xworm | Wave[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Wave.zip
Size

5.8MB
MD5

244cd2cdb968445ed57169787e7c86aa
SHA1

49b4a8ff12956d1429a1ee0b9331d49c279e27d9
SHA256

88161212f0666ef635decddbdf96cc1dee72285ac12764c97fef4ae25d473abe
SHA512

5bae410400e7a8ac71c53a71d1ea1d120a3d1b63fbc0a2064155b216aa7f92f520dc61aed39ba88752f73bd8c2db0e3e3f39a2fddc3f4489eda2a0d07454dad3
SSDEEP

98304:uS6xFkFQhCwuZYQK8liaaJsyPR9irKUv0NxDIJO6dR4Mfq+L1cu40w:uSmFUQhtQKayZ9irhv0QO6r4MfVLCv

Score

10^/10

xworm

Malware Config

Extracted

Family

xworm

Attributes

Install_directory
%AppData%
install_file
svchost.exe
pastebin_url
https://pastebin.com/raw/sGaZ7csB

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
static1/unpack001/Waveinstaller.exe	family_xworm

Xworm family
xworm

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CefSharp.Core.Runtime.dll
unpack001/Waveinstaller.exe
unpack001/bin/lz4.dll
unpack001/bin/wolfssl.dll
unpack001/bin/xxhash.dll
unpack001/bin/zlib1.dll
unpack001/bin/zstd.dll

Files

Wave.zip
.zip

Password: gameguard
CefSharp.Core.Runtime.dll
.dll windows:6 windows x86 arch:x86

Password: gameguard

d23845f7e2c02b1e4c42d565033f24b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\cefsharp\CefSharp.Core.Runtime\bin\Win32\Release\CefSharp.Core.Runtime.pdb

Imports

kernel32

GetLastError
SetLastError
FormatMessageA
VerifyVersionInfoW
WideCharToMultiByte
Sleep
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
VerSetConditionMask

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?uncaught_exception@std@@YA_NXZ
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?width@ios_base@std@@QAE_J_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ

vcruntime140

__CxxExceptionFilter
__CxxRegisterExceptionObject
__CxxDetectRethrow
__CxxUnregisterExceptionObject
_except_handler4_common
memset
__current_exception_context
__current_exception
__std_type_info_destroy_list
_CxxThrowException
__std_exception_destroy
__std_exception_copy
memmove
memcpy
__CxxFrameHandler3
__std_terminate
_purecall
__CxxQueryExceptionSize
__FrameUnwindFilter

api-ms-win-crt-runtime-l1-1-0

_invoke_watson
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initterm
_initialize_narrow_environment
_initialize_onexit_table
_crt_at_quick_exit
terminate
_cexit
abort
_crt_atexit
_execute_onexit_table
_register_onexit_function

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-heap-l1-1-0

malloc
free
_callnewh

libcef

cef_string_utf16_clear
cef_log
cef_string_utf8_clear
cef_string_wide_to_utf8
cef_string_utf8_to_utf16
cef_string_utf16_set
cef_print_settings_create
cef_string_utf16_cmp
cef_get_min_log_level
cef_string_utf16_to_utf8
cef_string_userfree_utf16_free
cef_value_create
cef_string_list_alloc
cef_string_list_free
cef_dictionary_value_create
cef_list_value_create
cef_is_cert_status_error
cef_currently_on
cef_post_task
cef_post_delayed_task
cef_register_extension
cef_register_scheme_handler_factory
cef_clear_scheme_handler_factories
cef_execute_process
cef_initialize
cef_get_exit_code
cef_shutdown
cef_do_message_loop_work
cef_run_message_loop
cef_quit_message_loop
cef_crash_reporting_enabled
cef_set_crash_key_value
cef_create_directory
cef_get_temp_directory
cef_create_new_temp_directory
cef_create_temp_directory_in_directory
cef_directory_exists
cef_delete_file
cef_zip_directory
cef_load_crlsets_file
cef_is_rtl
cef_add_cross_origin_whitelist_entry
cef_remove_cross_origin_whitelist_entry
cef_clear_cross_origin_whitelist
cef_resolve_url
cef_parse_url
cef_create_url
cef_format_url_for_security_display
cef_get_mime_type
cef_get_extensions_for_mime_type
cef_base64encode
cef_base64decode
cef_uriencode
cef_uridecode
cef_parse_json
cef_parse_json_buffer
cef_parse_jsonand_return_error
cef_write_json
cef_get_path
cef_launch_process
cef_begin_tracing
cef_end_tracing
cef_now_from_system_trace_time
cef_execute_java_script_with_user_gesture_for_tests
cef_set_data_directory_for_tests
cef_api_hash
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_request_context_get_global_context
cef_request_context_create_context
cef_create_context_shared
cef_cookie_manager_get_global_manager
cef_stream_writer_create_for_file
cef_stream_writer_create_for_handler
cef_drag_data_create
cef_stream_reader_create_for_file
cef_stream_reader_create_for_data
cef_stream_reader_create_for_handler
cef_urlrequest_create
cef_process_message_create
cef_post_data_create
cef_browser_host_create_browser
cef_browser_host_create_browser_sync
cef_binary_value_create
cef_post_data_element_create
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_media_router_get_global
cef_image_create
cef_response_create
cef_v8value_create_undefined
cef_v8value_create_null
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_uint
cef_v8value_create_double
cef_v8value_create_date
cef_v8value_create_string
cef_v8value_create_object
cef_v8value_create_array
cef_v8value_create_array_buffer
cef_v8value_create_function
cef_v8value_create_promise
cef_v8context_get_current_context
cef_v8context_get_entered_context
cef_v8context_in_context
cef_v8stack_trace_get_current
cef_task_runner_get_for_current_thread
cef_task_runner_get_for_thread
cef_menu_model_create

user32

GetKeyboardLayout
VkKeyScanExW
LoadCursorW
SetWindowLongW
GetWindowLongW
SetParent
IsChild
GetFocus
SetWindowPos
SetWindowTextW
GetClientRect
GetKeyState

