Client_Game_TTDL.zip
- SHA256 ee85b1e78c1bbbb6567f509525d0f55f3db725e72ad61c398b5848c2fb208970
Overview
overview
8Static
static
3Client_Gam...AT.bat
windows10-2004-x64
8Client_Gam...AT.bat
windows11-ltsc_2024-x64
8Client_Gam...65.dll
windows10-2004-x64
3Client_Gam...65.dll
windows11-ltsc_2024-x64
3Client_Gam...AT.bat
windows10-2004-x64
3Client_Gam...AT.bat
windows11-ltsc_2024-x64
3Client_Gam...er.bat
windows10-2004-x64
3Client_Gam...er.bat
windows11-ltsc_2024-x64
3Client_Gam...ng.exe
windows10-2004-x64
3Client_Gam...ng.exe
windows11-ltsc_2024-x64
3Client_Gam...er.exe
windows10-2004-x64
3Client_Gam...er.exe
windows11-ltsc_2024-x64
3Client_Gam...me.bat
windows10-2004-x64
3Client_Gam...me.bat
windows11-ltsc_2024-x64
3Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral5
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral8
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral9
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/FlashPlayer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral12
Sample
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/FlashPlayer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral13
Sample
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/StartGame.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target Client_Game_TTDL.zip
- Size 12.8MB
- Sample260807-wtly3stxev
- SHA256 ee85b1e78c1bbbb6567f509525d0f55f3db725e72ad61c398b5848c2fb208970
- MD5 5a7b6d850dad13ebd509947165d1dcad
- SHA1 3f016119d861fdb70b208518aaab02dd0eb2a0e1
- SHA512 2eb4162e4af8241bb391b3dcf64fa68f07db886cad4d7a1bda4c6ed45b4baf05f15fd7b8513ca89bc06360b2abd758a55e27c187d769a5802972b991ae1d0f69
- SSDEEP 196608:sunvImrRnlQKTPnnF1PMgmPwSDGaUFpABOr/7XJ81UVeu63X6p94kknASyyb+NM2:uy/TPpmYbaUfMk/7XvV/ecWAvyblAL
- TLSH T14DD633E67B4340FFDF4C6E72261AE28A770E42954799048F871EC4FED061AA1056EECD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.ocx
File Explorer
-
Client_Game_TTDL.zip.zip 12.8MB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat.bat 16KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.ocx.dll 9.2MB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat.bat 2KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/HUONG_DAN_CAI_DAT.txt3KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat.bat 4KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe.exe 137KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/config.ini119B
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/config.xml378B
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/login.swf188KB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/logo.png.png 1.6MB
-
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/version.ini14B
-
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/FlashPlayer.exe.exe 15.2MB
-
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/StartGame.bat.bat .vbs 878B
-
Client_Game_TTDL/TruyenThuyetDoLong/README_CLIENT.txt1KB
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/CAI_DAT.bat
- SHA256 d41d54ed544a80968d0e906ad4a2472719687cd056492320bd38c3d6d13fabb9
- MD5 4fed1aaf79239ee91bcbfd5dbbcd0002
- SHA1 e3e95bad21cd71dbb3eee48ab7be70ce52746f0c
- SHA512 d7e6e5a413c7163b1355fa27ffe910f31256d731b50a47fb5db4c725d32dbe27776b0eaea9eb3690d5fc96296620243fa09b610b3c914d74891a10ac72d60a52
