z
?Baselib_Memory_Allocate@il2cpp_baselib@@YAPEAX_K@Z
?Baselib_Memory_AllocatePages@il2cpp_baselib@@YA?AUBaselib_Memory_PageAllocation@1@_K00W4Baselib_Memory_PageState@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Memory_Free@il2cpp_baselib@@YAXPEAX@Z
?Baselib_Memory_GetPageSizeInfo@il2cpp_baselib@@YAXPEAUBaselib_Memory_PageSizeInfo@1@@Z
?Baselib_Memory_Reallocate@il2cpp_baselib@@YAPEAXPEAX_K@Z
?Baselib_Memory_ReleasePages@il2cpp_baselib@@YAXUBaselib_Memory_PageAllocation@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Memory_SetPageState@il2cpp_baselib@@YAXPEAX_K1W4Baselib_Memory_PageState@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_NetworkAddress_Decode@il2cpp_baselib@@YAXPEBUBaselib_NetworkAddress@1@PEAW4Baselib_NetworkAddress_Family@1@QEADIPEAGPEAUBaselib_ErrorState@1@@Z
?Baselib_NetworkAddress_Encode@il2cpp_baselib@@YAXPEAUBaselib_NetworkAddress@1@W4Baselib_NetworkAddress_Family@1@QEBDGPEAUBaselib_ErrorState@1@@Z
?Baselib_Process_Abort@il2cpp_baselib@@YAXW4Baselib_ErrorCode@1@@Z
?Baselib_RegisteredNetwork_BufferSlice_Create@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_BufferSlice@1@UBaselib_RegisteredNetwork_Buffer@1@II@Z
?Baselib_RegisteredNetwork_BufferSlice_Empty@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_BufferSlice@1@XZ
?Baselib_RegisteredNetwork_Buffer_Deregister@il2cpp_baselib@@YAXUBaselib_RegisteredNetwork_Buffer@1@@Z
?Baselib_RegisteredNetwork_Buffer_Register@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_Buffer@1@UBaselib_Memory_PageAllocation@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Endpoint_Create@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_Endpoint@1@PEBUBaselib_NetworkAddress@1@UBaselib_RegisteredNetwork_BufferSlice@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Endpoint_Empty@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_Endpoint@1@XZ
?Baselib_RegisteredNetwork_Endpoint_GetNetworkAddress@il2cpp_baselib@@YAXUBaselib_RegisteredNetwork_Endpoint@1@PEAUBaselib_NetworkAddress@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_Close@il2cpp_baselib@@YAXUBaselib_RegisteredNetwork_Socket_UDP@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_Create@il2cpp_baselib@@YA?AUBaselib_RegisteredNetwork_Socket_UDP@1@PEBUBaselib_NetworkAddress@1@W4Baselib_NetworkAddress_AddressReuse@1@IIPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_DequeueRecv@il2cpp_baselib@@YAIUBaselib_RegisteredNetwork_Socket_UDP@1@QEAUBaselib_RegisteredNetwork_CompletionResult@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_DequeueSend@il2cpp_baselib@@YAIUBaselib_RegisteredNetwork_Socket_UDP@1@QEAUBaselib_RegisteredNetwork_CompletionResult@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_GetNetworkAddress@il2cpp_baselib@@YAXUBaselib_RegisteredNetwork_Socket_UDP@1@PEAUBaselib_NetworkAddress@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_ProcessRecv@il2cpp_baselib@@YA?AW4Baselib_RegisteredNetwork_ProcessStatus@1@UBaselib_RegisteredNetwork_Socket_UDP@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_ProcessSend@il2cpp_baselib@@YA?AW4Baselib_RegisteredNetwork_ProcessStatus@1@UBaselib_RegisteredNetwork_Socket_UDP@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_ScheduleRecv@il2cpp_baselib@@YAIUBaselib_RegisteredNetwork_Socket_UDP@1@PEBUBaselib_RegisteredNetwork_Request@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_ScheduleSend@il2cpp_baselib@@YAIUBaselib_RegisteredNetwork_Socket_UDP@1@PEBUBaselib_RegisteredNetwork_Request@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_WaitForCompletedRecv@il2cpp_baselib@@YA?AW4Baselib_RegisteredNetwork_CompletionQueueStatus@1@UBaselib_RegisteredNetwork_Socket_UDP@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_RegisteredNetwork_Socket_UDP_WaitForCompletedSend@il2cpp_baselib@@YA?AW4Baselib_RegisteredNetwork_CompletionQueueStatus@1@UBaselib_RegisteredNetwork_Socket_UDP@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_Bind@il2cpp_baselib@@YAXUBaselib_Socket_Handle@1@PEBUBaselib_NetworkAddress@1@W4Baselib_NetworkAddress_AddressReuse@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_Close@il2cpp_baselib@@YAXUBaselib_Socket_Handle@1@@Z