mscoree

_CorDllMain

Exports

Exports

?CanDownload@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@1@Z
?DoClose@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@@Z
?GetAccessibilityHandler@RenderClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefAccessibilityHandler@@@@XZ
?GetAudioHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefAudioHandler@@@@XZ
?GetAudioParameters@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAVCefAudioParameters@@@Z
?GetAuthCredentials@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@_N1H11V?$scoped_refptr@VCefAuthCallback@@@@@Z
?GetContextMenuHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefContextMenuHandler@@@@XZ
?GetDialogHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDialogHandler@@@@XZ
?GetDisplayHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDisplayHandler@@@@XZ
?GetDownloadHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDownloadHandler@@@@XZ
?GetDragHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefDragHandler@@@@XZ
?GetFindHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFindHandler@@@@XZ
?GetFocusHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFocusHandler@@@@XZ
?GetFrameHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefFrameHandler@@@@XZ
?GetJSDialogHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefJSDialogHandler@@@@XZ
?GetKeyboardHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefKeyboardHandler@@@@XZ
?GetLifeSpanHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefLifeSpanHandler@@@@XZ
?GetLoadHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefLoadHandler@@@@XZ
?GetPermissionHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefPermissionHandler@@@@XZ
?GetRenderHandler@RenderClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefRenderHandler@@@@XZ
?GetRequestHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefRequestHandler@@@@XZ
?GetResourceRequestHandler@ClientAdapter@Internals@CefSharp@@UAE?AV?$scoped_refptr@VCefResourceRequestHandler@@@@V?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefRequest@@@@_N3ABV?$CefStringBase@UCefStringTraitsUTF16@@@@AA_N@Z
?GetScreenInfo@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAVCefScreenInfo@@@Z
?GetScreenPoint@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@HHAAH1@Z
?GetViewRect@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@AAVCefRect@@@Z
?InternalCursorChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z
?InternalCursorChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z
?OnAcceleratedPaint@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_paint_element_type_t@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@ABVCefAcceleratedPaintInfo@@@Z
?OnAccessibilityLocationChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefValue@@@@@Z
?OnAccessibilityTreeChange@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefValue@@@@@Z
?OnAddressChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnAfterCreated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnAudioStreamError@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnAudioStreamPacket@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@PAPBMH_J@Z
?OnAudioStreamStarted@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefAudioParameters@@H@Z
?OnAudioStreamStopped@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnAutoResize@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefSize@@@Z
?OnBeforeBrowse@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefRequest@@@@_N3@Z
?OnBeforeClose@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnBeforeContextMenu@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@V?$scoped_refptr@VCefMenuModel@@@@@Z
?OnBeforeDownload@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDownloadItem@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefBeforeDownloadCallback@@@@@Z
?OnBeforePopup@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2W4cef_window_open_disposition_t@@_NABVCefPopupFeatures@@AAVCefWindowInfo@@AAV?$scoped_refptr@VCefClient@@@@AAV?$CefStructBase@UCefBrowserSettingsTraits@@@@AAV?$scoped_refptr@VCefDictionaryValue@@@@PA_N@Z
?OnBeforeUnloadDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@_NV?$scoped_refptr@VCefJSDialogCallback@@@@@Z
?OnCertificateError@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_errorcode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@V?$scoped_refptr@VCefSSLInfo@@@@V?$scoped_refptr@VCefCallback@@@@@Z
?OnConsoleMessage@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_log_severity_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2H@Z
?OnContextMenuCommand@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@HW4cef_event_flags_t@@@Z
?OnContextMenuDismissed@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z
?OnCursorChange@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@PAUHICON__@@W4cef_cursor_type_t@@ABVCefCursorInfo@@@Z
?OnDialogClosed@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnDismissPermissionPrompt@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_KW4cef_permission_request_result_t@@@Z
?OnDocumentAvailableInMainFrame@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnDownloadUpdated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDownloadItem@@@@V?$scoped_refptr@VCefDownloadItemCallback@@@@@Z
?OnDragEnter@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDragData@@@@W4cef_drag_operations_mask_t@@@Z
?OnDraggableRegionsChanged@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$vector@VCefDraggableRegion@@V?$allocator@VCefDraggableRegion@@@std@@@std@@@Z
?OnFaviconURLChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$vector@V?$CefStringBase@UCefStringTraitsUTF16@@@@V?$allocator@V?$CefStringBase@UCefStringTraitsUTF16@@@@@std@@@std@@@Z
?OnFileDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_file_dialog_mode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@2ABV?$vector@V?$CefStringBase@UCefStringTraitsUTF16@@@@V?$allocator@V?$CefStringBase@UCefStringTraitsUTF16@@@@@std@@@std@@V?$scoped_refptr@VCefFileDialogCallback@@@@@Z
?OnFindResult@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@HHABVCefRect@@H_N@Z
?OnFrameAttached@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@_N@Z
?OnFrameCreated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z
?OnFrameDetached@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@@Z
?OnFullscreenModeChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z
?OnGotFocus@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnImeCompositionRangeChanged@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefRange@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@@Z
?OnJSDialog@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@W4cef_jsdialog_type_t@@11V?$scoped_refptr@VCefJSDialogCallback@@@@AA_N@Z
?OnKeyEvent@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefKeyEvent@@PAUtagMSG@@@Z
?OnLoadEnd@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@H@Z
?OnLoadError@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_errorcode_t@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@3@Z
?OnLoadStart@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_transition_type_t@@@Z
?OnLoadingProgressChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@N@Z
?OnLoadingStateChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N11@Z
?OnMainFrameChanged@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@1@Z
?OnOpenURLFromTab@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@W4cef_window_open_disposition_t@@_N@Z
?OnPaint@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_paint_element_type_t@@ABV?$vector@VCefRect@@V?$allocator@VCefRect@@@std@@@std@@PBXHH@Z
?OnPopupShow@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z
?OnPopupSize@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABVCefRect@@@Z
?OnPreKeyEvent@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@ABVCefKeyEvent@@PAUtagMSG@@PA_N@Z
?OnProcessMessageReceived@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@W4cef_process_id_t@@V?$scoped_refptr@VCefProcessMessage@@@@@Z
?OnRenderProcessTerminated@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_termination_status_t@@HABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnRenderViewReady@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnRequestMediaAccessPermission@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@IV?$scoped_refptr@VCefMediaAccessCallback@@@@@Z
?OnResetDialogState@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@@Z
?OnSelectClientCertificate@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@_NABV?$CefStringBase@UCefStringTraitsUTF16@@@@HABV?$vector@V?$scoped_refptr@VCefX509Certificate@@@@V?$allocator@V?$scoped_refptr@VCefX509Certificate@@@@@std@@@std@@V?$scoped_refptr@VCefSelectClientCertificateCallback@@@@@Z
?OnSetFocus@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@W4cef_focus_source_t@@@Z
?OnShowPermissionPrompt@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@_KABV?$CefStringBase@UCefStringTraitsUTF16@@@@IV?$scoped_refptr@VCefPermissionPromptCallback@@@@@Z
?OnStatusMessage@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnTakeFocus@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@_N@Z
?OnTitleChange@ClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@ABV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnTooltip@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@AAV?$CefStringBase@UCefStringTraitsUTF16@@@@@Z
?OnVirtualKeyboardRequested@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_text_input_mode_t@@@Z
?RunContextMenu@ClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefFrame@@@@V?$scoped_refptr@VCefContextMenuParams@@@@V?$scoped_refptr@VCefMenuModel@@@@V?$scoped_refptr@VCefRunContextMenuCallback@@@@@Z
?StartDragging@RenderClientAdapter@Internals@CefSharp@@UAE_NV?$scoped_refptr@VCefBrowser@@@@V?$scoped_refptr@VCefDragData@@@@W4cef_drag_operations_mask_t@@HH@Z
?UpdateDragCursor@RenderClientAdapter@Internals@CefSharp@@UAEXV?$scoped_refptr@VCefBrowser@@@@W4cef_drag_operations_mask_t@@@Z

