c3a8fb73c92ce9a2d98268b8e9f693f05dcf936ba7ed5649ea1ad46abac27444
- SHA256 c3a8fb73c92ce9a2d98268b8e9f693f05dcf936ba7ed5649ea1ad46abac27444
Overview
overview
10Static
static
10Monster Hu...er.exe
windows10-2004-x64
1Monster Hu...er.exe
windows11-21h2-x64
1nativePC/p...ss.dll
windows10-2004-x64
1nativePC/p...ss.dll
windows11-21h2-x64
1hid.dll
windows10-2004-x64
1hid.dll
windows11-21h2-x64
1loader.dll
windows10-2004-x64
1loader.dll
windows11-21h2-x64
1nativePC/p...er.dll
windows10-2004-x64
1nativePC/p...er.dll
windows11-21h2-x64
1nativePC/p...er.dll
windows10-2004-x64
1nativePC/p...er.dll
windows11-21h2-x64
1Behavioral task
behavioral1
Sample
Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
nativePC/plugins/!CRCBypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
nativePC/plugins/!CRCBypass.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
hid.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
hid.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
loader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
loader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
nativePC/plugins/MonsterLoader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
nativePC/plugins/MonsterLoader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
nativePC/plugins/QuestLoader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
nativePC/plugins/QuestLoader.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target c3a8fb73c92ce9a2d98268b8e9f693f05dcf936ba7ed5649ea1ad46abac27444
- Size 1.0MB
- Sample260527-tk1prsbx3l
- SHA256 c3a8fb73c92ce9a2d98268b8e9f693f05dcf936ba7ed5649ea1ad46abac27444
- MD5 350f7c4ededbc00ce3eae52a75be5b69
- SHA1 b332891ebd1bdecdf62448eba6d5c1e6f192c2cf
- SHA512 9ab56c09f29c02813c6afce9821e1467febba300ec2e99cd9abde93b5280fa1a16fdb1b929c0a39f7b3a4056abfa4ea73aa3e1adc31314a5de842037e33a83f5
- SSDEEP 24576:zGoXHMgyweb8eGxniK4lJeWi3YyKvGDXPBHkKzK62IIMH:9cgleLuiFOWioyeeXPhkKn2If
- TLSH T17E35331F053B2849E4B1F219EB6F0076FDE25DB534DB57A20B49026561B20EE398CF6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- r77 rootkit payload 1 IoCs
Detects the payload of the r77 rootkit.
resource yara_rule static1/unpack001/Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe r77_payload - Unsigned PE 6 IoCs
Checks for missing Authenticode signature.
resource unpack001/Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe unpack002/nativePC/plugins/!CRCBypass.dll unpack003/hid.dll unpack003/loader.dll unpack003/nativePC/plugins/MonsterLoader.dll unpack003/nativePC/plugins/QuestLoader.dll
File Explorer
-
c3a8fb73c92ce9a2d98268b8e9f693f05dcf936ba7ed5649ea1ad46abac27444.rar 1.0MB
-
Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe.exe 1.6MB
-
前置/2021 Patch-3473-1-7-1609952513.zip.zip 34KB
-
nativePC/plugins/!CRCBypass.dll.dll 74KB
-
前置/Stracker's Loader-1982-2-2-1-1623184044.zip.zip 705KB
-
hid.dll.dll 233KB
-
loader-config.json127B
-
loader.dll.dll 393KB
-
nativePC/plugins/MonsterLoader.dll.dll 23KB
-
nativePC/plugins/QuestLoader.dll.dll 55KB
-
有问题点我！安装教程！.png.png 57KB
Monster Hunter World v20200109-v20210602 Plus 67 Trainer.exe
- IMPHASH 304797a34e6ebd747aa74fdb92523157
- SHA256 f5e0c4f0ef809417d2fcde05fcc037308a323383226169c56912ae401e996bab
- MD5 eb3295617d26a4902d2c51fc8ca4c9b7
- SHA1 c1cc56cac046678b5373ff473da1560b35cd4ca6
- SHA512 f3fc1575075da3c875cb80e4d414a161d2c84be00febb7dacdfeab0f783117fd09984a95f5cf5863ccfa60069492a5e0313d183e01febb54b8b630ed3274eb66
- SSDEEP 24576:K9SxXI1fDRUbRa/9ghKUU6F9UK3/fsA9SPQaPECkDtGQjnEdfDSKk:crWCOhKOUKMA9qT/kwonn
- TLSH T19975AD5A779842F8E0779138C5538647F2B274061B718BDF13A847BB2F277A04E7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
r77 rootkit payload