?Baselib_Socket_Create@il2cpp_baselib@@YA?AUBaselib_Socket_Handle@1@W4Baselib_NetworkAddress_Family@1@W4Baselib_Socket_Protocol@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_GetAddress@il2cpp_baselib@@YAXUBaselib_Socket_Handle@1@PEAUBaselib_NetworkAddress@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_Poll@il2cpp_baselib@@YAXPEAUBaselib_Socket_PollFd@1@IIPEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_TCP_Accept@il2cpp_baselib@@YA?AUBaselib_Socket_Handle@1@U21@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_TCP_Connect@il2cpp_baselib@@YAXUBaselib_Socket_Handle@1@PEBUBaselib_NetworkAddress@1@W4Baselib_NetworkAddress_AddressReuse@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_TCP_Listen@il2cpp_baselib@@YAXUBaselib_Socket_Handle@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_TCP_Recv@il2cpp_baselib@@YAIUBaselib_Socket_Handle@1@PEAXIPEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_TCP_Send@il2cpp_baselib@@YAIUBaselib_Socket_Handle@1@PEAXIPEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_UDP_Recv@il2cpp_baselib@@YAIUBaselib_Socket_Handle@1@QEAUBaselib_Socket_Message@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_Socket_UDP_Send@il2cpp_baselib@@YAIUBaselib_Socket_Handle@1@QEAUBaselib_Socket_Message@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_SystemFutex_Notify@il2cpp_baselib@@YAXPEAHIW4Baselib_WakeupFallbackStrategy@1@@Z
?Baselib_SystemFutex_Wait@il2cpp_baselib@@YAXPEAHHI@Z
?Baselib_SystemSemaphore_Acquire@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_Create@il2cpp_baselib@@YA?AUBaselib_SystemSemaphore_Handle@1@XZ
?Baselib_SystemSemaphore_CreateInplace@il2cpp_baselib@@YA?AUBaselib_SystemSemaphore_Handle@1@PEAX@Z
?Baselib_SystemSemaphore_Free@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_FreeInplace@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_Release@il2cpp_baselib@@YAXUBaselib_SystemSemaphore_Handle@1@I@Z
?Baselib_SystemSemaphore_TryAcquire@il2cpp_baselib@@YA_NUBaselib_SystemSemaphore_Handle@1@@Z
?Baselib_SystemSemaphore_TryTimedAcquire@il2cpp_baselib@@YA_NUBaselib_SystemSemaphore_Handle@1@I@Z
?Baselib_TLS_Alloc@il2cpp_baselib@@YA_KXZ
?Baselib_TLS_Free@il2cpp_baselib@@YAX_K@Z
?Baselib_Thread_Create@il2cpp_baselib@@YAPEAUBaselib_Thread@1@UBaselib_Thread_Config@1@PEAUBaselib_ErrorState@1@@Z
?Baselib_Thread_GetCurrentThreadId@il2cpp_baselib@@YA_JXZ
?Baselib_Thread_GetId@il2cpp_baselib@@YA_JPEAUBaselib_Thread@1@@Z
?Baselib_Thread_Join@il2cpp_baselib@@YAXPEAUBaselib_Thread@1@IPEAUBaselib_ErrorState@1@@Z
?Baselib_Thread_SupportsThreads@il2cpp_baselib@@YA_NXZ
?Baselib_Thread_YieldExecution@il2cpp_baselib@@YAXXZ
?Baselib_Timer_GetHighPrecisionTimerTicks@il2cpp_baselib@@YA_KXZ
?Baselib_Timer_GetTicksToNanosecondsConversionRatio@il2cpp_baselib@@YA?AUBaselib_Timer_TickToNanosecondConversionRatio@1@XZ
?Baselib_Timer_GetTimeSinceStartupInSeconds@il2cpp_baselib@@YANXZ
?Baselib_Timer_TickToNanosecondsConversionFactor@il2cpp_baselib@@3NB
?Baselib_Timer_WaitForAtLeast@il2cpp_baselib@@YAXI@Z
?Call@AbortShim@il2cpp_baselib@@QEAA_NW4Baselib_ErrorCode@2@@Z
?CreateThread@Thread@il2cpp_baselib@baselib@@CAPEAUBaselib_Thread@2@P6AXPEAX@Z0@Z
?Detail_Baselib_EventSemaphore_SemaphoreBased_AcquireNonSet@il2cpp_baselib@@YAXHPEAUBaselib_EventSemaphore@@@Z
?Detail_Baselib_EventSemaphore_SemaphoreBased_TryTimedAcquireNonSet@il2cpp_baselib@@YA_NHPEAUBaselib_EventSemaphore@@I@Z
?Empty@AbortShim@il2cpp_baselib@@SA?AV12@XZ
?GetCurrentId@Thread@il2cpp_baselib@baselib@@SA_JXZ
?GetId@Thread@il2cpp_baselib@baselib@@QEAA_JXZ
?SetAbortShim@il2cpp_baselib@@YA?AVAbortShim@1@V21@@Z
?ShimmableAbort@il2cpp_baselib@@YAXW4Baselib_ErrorCode@1@@Z
?SupportsThreads@Thread@il2cpp_baselib@baselib@@SA_NXZ
?TryJoin@Thread@il2cpp_baselib@baselib@@QEAA_NV?$duration@IU?$ratio@$00$0DOI@@std@@@chrono@std@@@Z
?YieldExecution@Thread@il2cpp_baselib@baselib@@SAXXZ
?detail_AssertLog@il2cpp_baselib@@YAXPEBDZZ
?detail_AssertLogMute@il2cpp_baselib@@YAX_N@Z