Sections

.text
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 674KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
README.txt
Waveinstaller.exe
.exe windows:4 windows x86 arch:x86

Password: gameguard

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Background.mp4
bin/lz4.dll
.dll windows:6 windows x64 arch:x64

Password: gameguard

26bb2ecdbddc12d64783983d93e989a5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\vcpkg\buildtrees\lz4\x64-windows-rel\lz4.pdb

Imports

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memcpy
memset
memmove

api-ms-win-crt-heap-l1-1-0

free
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_onexit_table
_cexit
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment
_configure_narrow_argv

kernel32

GetSystemTimeAsFileTime
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
RtlCaptureContext
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent

Exports

Exports

LZ4F_compressBegin
LZ4F_compressBound
LZ4F_compressEnd
LZ4F_compressFrame
LZ4F_compressFrameBound
LZ4F_compressUpdate
LZ4F_compressionLevel_max
LZ4F_createCompressionContext
LZ4F_createDecompressionContext
LZ4F_decompress
LZ4F_flush
LZ4F_freeCompressionContext
LZ4F_freeDecompressionContext
LZ4F_getErrorName
LZ4F_getFrameInfo
LZ4F_getVersion
LZ4F_headerSize
LZ4F_isError
LZ4F_resetDecompressionContext
LZ4_compress
LZ4_compressBound
LZ4_compressHC
LZ4_compressHC2
LZ4_compressHC2_continue
LZ4_compressHC2_limitedOutput
LZ4_compressHC2_limitedOutput_continue
LZ4_compressHC2_limitedOutput_withStateHC
LZ4_compressHC2_withStateHC
LZ4_compressHC_continue
LZ4_compressHC_limitedOutput
LZ4_compressHC_limitedOutput_continue
LZ4_compressHC_limitedOutput_withStateHC
LZ4_compressHC_withStateHC
LZ4_compress_HC
LZ4_compress_HC_continue
LZ4_compress_HC_continue_destSize
LZ4_compress_HC_destSize
LZ4_compress_HC_extStateHC
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createHC
LZ4_createStream
LZ4_createStreamDecode
LZ4_createStreamHC
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_partial_usingDict
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeHC
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_freeStreamHC
LZ4_initStream
LZ4_initStreamHC
LZ4_loadDict
LZ4_loadDictHC
LZ4_resetStream
LZ4_resetStreamHC
LZ4_resetStreamHC_fast
LZ4_resetStreamState
LZ4_resetStreamStateHC
LZ4_resetStream_fast
LZ4_saveDict
LZ4_saveDictHC
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStateHC
LZ4_sizeofStreamState
LZ4_sizeofStreamStateHC
LZ4_slideInputBuffer
LZ4_slideInputBufferHC
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/wolfssl.dll
.dll windows:6 windows x64 arch:x64

Password: gameguard

0fc90ed65bdfb6bd41f1d230f0355fe5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\vcpkg\buildtrees\wolfssl\x64-windows-rel\wolfssl.pdb

Imports

ws2_32

gethostbyname
socket
send
recv
listen
htons
connect
closesocket
bind
WSAGetLastError
accept

crypt32

CertEnumCertificatesInStore
CertCloseStore
CertOpenSystemStoreA

kernel32

IsProcessorFeaturePresent
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
FindClose
UnhandledExceptionFilter
FindNextFileA
CloseHandle
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventA
QueryPerformanceCounter
QueryPerformanceFrequency
FormatMessageA
DisableThreadLibraryCalls
RtlVirtualUnwind
RtlLookupFunctionEntry
FindFirstFileA
InitializeSListHead
IsDebuggerPresent
RtlCaptureContext

advapi32

CryptReleaseContext
CryptAcquireContextA
CryptGenRandom

vcruntime140

strstr
__C_specific_handler
__std_type_info_destroy_list
memmove
memcmp
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

fclose
fopen
fwrite
__stdio_common_vfprintf
fflush
fread
fseek
fgets
__stdio_common_vsprintf
ftell

api-ms-win-crt-string-l1-1-0

strncmp
strncat
_stricmp
strtok_s
strncpy
strcmp
strcpy_s
tolower
isspace
_strnicmp
toupper

api-ms-win-crt-runtime-l1-1-0

_beginthread
_errno
_beginthreadex
_cexit
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc

api-ms-win-crt-math-l1-1-0

pow
log

api-ms-win-crt-time-l1-1-0

_time64
_mktime64
_gmtime64

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-environment-l1-1-0

getenv

Exports

Exports

AddSessionToCache
AddSignature
AltNameNew
Base16_Decode
Base16_Encode
Base64_Decode
Base64_Encode
Base64_EncodeEsc
Base64_Encode_NoNl
BioReceive
BioSend
BuildTls13Message
CheckRunTimeFastMath
CheckRunTimeSettings
ERR_load_SSL_strings
EccEnumToNID
EmbedOcspLookup
EmbedOcspRespFree
EmbedReceive
EmbedSend
FreeAltNames
FreeDecodedCert
FreeNameSubtrees
GetASNInt
InitDecodedCert
InitSuitesHashSigAlgo_ex2
ParseCert
SSL_COMP_get_compression_methods
SSL_CTX_set_tmp_dh_callback
SSL_ResourceFree
SetAlgoID
SetName
ToTraditional
ToTraditional_ex
TraditionalEnc
UnTraditionalEnc
WOLFSSL_CIPHER_mode
WOLFSSL_ERROR
WOLFSSL_ERROR_MSG
WOLFSSL_EVP_CIPHER_mode
cpuid_clear_flag
cpuid_select_flags
cpuid_set_flag
mp_cond_copy
mp_rand
wc_AesCbcDecrypt
wc_AesCbcDecryptWithKey
wc_AesCbcEncrypt
wc_AesCbcEncryptWithKey
wc_AesCfb1Decrypt
wc_AesCfb1Encrypt
wc_AesCfb8Decrypt
wc_AesCfb8Encrypt
wc_AesCfbDecrypt
wc_AesCfbEncrypt
wc_AesDecryptDirect
wc_AesEncryptDirect
wc_AesFree
wc_AesGcmDecrypt
wc_AesGcmEncrypt
wc_AesGcmEncrypt_ex
wc_AesGcmSetExtIV
wc_AesGcmSetIV
wc_AesGcmSetKey
wc_AesGetKeySize
wc_AesInit
wc_AesInit_Id
wc_AesInit_Label
wc_AesKeyUnWrap
wc_AesKeyUnWrap_ex
wc_AesKeyWrap
wc_AesKeyWrap_ex
wc_AesSetIV
wc_AesSetKey
wc_AesSetKeyDirect
wc_AllocDer
wc_BufferKeyDecrypt
wc_BufferKeyEncrypt
wc_CertFree
wc_CertNew
wc_CertPemToDer
wc_ChaCha20Poly1305_CheckTag
wc_ChaCha20Poly1305_Decrypt
wc_ChaCha20Poly1305_Encrypt
wc_ChaCha20Poly1305_Final
wc_ChaCha20Poly1305_Init
wc_ChaCha20Poly1305_UpdateAad
wc_ChaCha20Poly1305_UpdateData
wc_Chacha_Process
wc_Chacha_SetIV
wc_Chacha_SetKey
wc_CheckCertSigPubKey
wc_CheckProbablePrime
wc_CheckProbablePrime_ex
wc_CreateEncryptedPKCS8Key
wc_CreatePKCS8Key
wc_CryptoCb_DefaultDevID
wc_CryptoCb_RegisterDevice
wc_CryptoCb_UnRegisterDevice
wc_DecryptPKCS8Key
wc_DerToPem
wc_DerToPemEx
wc_Des3Free
wc_Des3Init
wc_Des3_CbcDecrypt
wc_Des3_CbcDecryptWithKey
wc_Des3_CbcEncrypt
wc_Des3_CbcEncryptWithKey
wc_Des3_EcbEncrypt
wc_Des3_SetIV
wc_Des3_SetKey
wc_Des_CbcDecrypt
wc_Des_CbcDecryptWithKey
wc_Des_CbcEncrypt
wc_Des_CbcEncryptWithKey
wc_Des_EcbEncrypt
wc_Des_SetIV
wc_Des_SetKey
wc_DhAgree
wc_DhCheckKeyPair
wc_DhCheckPrivKey
wc_DhCheckPrivKey_ex
wc_DhCheckPubKey
wc_DhCheckPubKey_ex
wc_DhCheckPubValue
wc_DhCmpNamedKey
wc_DhCopyNamedKey
wc_DhExportParamsRaw
wc_DhGenerateKeyPair
wc_DhGenerateParams
wc_DhGetNamedKeyMinSize
wc_DhGetNamedKeyParamSize
wc_DhKeyDecode
wc_DhParamsLoad
wc_DhSetCheckKey
wc_DhSetKey
wc_DhSetKey_ex
wc_DhSetNamedKey
wc_Dh_ffdhe2048_Get
wc_ERR_print_errors_cb
wc_ERR_print_errors_fp
wc_ERR_remove_state
wc_EccKeyDerSize
wc_EccKeyToDer
wc_EccKeyToPKCS8
wc_EccPrivateKeyDecode
wc_EccPrivateKeyToDer
wc_EccPrivateKeyToPKCS8
wc_EccPublicKeyDecode
wc_EccPublicKeyDerSize
wc_EccPublicKeyToDer
wc_EccPublicKeyToDer_ex
wc_EncodeObjectId
wc_EncodeSignature
wc_EncryptPKCS8Key
wc_EncryptedInfoGet
wc_ErrorString
wc_FileExists
wc_FreeDecodedCert
wc_FreeDer
wc_FreeDhKey
wc_FreeMutex
wc_FreeRng
wc_FreeRsaKey
wc_FreeRwLock
wc_GenerateSeed
wc_GetCTC_HashOID
wc_GetDateAsCalendarTime
wc_GetDateInfo
wc_GetErrorString
wc_GetMutexCb
wc_GetPkcs8TraditionalOffset
wc_GetPubKeyDerFromCert
wc_GetSubjectRaw
wc_GetTime
wc_Gmac
wc_GmacSetKey
wc_GmacUpdate
wc_GmacVerify
wc_HKDF
wc_HKDF_Expand
wc_HKDF_Expand_ex
wc_HKDF_Extract
wc_HKDF_Extract_ex
wc_Hash
wc_HashFinal
wc_HashFree
wc_HashGetBlockSize
wc_HashGetDigestSize
wc_HashGetFlags
wc_HashGetOID
wc_HashInit
wc_HashInit_ex
wc_HashSetFlags
wc_HashTypeConvert
wc_HashUpdate
wc_Hash_ex
wc_HmacFinal
wc_HmacFree
wc_HmacInit
wc_HmacInit_Id
wc_HmacInit_Label
wc_HmacSetKey
wc_HmacSizeByType
wc_HmacUpdate
wc_InitAndAllocMutex
wc_InitCert
wc_InitCert_ex
wc_InitDecodedCert
wc_InitDhKey
wc_InitDhKey_ex
wc_InitMd5
wc_InitMd5_ex
wc_InitMutex
wc_InitRng
wc_InitRngNonce
wc_InitRngNonce_ex
wc_InitRng_ex
wc_InitRsaKey
wc_InitRsaKey_Id
wc_InitRsaKey_Label
wc_InitRsaKey_ex
wc_InitRwLock
wc_InitSha
wc_InitSha224
wc_InitSha224_ex
wc_InitSha256
wc_InitSha256_ex
wc_InitSha384
wc_InitSha384_ex
wc_InitSha3_224
wc_InitSha3_256
wc_InitSha3_384
wc_InitSha3_512
wc_InitSha512
wc_InitSha512_224
wc_InitSha512_224_ex
wc_InitSha512_256
wc_InitSha512_256_ex
wc_InitSha512_ex
wc_InitSha_ex
wc_KeyPemToDer
wc_LockMutex
wc_LockMutex_ex
wc_LockRwLock_Rd
wc_LockRwLock_Wr
wc_MakeCert
wc_MakeCertReq
wc_MakeCertReq_ex
wc_MakeCert_ex
wc_MakeRsaKey
wc_MakeSelfCert
wc_Md5Copy
wc_Md5Final
wc_Md5Free
wc_Md5GetFlags
wc_Md5GetHash
wc_Md5Hash
wc_Md5Hash_ex
wc_Md5SetFlags
wc_Md5Transform
wc_Md5Update