Detects the payload of the r77 rootkit.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
220248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
CloseHandle
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
Sleep
GetCurrentProcessId
LoadLibraryW
GetProcAddress
WaitNamedPipeW
GetLastError
CreateFileW
ReadFile
WriteFile
GetModuleHandleA
LoadLibraryA
GetPrivateProfileStringW
WritePrivateProfileStringW
GetModuleHandleW
FindResourceW
LoadResource
SizeofResource
LockResource
GetFileAttributesW
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
MultiByteToWideChar
WinExec
GetCurrentProcess
IsWow64Process
SetLastError
ResumeThread
WaitForSingleObject
GetTempPathW
CreateDirectoryW
RaiseException
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
HeapReAlloc
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LocalFree
WideCharToMultiByte
GetStringTypeW
DuplicateHandle
WaitForSingleObjectEx
SwitchToThread
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SetEvent
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwindEx
RtlPcToFileHeader
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
ExitThread
GetStdHandle
HeapFree
HeapAlloc
SetFilePointerEx
FlushFileBuffers
GetConsoleCP
GetConsoleMode
user32
MessageBoxA
MessageBoxW
shell32
SHGetFolderPathW
oleaut32
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCreateVector
SafeArrayDestroy
mscoree
CorBindToRuntime
CLRCreateInstance
wininet
InternetReadFile
InternetOpenUrlA
InternetOpenA
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
PlaySoundW
Name
.text
Size
485KB
Virtual Size
484KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
211KB
Virtual Size
211KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
12KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
887KB
Virtual Size
886KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=26715,
count=20, id=260, version=26715,
count=179, id=261, version=26715,
count=9, id=259, version=26706,
count=36, id=260, version=26706,
count=126, id=261, version=26706,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=15, id=257, version=26715,
count=181, id=1, productName=Unmarked objects,
count=17, id=265, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
前置/2021 Patch-3473-1-7-1609952513.zip
- SHA256 6318d3fccc995cccd002aeff66c77430c36e1a021d9bc15f1a88745331759493
- MD5 b4ee2d9f7180f5f672728972bf698f18
- SHA1 98830f1a1fc562bb59ba60b8b13a1f885cf318a1
- SHA512 464b1fc72ffeddf1d9a50b03370ceb0412a3216ee4bc41c39f4d1f5c711e83a7484f08af0988bfe2ad7fc7b53175c1b6f4642cf9dc013ae771cd92a6965f8276
- SSDEEP 768:IQekboKrFl4I0zmaVSedRNGzBNUN7lVFQ2g3oj:IQek34I0zRVScN60lLEoj
- TLSH T19AF2F2853A6F7366F05DDD3C62E4B3F527BA020833148A95B815229FDC02DA61FF6B61
- MD5 SHA1 SHA512 SSDEEP TLSH
nativePC/plugins/!CRCBypass.dll
- IMPHASH 5246fee7e9ed047cc7c0186a924bc494
- SHA256 44c56884e9554c8ffcb0f445ff16239ac3f1752dca855092884770903e1f7569
- MD5 4c3118388abfbd864a62d664702fd142
- SHA1 a719ba006dd0844ff40d15242cfd15fb51fbd7b9
- SHA512 d43e8fe01e1728e235fc94069533ebe43acae7fde6ae16a71f0b4a04122f1b92f18a7d8577c2822ef639cc84709436e2275e5608e94f41e75eb967af2b447769
- SSDEEP 1536:OnHBO0rV4h5G0lBoPsxc8qWBSmjykhbOOVgOKKp9YwF:8rV4h8kBqkd3VJKKp9YO
- TLSH T197736C6B760900B9D07B907CCA9B6E06E371B42517128BCF27A0134A2F67BE55E7E371
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
50460
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
G:\Tools\MHW Stracker Plugin\Plugins\!CRCBypass\x64\Release\!CRCBypass.pdb
loader
??0LOG@loader@@QEAA@W4LogLevel@1@@Z
?MinLogLevel@loader@@3W4LogLevel@1@A
??1LOG@loader@@QEAA@XZ
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
VirtualProtect
GetCurrentProcess
GetModuleHandleA
K32GetModuleInformation
VirtualQuery