Sections

.text
Size: 271KB - Virtual size: 271KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

23b3b3aa9fdf356bc269e3f4f57831f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

ole32

oleaut32

shell32

ws2_32

iphlpapi

dbghelp

baselib

Exports

Exports

Sections

.text Size: 1.7MB - Virtual size: 1.7MB

il2cpp Size: 12.1MB - Virtual size: 12.1MB

.rdata Size: 3.5MB - Virtual size: 3.5MB

.data Size: 916KB - Virtual size: 3.6MB

.pdata Size: 722KB - Virtual size: 722KB

_RDATA Size: 512B - Virtual size: 252B

.reloc Size: 308KB - Virtual size: 307KB

Password: infected

ce1183cc150987a99aef5749f22af81e

Headers

DLL Characteristics

File Characteristics

Imports

unityplayer

kernel32

Exports

Exports

Sections

.text Size: 50KB - Virtual size: 50KB

.rdata Size: 37KB - Virtual size: 37KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 4KB - Virtual size: 3KB

_RDATA Size: 512B - Virtual size: 148B

.rsrc Size: 552KB - Virtual size: 552KB

.reloc Size: 2KB - Virtual size: 1KB

Password: infected

8ac95d4ef8d56e2b91d1ccfdedb9407e

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

kernel32

ole32

user32

Exports

Exports

Sections

.text Size: 480KB - Virtual size: 479KB

.managed Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 2.1MB - Virtual size: 2.1MB

.data Size: 161KB - Virtual size: 231KB

.pdata Size: 190KB - Virtual size: 190KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1024B - Virtual size: 944B

.reloc Size: 89KB - Virtual size: 88KB

Password: infected

Headers

DLL Characteristics

File Characteristics

Exports

Exports

Sections

.text Size: 39KB - Virtual size: 39KB

.text
Size: 1.7MB - Virtual size: 1.7MB

il2cpp
Size: 12.1MB - Virtual size: 12.1MB

.rdata
Size: 3.5MB - Virtual size: 3.5MB

.data
Size: 916KB - Virtual size: 3.6MB

.pdata
Size: 722KB - Virtual size: 722KB

_RDATA
Size: 512B - Virtual size: 252B

.reloc
Size: 308KB - Virtual size: 307KB

.text
Size: 50KB - Virtual size: 50KB

.rdata
Size: 37KB - Virtual size: 37KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 552KB - Virtual size: 552KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 480KB - Virtual size: 479KB

.managed
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 2.1MB - Virtual size: 2.1MB

.data
Size: 161KB - Virtual size: 231KB

.pdata
Size: 190KB - Virtual size: 190KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1024B - Virtual size: 944B

.reloc
Size: 89KB - Virtual size: 88KB

.text
Size: 39KB - Virtual size: 39KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 1KB - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 16B

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52
Certificate

57:44:9e:23:9b:66:b2:c3:0a:d5:26:7d:29:d8:2f:d9:a9:5e:e6:c0
Signer

.text
Size: 556KB - Virtual size: 555KB

.rdata
Size: 162KB - Virtual size: 162KB

.data
Size: 12KB - Virtual size: 21KB

.pdata
Size: 30KB - Virtual size: 30KB

_RDATA
Size: 512B - Virtual size: 148B

.rsrc
Size: 349KB - Virtual size: 349KB

.reloc
Size: 5KB - Virtual size: 5KB

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

0f:7c:5a:5e:06:2a:bd:ba:fc:be:1e:c6:3d:4c:30:52
Certificate

c5:46:c7:38:e6:65:02:a8:65:9c:d3:42:1f:ba:3f:69:42:9c:f3:92
Signer