wc_OidGetHash
wc_PBKDF1
wc_PBKDF1_ex
wc_PBKDF2
wc_PBKDF2_ex
wc_PKCS12_PBKDF
wc_PKCS12_PBKDF_ex
wc_PKCS12_create
wc_PKCS12_free
wc_PKCS12_new
wc_PKCS12_parse
wc_PKCS7_AddCertificate
wc_PKCS7_AddRecipient_KARI
wc_PKCS7_AddRecipient_KEKRI
wc_PKCS7_AddRecipient_KTRI
wc_PKCS7_AddRecipient_ORI
wc_PKCS7_AddRecipient_PWRI
wc_PKCS7_AllowDegenerate
wc_PKCS7_DecodeAuthEnvelopedData
wc_PKCS7_DecodeEncryptedData
wc_PKCS7_DecodeEnvelopedData
wc_PKCS7_EncodeAuthEnvelopedData
wc_PKCS7_EncodeData
wc_PKCS7_EncodeEncryptedData
wc_PKCS7_EncodeEnvelopedData
wc_PKCS7_EncodeSignedData
wc_PKCS7_EncodeSignedData_ex
wc_PKCS7_EncodeSignedEncryptedFPD
wc_PKCS7_EncodeSignedFPD
wc_PKCS7_Free
wc_PKCS7_GetAttributeValue
wc_PKCS7_GetNoCerts
wc_PKCS7_GetPadSize
wc_PKCS7_GetSignerSID
wc_PKCS7_GetStreamMode
wc_PKCS7_Init
wc_PKCS7_InitWithCert
wc_PKCS7_New
wc_PKCS7_NoDefaultSignedAttribs
wc_PKCS7_PadData
wc_PKCS7_SetContentType
wc_PKCS7_SetDecodeEncryptedCb
wc_PKCS7_SetDecodeEncryptedCtx
wc_PKCS7_SetDefaultSignedAttribs
wc_PKCS7_SetDetached
wc_PKCS7_SetKey
wc_PKCS7_SetNoCerts
wc_PKCS7_SetOriDecryptCb
wc_PKCS7_SetOriDecryptCtx
wc_PKCS7_SetOriEncryptCtx
wc_PKCS7_SetPassword
wc_PKCS7_SetSignerIdentifierType
wc_PKCS7_SetStreamMode
wc_PKCS7_SetWrapCEKCb
wc_PKCS7_VerifySignedData
wc_PKCS7_VerifySignedData_ex
wc_PRF
wc_PRF_TLS
wc_PRF_TLSv1
wc_ParseCert
wc_PemCertToDer
wc_PemCertToDer_ex
wc_PemGetHeaderFooter
wc_PemPubKeyToDer
wc_PemPubKeyToDer_ex
wc_PemToDer
wc_Poly1305Final
wc_Poly1305SetKey
wc_Poly1305Update
wc_Poly1305_EncodeSizes
wc_Poly1305_EncodeSizes64
wc_Poly1305_MAC
wc_Poly1305_Pad
wc_PubKeyPemToDer
wc_RNG_GenerateBlock
wc_RNG_GenerateByte
wc_RNG_HealthTest
wc_RNG_HealthTest_ex
wc_RNG_TestSeed
wc_ReadDirClose
wc_ReadDirFirst
wc_ReadDirNext
wc_RsaEncryptSize
wc_RsaExportKey
wc_RsaFlattenPublicKey
wc_RsaFunction
wc_RsaKeyToDer
wc_RsaKeyToPublicDer
wc_RsaKeyToPublicDer_ex
wc_RsaPSS_CheckPadding
wc_RsaPSS_CheckPadding_ex
wc_RsaPSS_CheckPadding_ex2
wc_RsaPSS_Sign
wc_RsaPSS_Sign_ex
wc_RsaPSS_Verify
wc_RsaPSS_VerifyCheck
wc_RsaPSS_VerifyCheckInline
wc_RsaPSS_VerifyInline
wc_RsaPSS_VerifyInline_ex
wc_RsaPSS_Verify_ex
wc_RsaPrivateDecrypt
wc_RsaPrivateDecryptInline
wc_RsaPrivateDecryptInline_ex
wc_RsaPrivateDecrypt_ex
wc_RsaPrivateKeyDecode
wc_RsaPrivateKeyValidate
wc_RsaPublicEncrypt
wc_RsaPublicEncrypt_ex
wc_RsaPublicKeyDecode
wc_RsaPublicKeyDecodeRaw
wc_RsaPublicKeyDecode_ex
wc_RsaPublicKeyDerSize
wc_RsaSSL_Sign
wc_RsaSSL_Verify
wc_RsaSSL_VerifyInline
wc_RsaSSL_Verify_ex
wc_RsaSSL_Verify_ex2
wc_RsaSetRNG
wc_SetAuthKeyId
wc_SetAuthKeyIdFromCert
wc_SetAuthKeyIdFromPublicKey
wc_SetAuthKeyIdFromPublicKey_ex
wc_SetCustomExtension
wc_SetExtKeyUsage
wc_SetIssuer
wc_SetIssuerBuffer
wc_SetIssuerRaw
wc_SetKeyUsage
wc_SetLoggingHeap
wc_SetMutexCb
wc_SetSubject
wc_SetSubjectBuffer
wc_SetSubjectKeyId
wc_SetSubjectKeyIdFromPublicKey
wc_SetSubjectKeyIdFromPublicKey_ex
wc_SetSubjectRaw
wc_SetTimeCb
wc_Sha224Copy
wc_Sha224Final
wc_Sha224Free
wc_Sha224GetFlags
wc_Sha224GetHash
wc_Sha224Hash
wc_Sha224Hash_ex
wc_Sha224SetFlags
wc_Sha224Update
wc_Sha256Copy
wc_Sha256Final
wc_Sha256FinalRaw
wc_Sha256Free
wc_Sha256GetFlags
wc_Sha256GetHash
wc_Sha256Hash
wc_Sha256Hash_ex
wc_Sha256SetFlags
wc_Sha256Transform
wc_Sha256Update
wc_Sha384Copy
wc_Sha384Final
wc_Sha384FinalRaw
wc_Sha384Free
wc_Sha384GetFlags
wc_Sha384GetHash
wc_Sha384Hash
wc_Sha384Hash_ex
wc_Sha384SetFlags
wc_Sha384Update
wc_Sha3_224Hash
wc_Sha3_224Hash_ex
wc_Sha3_224_Copy
wc_Sha3_224_Final
wc_Sha3_224_Free
wc_Sha3_224_GetHash
wc_Sha3_224_Update
wc_Sha3_256Hash
wc_Sha3_256Hash_ex
wc_Sha3_256_Copy
wc_Sha3_256_Final
wc_Sha3_256_Free
wc_Sha3_256_GetHash
wc_Sha3_256_Update
wc_Sha3_384Hash
wc_Sha3_384Hash_ex
wc_Sha3_384_Copy
wc_Sha3_384_Final
wc_Sha3_384_Free
wc_Sha3_384_GetHash
wc_Sha3_384_Update
wc_Sha3_512Hash
wc_Sha3_512Hash_ex
wc_Sha3_512_Copy
wc_Sha3_512_Final
wc_Sha3_512_Free
wc_Sha3_512_GetHash
wc_Sha3_512_Update
wc_Sha3_GetFlags
wc_Sha3_SetFlags
wc_Sha512Copy
wc_Sha512Final
wc_Sha512FinalRaw
wc_Sha512Free
wc_Sha512GetFlags
wc_Sha512GetHash
wc_Sha512Hash
wc_Sha512Hash_ex
wc_Sha512SetFlags
wc_Sha512Transform
wc_Sha512Update
wc_Sha512_224Copy
wc_Sha512_224Final
wc_Sha512_224FinalRaw
wc_Sha512_224Free
wc_Sha512_224GetFlags
wc_Sha512_224GetHash
wc_Sha512_224Hash
wc_Sha512_224Hash_ex
wc_Sha512_224SetFlags
wc_Sha512_224Transform
wc_Sha512_224Update
wc_Sha512_256Copy
wc_Sha512_256Final
wc_Sha512_256FinalRaw
wc_Sha512_256Free
wc_Sha512_256GetFlags
wc_Sha512_256GetHash
wc_Sha512_256Hash
wc_Sha512_256Hash_ex
wc_Sha512_256SetFlags
wc_Sha512_256Transform
wc_Sha512_256Update
wc_ShaCopy
wc_ShaFinal
wc_ShaFinalRaw
wc_ShaFree
wc_ShaGetFlags
wc_ShaGetHash
wc_ShaHash
wc_ShaHash_ex