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeSListHead
TerminateProcess
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?uncaught_exception@std@@YA_NXZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strxfrm
?id@?$ctype@D@std@@2V0locale@2@A
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??0_Locinfo@std@@QEAA@PEBD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__C_specific_handler
__current_exception_context
__std_type_info_destroy_list
strchr
__std_terminate
__std_exception_copy
__std_exception_destroy
__current_exception
memmove
memcmp
memcpy
memset
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
realloc
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_crt_atexit
_seh_filter_dll
terminate
_initialize_onexit_table
_initterm_e
_invalid_parameter_noinfo_noreturn
_initterm
_cexit
_configure_narrow_argv
_initialize_narrow_environment
_register_onexit_function
?onLoad@@YAXXZ
Name
.text
Size
50KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=28117,
count=2, id=259, version=28117,
count=19, id=261, version=28117,
count=6, id=257, version=28117,
count=2, id=257, version=26715,
count=3, id=257, productName=VS2019 v16.4.4 build 28316, version=28316,
count=104, id=1, productName=Unmarked objects,
count=1, id=265, version=28316,
count=1, id=256, productName=VS2019 v16.4.4 build 28316, version=28316,
count=1, id=255, productName=VS2019 v16.4.4 build 28316, version=28316,
count=1, id=258, productName=VS2019 v16.4.4 build 28316, version=28316,
前置/Stracker's Loader-1982-2-2-1-1623184044.zip
- SHA256 0f4b31b8ab66e9dab7a83b51ece113ca7a66ef430b94eed55300e721a605f00e
- MD5 8dec90b4346fcb35f2f0b9a6253583ca
- SHA1 8df22252d6c28efb9825024c622463b277b20878
- SHA512 ce0bf48474c2196f46e5ab5778a2a881fb21d70b2bec2032bae1765ccc9e257dd2c5bf15eb87f04877573fc7f402e3ce65d98e00aeaf0fb683e15cfd23404bfd
- SSDEEP 12288:DyM/62x5SUTfN+QII33JOoYtYsUvBAbimprYMOQHeDoaZZZZZZZZu0sh/S:DyM/dnSUTfNtIIJOtOsUvebimprZOQHe
- TLSH T1CFE48D1AF66408B9E8B38138C9735A46E7B27C5A0770CBEF13A0461A5F37BD0593E761
- MD5 SHA1 SHA512 SSDEEP TLSH
hid.dll
- IMPHASH ca252c84d154bbc8cac6addb4807108a
- SHA256 8b4f03f543cb8478fdfd4b9c1bab6e45f867a04035e3eb87411d41514b8e2691
- MD5 e768f92f24f678454d47bb91a74decb1
- SHA1 df37ed24e8d445a7ca5609312b85a101ef73b765
- SHA512 51a7cea9bcd5c15cbaf307646945e83466e5f05b5019dbea687a379cd73998d8741bddf01c4a1360db095e8025c44f6a5490ccd1db590cfe062115ca4734c6af
- SSDEEP 6144:cIVBM8hrQHGnvElULHDohIZZZZZZZZNI:cYMOQHeDoaZZZZZZZZu
- TLSH T153346B5977A90CB9EC778139CC530A06E7B378660771DAAF03A0425ADF2F7D0653AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
27188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\MHW-QuestLoader\x64\Release\injector.pdb
kernel32
VirtualProtect
HeapFree
SetLastError
VirtualFree
VirtualAlloc
LoadLibraryA
GetNativeSystemInfo
HeapAlloc
GetProcAddress
GetProcessHeap
FreeLibrary
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
CloseHandle
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
Name
.text
Size
137KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
77KB
Virtual Size
77KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=19, id=260, version=27412,
count=173, id=261, version=27412,
count=14, id=260, version=28920,
count=10, id=259, version=28920,
count=68, id=261, version=28920,
count=3, id=257, version=27412,
count=100, id=1, productName=Unmarked objects,
count=2, id=265, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
loader-config.json
- SHA256 d1a602cbcb6615ef6bd41c5e174baf442a06f140042479cc9e35d30953d26999
- MD5 85546697c88ec4fcefd6dd90dccb785d
- SHA1 47d350ac88c5e7f6fb5119ab693fc6a3de98c47b
- SHA512 cad22d6cee679649b73bd548783b3524ca6cdf9413fc54d21cccc8aade2e918893ed1b6e4fca7aa7fffb65a8d15874ec0b69e5a8abb24a71235258a77b030233