- SSDEEP 384:QRqSGzQeF63qwOh4dMEf7tpCO6u630BNy0ICpIQ/xODvNI5hl5p3eVD9sCDJY861:Qyh1O1pnPZ46hhm6sHJQ
- TLSH T10F7293033E0146068D70E6E05F7A4166EB4A8187833791D9306FB2AAB35F34B97ED7C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Flash32_11_4_402_265.ocx
- IMPHASH 025a8a4fc771435437c57b25fd091eaa
- SHA256 f5829c373011d9bcf88e26829dc900eb4faac99b1a07511dc974ffe9080bd1f6
- MD5 c7d41058eeb57f425fbd1585f9de71c4
- SHA1 88fdd76afdc2a1198103e8f4dd416d54c3ab89d0
- SHA512 0492c58a37357d575ee17ce1a63fb07b7bf0b7876aa5d19d6eb5f568f740c50cbbb5af4c1ab686d57116f79dca99c8b9a01aeba704a59d1f2e3495e79dbc5f48
- SSDEEP 196608:+0iIptsRKRkW3pti7pCtfmsAq/8iRhOe/zoxKmVGOts2AGeusYOV:+0HptoK/5ts4fmHiRhOeLgKmVGOts2AR
- TLSH T1DBA6CF23A7D1C0B6D09324F15137B76FA9FC6B21077499CBABC05865AA703D1963A38F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
41:04:d4:a9:d7:fc:80:75:1c:b8:74:2d:93:2b:61:f5:d7:3a:f0:f8
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Chains
Aug 15, 2012
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US
Serial Number
15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 15, 2010 - Dec 14, 2012
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
6869605
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
Flash.pdb
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
winmm
waveOutGetPosition
waveInOpen
waveInPrepareHeader
waveInReset
waveInUnprepareHeader
waveInClose
waveOutOpen
waveInStop
waveInAddBuffer
waveInStart
waveOutClose
waveOutReset
waveInGetNumDevs
mixerSetControlDetails
waveInGetPosition
timeKillEvent
timeSetEvent
timeGetTime
timeEndPeriod
timeBeginPeriod
waveOutWrite
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutGetDevCapsW
waveInGetDevCapsW
waveOutGetNumDevs
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
timeGetDevCaps
wininet
InternetOpenA
InternetConnectA
HttpOpenRequestA
InternetSetOptionW
HttpSendRequestA
InternetReadFile
InternetCloseHandle
crypt32
CryptDecodeObjectEx
CertFindRDNAttr
CertRDNValueToStrW
CryptFindOIDInfo
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCompareCertificate
CertVerifyTimeValidity
CertVerifyRevocation
CertOpenStore
CertAddStoreToCollection
CryptVerifyMessageSignature
CryptGetMessageCertificates
CertCreateCertificateContext
CertNameToStrW
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
rpcrt4
UuidToStringA
RpcStringFreeA
oleaut32
SysStringLen
SysStringByteLen
VariantInit
VariantClear
SysAllocString
SysAllocStringLen
VariantChangeType
UnRegisterTypeLi
RegisterTypeLi
VarUI4FromStr
LoadRegTypeLi
SysFreeString
LoadTypeLi
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
SafeArrayCreateVector
SafeArrayLock
SafeArrayUnlock
SysAllocStringByteLen
VarBstrCat
OleCreatePropertyFrame
dsound
ord1
ord8
msimg32
AlphaBlend
kernel32
LoadLibraryW
CreateMutexW
RaiseException
lstrcmpiW
FlushInstructionCache
GetCurrentProcess
MulDiv
GlobalUnlock
GlobalLock
LocalFree
LocalAlloc
SetFileAttributesA
GetFileAttributesA
GetModuleFileNameA
GetVersionExA
GetModuleFileNameW
GetCurrentThreadId
OutputDebugStringW
SetLastError
DisableThreadLibraryCalls
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetLocaleInfoW
GetTickCount
LCMapStringW
CreateProcessA
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
LoadLibraryA
CreateFileW
CreateDirectoryW