Sections

.text
Size: 886KB - Virtual size: 886KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 54KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/xxhash.dll
.dll windows:6 windows x64 arch:x64

Password: gameguard

fba6b233846a2ea5e6907e23b2de9a26

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\vcpkg\buildtrees\xxhash\x64-windows-rel\xxhash.pdb

Imports

vcruntime140

memcpy
__std_type_info_destroy_list
__C_specific_handler
memset

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_cexit
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_initialize_onexit_table
_initialize_narrow_environment

kernel32

GetCurrentThreadId
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
RtlCaptureContext
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess

Exports

Exports

XXH128
XXH128_canonicalFromHash
XXH128_cmp
XXH128_hashFromCanonical
XXH128_isEqual
XXH32
XXH32_canonicalFromHash
XXH32_copyState
XXH32_createState
XXH32_digest
XXH32_freeState
XXH32_hashFromCanonical
XXH32_reset
XXH32_update
XXH3_128bits
XXH3_128bits_digest
XXH3_128bits_reset
XXH3_128bits_reset_withSecret
XXH3_128bits_reset_withSecretandSeed
XXH3_128bits_reset_withSeed
XXH3_128bits_update
XXH3_128bits_withSecret
XXH3_128bits_withSecretandSeed
XXH3_128bits_withSeed
XXH3_64bits
XXH3_64bits_digest
XXH3_64bits_reset
XXH3_64bits_reset_withSecret
XXH3_64bits_reset_withSecretandSeed
XXH3_64bits_reset_withSeed
XXH3_64bits_update
XXH3_64bits_withSecret
XXH3_64bits_withSecretandSeed
XXH3_64bits_withSeed
XXH3_copyState
XXH3_createState
XXH3_freeState
XXH3_generateSecret
XXH3_generateSecret_fromSeed
XXH64
XXH64_canonicalFromHash
XXH64_copyState
XXH64_createState
XXH64_digest
XXH64_freeState
XXH64_hashFromCanonical
XXH64_reset
XXH64_update
XXH_versionNumber

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/zlib1.dll
.dll windows:6 windows x64 arch:x64

Password: gameguard

d879d2294039900ef484e0f01607f882

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\vcpkg\buildtrees\zlib\x64-windows-rel\zlib.pdb