- TLSH T14AB09B11470D14BF16B1604490D4544323104F5511717C67F2BF45145433A377AA1F51
- MD5 SHA1 SHA512 TLSH
loader.dll
- IMPHASH 10a7e78d81a06850f52158277b31cfcd
- SHA256 5526f5e85d66d414675ccbb44a6bfc4628df5f4860ced24d75538c23fda375a6
- MD5 751468ca991216661cabb84ae207342f
- SHA1 4dc027f30b0619feb67aae191eeb21c61182becc
- SHA512 cbccb1f4d6c37567d074c2f435c9bedf240a33a96b455aafb251c9e96779c283bc9e1235aaefbe31ee843eb1bfc0ec652c9dda0316a210fd550debdd9ce11fcb
- SSDEEP 12288:6yM/62x5SUTfN+QII33JOoYtYsUvBAbimp:6yM/dnSUTfNtIIJOtOsUvebimp
- TLSH T15A847C1AF65404BDE0B78138C9779A46E7B27C5A07608AEF23A406162F73FE09D3E751
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
110164
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\MHW-QuestLoader\x64\Release\loader.pdb
kernel32
LoadLibraryA
GetProcAddress
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
WriteConsoleA
AllocConsole
VirtualProtect
GetCurrentProcess
GetModuleHandleA
K32GetModuleInformation
VirtualQuery
WriteConsoleW
HeapSize
HeapFree
SetLastError
VirtualFree
VirtualAlloc
GetNativeSystemInfo
HeapAlloc
GetProcessHeap
FreeLibrary
IsBadReadPtr
FormatMessageA
LocalFree
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetEndOfFile
SetFilePointerEx
AreFileApisANSI
CloseHandle
GetLastError
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetFileSizeEx
GetFileType
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
GetTimeZoneInformation
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
RtlUnwind
user32
MessageBoxA
??0LOG@loader@@QEAA@W4LogLevel@1@@Z
??1LOG@loader@@QEAA@XZ
?GameVersion@loader@@3PEBDEB
?MinLogLevel@loader@@3W4LogLevel@1@A
?__autoclassinit2@LOG@loader@@QEAAX_K@Z
Initialize
Name
.text
Size
267KB
Virtual Size
267KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
100KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
148B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=27412,
count=19, id=260, version=27412,
count=176, id=261, version=27412,
count=14, id=260, version=28920,
count=10, id=259, version=28920,
count=72, id=261, version=28920,
count=5, id=257, version=27412,
count=127, id=1, productName=Unmarked objects,
count=5, id=265, version=29112,
count=1, id=256, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
nativePC/plugins/MonsterLoader.dll
- IMPHASH 959df1ddf1642ac3c6adbfa28a5549e5
- SHA256 5db748df6f9f0f4f12a5237360f1b4111baa30ad58b5e2a843bdd93d06279027
- MD5 192a103f2e97d763da3aa9b12b89a375
- SHA1 f73e27cd3bff3f4f069ff6b2820082c16712a729
- SHA512 d82733675e5f7ca84bcca1c57115dd7beb29baa345cfd5e9c6825df823b81c9910c1918a94bdc325849d9015eb37c0ef0b4ed933bd703a302c805ff0f0aa635e
- SSDEEP 384:owuiS/L6XbiQjBk/sRNlxo37Z6bswZYLBAqm99EgVlwbL+XWGl:xS/LebiqVx6csnBAqrd3ERl
- TLSH T13FB25B1BFB4649EAD552E0B8C1A7AA0DD2F2B5190B20C7CF13509A6E1FA37D16939703
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
12868
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\MHW-QuestLoader\x64\Release\MonsterLoader.pdb
loader
??0LOG@loader@@QEAA@W4LogLevel@1@@Z
?MinLogLevel@loader@@3W4LogLevel@1@A
?GameVersion@loader@@3PEBDEB
??1LOG@loader@@QEAA@XZ
msvcp140
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
memmove
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
__std_type_info_destroy_list
memcmp
memcpy
memset
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_cexit
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
kernel32
InitializeSListHead
HeapAlloc
CloseHandle
HeapReAlloc
Sleep
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
GetCurrentThreadId
Thread32First
Thread32Next
GetCurrentProcess
HeapFree
VirtualProtect
HeapCreate
IsDebuggerPresent
GetCurrentProcessId
FlushInstructionCache