GetProcessTimes
GetCurrentProcessId
GlobalSize
GetTempFileNameW
GetSystemInfo
GetUserDefaultUILanguage
MoveFileExW
VirtualQuery
GetUserDefaultLangID
DeleteFileA
CreateFileA
WriteFile
SetFilePointer
VerifyVersionInfoW
VerSetConditionMask
CreateThread
ReadFile
GetFileSize
LockResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
GetTimeZoneInformation
ReleaseSemaphore
CreateSemaphoreW
GetSystemDirectoryW
ExpandEnvironmentStringsA
GetTempFileNameA
GetTempPathA
CreateDirectoryA
CreateMutexA
SetFilePointerEx
GetCurrentDirectoryW
SetCurrentDirectoryW
ExpandEnvironmentStringsW
OutputDebugStringA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
TerminateThread
SetThreadPriority
GetSystemDirectoryA
lstrcpyA
CompareFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
SwitchToThread
DeviceIoControl
CreateSemaphoreA
VirtualAlloc
VirtualFree
GetModuleHandleA
VirtualProtect
TlsAlloc
TlsFree
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
SetHandleCount
GetProcAddress
WaitForMultipleObjects
FreeLibrary
WaitForSingleObject
ResetEvent
CloseHandle
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
GetModuleHandleW
GlobalAlloc
GetLastError
GetLocaleInfoA
GetVersionExW
lstrlenW
lstrlenA
WideCharToMultiByte
GlobalFree
DeleteFileW
GetFileAttributesW
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
GetFileType
GetStartupInfoA
GetConsoleCP
GetConsoleMode
HeapCreate
HeapDestroy
HeapReAlloc
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FlushFileBuffers
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
SetEndOfFile
GetVersion
InterlockedExchangeAdd
CancelWaitableTimer
CreateWaitableTimerA
CreateEventA
GetFileSizeEx
SetWaitableTimer
user32
DeleteMenu
GetWindowTextLengthW
MapWindowPoints
EnumDisplaySettingsW
IsIconic
ShowWindowAsync
IsWindowVisible
SetWindowPlacement
GetWindowPlacement
IsZoomed
GetSystemMenu
FlashWindowEx
GetActiveWindow
MoveWindow
SetCaretPos
CreateCaret
ShowCaret
DestroyCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RegisterClipboardFormatW
GetWindowThreadProcessId
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
CreatePopupMenu
TrackPopupMenu
DestroyMenu
DrawMenuBar
CreateMenu
SetMenuInfo
PostThreadMessageW
GetMessageW
TranslateMessage
DispatchMessageW
DialogBoxParamW
SetWindowTextA
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDlgItem
SetWindowTextW
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
GetMonitorInfoW
SetRectEmpty
GetCursor
DestroyIcon
LoadImageW
GetPropW
SetPropW
GetSystemMetrics
InflateRect
GetClipboardFormatNameA
RegisterClipboardFormatA
IsWindow
GetParent
IsChild
PtInRect
EqualRect
SetWindowRgn
SetWindowPos
BeginPaint
EndPaint
GetSubMenu
MapVirtualKeyW
LoadStringW
IntersectRect
ReleaseCapture
UpdateWindow
SystemParametersInfoW
SetCursorPos
GetMessageTime
LoadIconW
RegisterClassW
GetFocus
GetKeyState
PeekMessageW
GetQueueStatus
SetTimer
GetCapture
SetCursor
GetCursorPos
WindowFromPoint
ScreenToClient
KillTimer
GetClientRect
LoadStringA
MessageBoxA
SetCapture
EnableMenuItem
CheckMenuItem
SetFocus
GetWindowInfo
CopyRect
PostQuitMessage
ClientToScreen
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
UnregisterClassW
RegisterClassExW
InvalidateRect
DefWindowProcW
UnionRect
CallWindowProcW
GetDC
ReleaseDC
LoadCursorW
GetClassInfoExW