Imports

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
memmove
memchr
memset
memcpy

api-ms-win-crt-stdio-l1-1-0

_wopen
_write
_read
_close
__stdio_common_vsprintf
_open
_lseeki64

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-runtime-l1-1-0

_errno
strerror
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_cexit

kernel32

DisableThreadLibraryCalls
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
InitializeSListHead
RtlCaptureContext
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter

Exports

Exports

adler32
adler32_combine
adler32_z
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine_gen
crc32_combine_op
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzfread
gzfwrite
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzvprintf
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
uncompress
uncompress2
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/zstd.dll
.dll windows:6 windows x64 arch:x64

Password: gameguard

163b42376483ef4dde972117fa0042a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\vcpkg\buildtrees\zstd\x64-windows-rel\lib\zstd.pdb

Imports

kernel32

InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
CloseHandle
GetLastError
WaitForSingleObject
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

vcruntime140

memset
memmove
memcmp
__C_specific_handler
__std_type_info_destroy_list
memcpy

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_beginthreadex
_seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
fflush
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

clock

Exports

Exports

ZDICT_addEntropyTablesFromBuffer
ZDICT_finalizeDictionary
ZDICT_getDictHeaderSize
ZDICT_getDictID
ZDICT_getErrorName
ZDICT_isError
ZDICT_optimizeTrainFromBuffer_cover
ZDICT_optimizeTrainFromBuffer_fastCover
ZDICT_trainFromBuffer
ZDICT_trainFromBuffer_cover
ZDICT_trainFromBuffer_fastCover
ZDICT_trainFromBuffer_legacy
ZSTD_CCtxParams_getParameter
ZSTD_CCtxParams_init
ZSTD_CCtxParams_init_advanced
ZSTD_CCtxParams_reset
ZSTD_CCtxParams_setParameter
ZSTD_CCtx_getParameter
ZSTD_CCtx_loadDictionary
ZSTD_CCtx_loadDictionary_advanced
ZSTD_CCtx_loadDictionary_byReference
ZSTD_CCtx_refCDict
ZSTD_CCtx_refPrefix
ZSTD_CCtx_refPrefix_advanced
ZSTD_CCtx_refThreadPool
ZSTD_CCtx_reset
ZSTD_CCtx_setCParams
ZSTD_CCtx_setFParams
ZSTD_CCtx_setParameter
ZSTD_CCtx_setParametersUsingCCtxParams
ZSTD_CCtx_setParams
ZSTD_CCtx_setPledgedSrcSize
ZSTD_CStreamInSize
ZSTD_CStreamOutSize
ZSTD_DCtx_getParameter
ZSTD_DCtx_loadDictionary
ZSTD_DCtx_loadDictionary_advanced
ZSTD_DCtx_loadDictionary_byReference
ZSTD_DCtx_refDDict
ZSTD_DCtx_refPrefix
ZSTD_DCtx_refPrefix_advanced
ZSTD_DCtx_reset
ZSTD_DCtx_setFormat
ZSTD_DCtx_setMaxWindowSize
ZSTD_DCtx_setParameter
ZSTD_DStreamInSize
ZSTD_DStreamOutSize
ZSTD_adjustCParams
ZSTD_cParam_getBounds
ZSTD_checkCParams
ZSTD_compress
ZSTD_compress2
ZSTD_compressBegin
ZSTD_compressBegin_advanced
ZSTD_compressBegin_usingCDict
ZSTD_compressBegin_usingCDict_advanced
ZSTD_compressBegin_usingDict
ZSTD_compressBlock
ZSTD_compressBound
ZSTD_compressCCtx
ZSTD_compressContinue
ZSTD_compressEnd
ZSTD_compressSequences
ZSTD_compressStream
ZSTD_compressStream2
ZSTD_compressStream2_simpleArgs
ZSTD_compress_advanced
ZSTD_compress_usingCDict
ZSTD_compress_usingCDict_advanced
ZSTD_compress_usingDict
ZSTD_copyCCtx
ZSTD_copyDCtx
ZSTD_createCCtx
ZSTD_createCCtxParams
ZSTD_createCCtx_advanced
ZSTD_createCDict
ZSTD_createCDict_advanced
ZSTD_createCDict_advanced2
ZSTD_createCDict_byReference
ZSTD_createCStream
ZSTD_createCStream_advanced
ZSTD_createDCtx
ZSTD_createDCtx_advanced
ZSTD_createDDict
ZSTD_createDDict_advanced
ZSTD_createDDict_byReference
ZSTD_createDStream
ZSTD_createDStream_advanced
ZSTD_createThreadPool
ZSTD_dParam_getBounds
ZSTD_decodingBufferSize_min
ZSTD_decompress
ZSTD_decompressBegin
ZSTD_decompressBegin_usingDDict
ZSTD_decompressBegin_usingDict
ZSTD_decompressBlock
ZSTD_decompressBound
ZSTD_decompressContinue
ZSTD_decompressDCtx
ZSTD_decompressStream
ZSTD_decompressStream_simpleArgs
ZSTD_decompress_usingDDict
ZSTD_decompress_usingDict
ZSTD_decompressionMargin
ZSTD_defaultCLevel
ZSTD_endStream
ZSTD_estimateCCtxSize
ZSTD_estimateCCtxSize_usingCCtxParams
ZSTD_estimateCCtxSize_usingCParams
ZSTD_estimateCDictSize
ZSTD_estimateCDictSize_advanced
ZSTD_estimateCStreamSize
ZSTD_estimateCStreamSize_usingCCtxParams
ZSTD_estimateCStreamSize_usingCParams
ZSTD_estimateDCtxSize
ZSTD_estimateDDictSize
ZSTD_estimateDStreamSize
ZSTD_estimateDStreamSize_fromFrame
ZSTD_findDecompressedSize
ZSTD_findFrameCompressedSize
ZSTD_flushStream
ZSTD_frameHeaderSize
ZSTD_freeCCtx
ZSTD_freeCCtxParams
ZSTD_freeCDict
ZSTD_freeCStream
ZSTD_freeDCtx
ZSTD_freeDDict
ZSTD_freeDStream
ZSTD_freeThreadPool
ZSTD_generateSequences
ZSTD_getBlockSize
ZSTD_getCParams
ZSTD_getDecompressedSize
ZSTD_getDictID_fromCDict
ZSTD_getDictID_fromDDict
ZSTD_getDictID_fromDict
ZSTD_getDictID_fromFrame
ZSTD_getErrorCode
ZSTD_getErrorName
ZSTD_getErrorString
ZSTD_getFrameContentSize
ZSTD_getFrameHeader
ZSTD_getFrameHeader_advanced
ZSTD_getFrameProgression
ZSTD_getParams
ZSTD_initCStream
ZSTD_initCStream_advanced
ZSTD_initCStream_srcSize
ZSTD_initCStream_usingCDict
ZSTD_initCStream_usingCDict_advanced
ZSTD_initCStream_usingDict
ZSTD_initDStream
ZSTD_initDStream_usingDDict
ZSTD_initDStream_usingDict
ZSTD_initStaticCCtx
ZSTD_initStaticCDict
ZSTD_initStaticCStream
ZSTD_initStaticDCtx
ZSTD_initStaticDDict
ZSTD_initStaticDStream
ZSTD_insertBlock
ZSTD_isError
ZSTD_isFrame
ZSTD_isSkippableFrame
ZSTD_maxCLevel
ZSTD_mergeBlockDelimiters
ZSTD_minCLevel
ZSTD_nextInputType
ZSTD_nextSrcSizeToDecompress
ZSTD_readSkippableFrame
ZSTD_registerSequenceProducer
ZSTD_resetCStream
ZSTD_resetDStream
ZSTD_sequenceBound
ZSTD_sizeof_CCtx
ZSTD_sizeof_CDict
ZSTD_sizeof_CStream
ZSTD_sizeof_DCtx
ZSTD_sizeof_DDict
ZSTD_sizeof_DStream
ZSTD_toFlushNow
ZSTD_versionNumber
ZSTD_versionString
ZSTD_writeSkippableFrame