SetThreadContext
OpenThread
GetSystemTimeAsFileTime
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetThreadContext
Name
.text
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
72B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=261, version=28920,
count=8, id=260, version=28920,
count=3, id=259, version=28920,
count=6, id=257, version=28920,
count=3, id=257, productName=VS2019 v16.7.5 build 29112, version=29112,
count=2, id=257, version=27412,
count=89, id=1, productName=Unmarked objects,
count=5, id=265, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
nativePC/plugins/QuestLoader.dll
- IMPHASH da5b941fe141506aaaf96fe402b851ff
- SHA256 11d55f7aaf1850ec97865ebf6e9190792f149e37ced80b805c9284f7903b3311
- MD5 1f614e4e1757a8a02fe56d885bfcd760
- SHA1 c4a22b29dc30dab34c3ef19dfeb178e9658e43bd
- SHA512 d777b12e80755acc58a3b970f8472b0f6463b52f18b89aa3eccf3b1c35ce0b3d4128feee6a26a691eeb3eb63091e89c817103f2cd7e58abcdbd60867d6dfb2bd
- SSDEEP 768:Tm9hM6P6YyEm2kWJuXHRsGs5zC7OzLh4NbxVlZ+1D2QMf4MPUi6h9v+nwyvG:q8UmKJex5Mh4Nbxpq27Pcz+wy
- TLSH T10F437C5F76A800F8D562E13CDAA3AA43D673B846172087CF1350A62B2F737D16D7A361
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
37124
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\Dev\MHW-QuestLoader\x64\Release\QuestLoader.pdb
loader
??0LOG@loader@@QEAA@W4LogLevel@1@@Z
?MinLogLevel@loader@@3W4LogLevel@1@A
?GameVersion@loader@@3PEBDEB
??1LOG@loader@@QEAA@XZ
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?uncaught_exception@std@@YA_NXZ
?_Syserror_map@std@@YAPEBDH@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_exception_destroy
__std_exception_copy
__std_terminate
__C_specific_handler
_CxxThrowException
memset
__std_type_info_destroy_list
memcpy
memcmp
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsscanf
__stdio_common_vsprintf_s
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_seh_filter_dll
terminate
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
kernel32
GetCurrentProcess
SetLastError
GetLastError
AreFileApisANSI
GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindClose
CreateFileW
FormatMessageA
LocalFree
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualFree
OpenThread
SetThreadContext
FlushInstructionCache
GetModuleHandleW
GetCurrentProcessId
GetProcAddress
GetThreadContext
HeapAlloc
CloseHandle
HeapReAlloc
Sleep
CreateToolhelp32Snapshot
ResumeThread
SuspendThread
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCurrentThreadId
Thread32First
Thread32Next
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WideCharToMultiByte
MultiByteToWideChar
VirtualProtect
HeapCreate
api-ms-win-crt-math-l1-1-0
ceilf
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=260, version=28920,
count=3, id=259, version=28920,
count=19, id=261, version=28920,
count=6, id=257, version=28920,
count=3, id=257, productName=VS2019 v16.7.5 build 29112, version=29112,
count=2, id=257, version=27412,
count=133, id=1, productName=Unmarked objects,
count=5, id=265, version=29112,
count=1, id=255, productName=VS2019 v16.7.5 build 29112, version=29112,
count=1, id=258, productName=VS2019 v16.7.5 build 29112, version=29112,
有问题点我！安装教程！.png
- SHA256 ed13de353092aecb37b259c17213cc7cf6d952958ac40b827798b124ffe0777e
- MD5 5c63248e32e7b24caa556e4daadd4b40
- SHA1 5e73b6dc9549b4d54c976df040c7b261d09e5334
- SHA512 3d737e0c68242165a564edd5350d8d2328d2ba418f8ee339a37e9bf7fc8297ed718b68c868a45f80cfc213c8201af0f0a0a2c63fa8662079e487129d213f6dc9
- SSDEEP 1536:QjcaAicSIRKFOduiRO8LAuqeg5mQxjeGPSP6:QjX6XRKFiUp5mfGP5
- TLSH T1804302841F4842EE8A57C6D7207E4A29E0CB42F547DDC6E08612F8980B78791EB5F467
- MD5 SHA1 SHA512 SSDEEP TLSH
Extracted URLs
-
qr https://ssp.njxzwh.com/wp/redirect