Sections

.text
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
d3dcompiler_47.dll
.dll windows:10 windows x86 arch:x86

Password: gameguard

7f269ea2d96d8d376f2c7642ddadc7bc

Code Sign

33:00:00:04:91:64:62:f3:b7:3e:e2:0c:cd:00:00:00:00:04:91
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:47

Not After

11/05/2023, 20:47

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c5:2f:2c:ef:c1:ff:cb:1d:a4:74:54:24:92:77:1b:44:ab:2a:fc:2e:3a:f7:4c:b7:7c:28:32:f4:57:06:82:80
Signer

Actual PE Digest

c5:2f:2c:ef:c1:ff:cb:1d:a4:74:54:24:92:77:1b:44:ab:2a:fc:2e:3a:f7:4c:b7:7c:28:32:f4:57:06:82:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D3DCompiler_47.pdb

Imports

kernel32

WriteFile
FreeLibrary
Sleep
TlsAlloc
TlsSetValue
HeapDestroy
TlsGetValue
TlsFree
GetFullPathNameW
GetFullPathNameA
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
GetProcAddress
LoadLibraryExW
SetLastError
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetStdHandle
GetFileType
GetStartupInfoW
RaiseException
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleW
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetEnvironmentStringsW
ReadFile
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetModuleFileNameW
ReadConsoleW
HeapSize
HeapReAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
RtlUnwind
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
LocalAlloc
LocalFree
GetFileSizeEx
GetLastError
CreateFileW
HeapFree
GetProcessHeap
UnmapViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetFileAttributesW
SetFileAttributesW
DeleteFileW
SetEndOfFile
DeviceIoControl
MapViewOfFileEx
CreateFileMappingA
ExpandEnvironmentStringsW
HeapAlloc
OutputDebugStringA
CloseHandle
LeaveCriticalSection
EnterCriticalSection
lstrcmpiA
HeapCreate
GetModuleFileNameA
CreateFileA
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
FindClose
FindFirstFileExW
FindNextFileW
GetCommandLineA
GetCommandLineW
GetDriveTypeW
GetCurrentDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
MultiByteToWideChar
FreeEnvironmentStringsW
DisableThreadLibraryCalls

advapi32

CryptDestroyHash
CryptAcquireContextW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
CryptGetHashParam
CryptCreateHash
CryptHashData
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
CryptReleaseContext

rpcrt4

UuidCreate

Exports

Exports

D3DAssemble
D3DCompile
D3DCompile2
D3DCompileFromFile
D3DCompressShaders
D3DCreateBlob
D3DCreateFunctionLinkingGraph
D3DCreateLinker
D3DDecompressShaders
D3DDisassemble
D3DDisassemble10Effect
D3DDisassemble11Trace
D3DDisassembleRegion
D3DGetBlobPart
D3DGetDebugInfo
D3DGetInputAndOutputSignatureBlob
D3DGetInputSignatureBlob
D3DGetOutputSignatureBlob
D3DGetTraceInstructionOffsets
D3DLoadModule
D3DPreprocess
D3DReadFileToBlob
D3DReflect
D3DReflectLibrary
D3DReturnFailure1
D3DSetBlobPart
D3DStripShader
D3DWriteBlobToFile
DebugSetMute

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 38KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: gameguard

Password: gameguard

d23845f7e2c02b1e4c42d565033f24b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

libcef

user32

mscoree

Exports

Exports

Sections

.text Size: 635KB - Virtual size: 634KB

.rdata Size: 674KB - Virtual size: 673KB

.data Size: 17KB - Virtual size: 29KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 34KB - Virtual size: 33KB

Password: gameguard

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 64KB - Virtual size: 64KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 12B

Password: gameguard

26bb2ecdbddc12d64783983d93e989a5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

kernel32

Exports

Exports

Sections

.text Size: 101KB - Virtual size: 101KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 100B

Password: gameguard

0fc90ed65bdfb6bd41f1d230f0355fe5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

kernel32

advapi32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

.text
Size: 635KB - Virtual size: 634KB

.rdata
Size: 674KB - Virtual size: 673KB

.data
Size: 17KB - Virtual size: 29KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 34KB - Virtual size: 33KB

.text
Size: 64KB - Virtual size: 64KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 101KB - Virtual size: 101KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 100B

.text
Size: 886KB - Virtual size: 886KB

.rdata
Size: 231KB - Virtual size: 231KB

.data
Size: 8KB - Virtual size: 34KB

.pdata
Size: 54KB - Virtual size: 53KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 35KB - Virtual size: 34KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 44B

.text
Size: 53KB - Virtual size: 53KB

.rdata
Size: 27KB - Virtual size: 27KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 108B