GetWindowLongW
SetWindowLongW
CharNextW
SetRect
GetForegroundWindow
GetDesktopWindow
EnumDisplayDevicesA
MonitorFromWindow
FillRect
OffsetRect
CreateWindowExW
ShowWindow
DestroyWindow
GetDoubleClickTime
EnumWindows
PostMessageW
IsWindowEnabled
GetWindow
GetClassNameA
GetWindowTextW
GetWindowTextA
PostMessageA
RegisterWindowMessageA
UnregisterClassA
SendInput
WaitForInputIdle
gdi32
StrokePath
EndDoc
StartDocW
GetWorldTransform
SetGraphicsMode
SetWorldTransform
GetTextCharacterExtra
GetTextExtentPoint32A
DPtoLP
EnumFontFamiliesA
GetCurrentObject
GetTextExtentPoint32W
CreatePen
SetPolyFillMode
EndPage
StartPage
SelectClipPath
RestoreDC
ExtCreatePen
DeleteDC
GdiFlush
DeleteObject
GetObjectW
GetStockObject
SelectObject
CreateDIBSection
GetDeviceCaps
TextOutW
SetTextAlign
DeleteMetaFile
CloseMetaFile
SetWindowExtEx
SetWindowOrgEx
CreateMetaFileW
BitBlt
ExtTextOutW
SetBkColor
StretchBlt
SetStretchBltMode
FillPath
CreateCompatibleDC
GetStretchBltMode
EnumFontFamiliesW
SetTextCharacterExtra
GetBkColor
SelectClipRgn
GetTextColor
GetBkMode
GetTextAlign
SetBkMode
CreateRectRgn
GetClipRgn
IntersectClipRect
CreateFontIndirectA
SetTextColor
ExtTextOutA
GetFontData
EnumFontFamiliesExW
GetTextMetricsW
SaveDC
BeginPath
EndPath
MoveToEx
LineTo
PolyBezierTo
CreateBitmap
SetPixel
CreateDCA
GetICMProfileA
GetObjectType
CreateRectRgnIndirect
LPtoDP
SetViewportOrgEx
GetClipBox
RectVisible
StretchDIBits
Rectangle
CreateSolidBrush
CreateFontIndirectW
comdlg32
GetSaveFileNameW
GetOpenFileNameW
PrintDlgW
CommDlgExtendedError
advapi32
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegDeleteValueA
RegQueryValueExW
RegCreateKeyA
RegOpenKeyA
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
shell32
SHGetSettings
SHGetSpecialFolderLocation
SHAppBarMessage
SHBrowseForFolderW
SHGetDiskFreeSpaceExW
SHGetFolderPathA
SHFileOperationW
SHGetSpecialFolderPathW
ShellExecuteW
SHGetFolderPathW
SHGetPathFromIDListW
ord165
ole32
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
StringFromGUID2
WriteClassStm
OleSaveToStream
ReadClassStm
MkParseDisplayName
ReleaseStgMedium
OleRegEnumVerbs
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleUninitialize
OleInitialize
CoUninitialize
CoInitializeEx
CoRegisterMessageFilter
CoInitialize
CreateOleAdviseHolder
CoTaskMemRealloc
CoCreateInstance
CoTaskMemAlloc
CreateBindCtx
OleFlushClipboard
CoTaskMemFree
PropVariantClear
ws2_32
getsockname
send
recv
setsockopt
WSAStartup
WSASocketW
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
htons
WSACloseEvent
inet_addr
gethostbyname
ntohl
select
gethostname
connect
ioctlsocket
WSAEnumNetworkEvents
WSAEventSelect
WSACreateEvent
WSAAddressToStringA
bind
sendto
recvfrom
WSASetLastError
getservbyport
gethostbyaddr
getservbyname
htonl
ntohs
inet_ntoa
shlwapi
PathFindFileNameW
ord158
UrlCanonicalizeW
AssocQueryStringW
urlmon
HlinkSimpleNavigateToMoniker
RegisterBindStatusCallback
CreateURLMoniker
CopyStgMedium
mscms
TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rodata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
277KB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
132KB
Virtual Size
131KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
316KB
Virtual Size
315KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=150, version=20413,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=2, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=37, id=123, productName=VS2005 build 50727, version=50727,
count=636, id=1, productName=Unmarked objects,
count=20, id=109, productName=VS2005 build 50727, version=50727,
count=440, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=31, productName=Unmarked objects (old),
count=56, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1123, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=2, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/GO_CAI_DAT.bat
- SHA256 cf029ee66a839dddacc721b98ab3b3039533e64c2c4dee6d1fc45db38b0c781e
- MD5 aa786af1754519c1bd2d4018f3b2b590
- SHA1 05067ea1a79710971c2243320a340db16880cb09
- SHA512 7bb8e8c31ff3b3d1444e2c7c72320ba452e851e3e7f136c5061f449abdc45859d020a7c10f362b06b4d14e6cb615fe867bf672425d02f55bd8cd6a8ea5acff41
- TLSH T11551530239225E068570B5C0D97A99637BAC429796337DC6B6D33635B88D3D933B87C8
- MD5 SHA1 SHA512 TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/HUONG_DAN_CAI_DAT.txt
- SHA256 369a749a629180a619e07757b3873317d87fd6ed7faef2d94c59db6262eae462
- MD5 f44f7ead1f31adcf2a5b18f11cc30842
- SHA1 dbd4f18b8478ab7645c1a87033de1601dd0b7622
- SHA512 aef8ee7240ad720eaa4665643cbb996e86641bb0b48424767a8f986730f904b87d2bd2c505eb9a9b30af1bfa77769bcabe84fb0e7b0635ea9ab509b69a784293
- TLSH T1318165001FA4A612513AC53DCB5EA50DFBCB881FE7818B9435EC503CBF2BB546A6C69D
- MD5 SHA1 SHA512 TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/Start_Launcher.bat
- SHA256 f083a3a925281fbf546dae1a2e45b802322db786e581f2573847d51a1362578e
- MD5 41ac38742785ae17fcf3a619840d65a3
- SHA1 da7160875028d050f56c195394a6395c4ba5cb12
- SHA512 35ac86679e6c1b48334e1935e81b274b2eef5c4bb343e36e3bf9bdd19a400e2477c11e8b895f036a6b4eb42da729acbbf8621a84470c21e1039eefef360300bf
- SSDEEP 96:X1yv6cwuY6dY6ZNLKI/pqc5d+rtuBAu9e7dupUkmhmKh5uVhJr0J9N:Fc6cwv6u63Lfqc5dM1raULAdDJr0J9N
- TLSH T15BA173827D04C9268C75F4D0A8390807E79B41C76753D6F6316339A6760D6CF02BE6C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/TruyenThuyetDoLong.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c317e10ca09cb8e8153663a64b64b17a21f668fee81b3767aef9ddb1a06ed4f2
- MD5 e529eb6f0763921403ba7e10170d45ee
- SHA1 a44c5b83d5af6832da30fd23de4fbd33fa1b6a6d
- SHA512 3bf0c5f98cb63cc5fb4c5d213977ac4fe1b9c666400cbdd313fff8b9e5c64b337b6604e7fc4a82d21b6ace29df5ad843a15d327c6f8febb6c6f95dbb803a5fa7
- SSDEEP 3072:+RsXUpu6A+BwtefO1E15OuXOqhdnKzR6b0jk6PGYreDH+wSzd:ODAow4f5pXOqhtA0oY6PGhfS
- TLSH T1D7D3123C2BE84A36CA694F37F62426279770ED09D221D1A7680CE4BD9F53A210D177DD
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
17070
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
127KB
Virtual Size
126KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/config.ini
- SHA256 7a564fa1928dfeebd663f878ca569bd1c877789bc15fbb5fc476d0aa3607b2dd
- MD5 97cd47f5804b5e32d28015623d4a1c91
- SHA1 8ef2d77792b6236736e8fdffda8806e7a0d4e7d4
- SHA512 d85a7137c57752fd72c713396fabbd15b6c70aed0bd2ec125bbe87dac88787dcd8b08bbbe7e2056caed9659b5ce4693d15238e0019a4cbcb3e7450bb6fe73f61
- TLSH T166B09B331065401598738E50D2A7737F55744B911101A86DBB1075445C5F6578406491
- MD5 SHA1 SHA512 TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/config.xml
- SHA256 2c66f8193368a893b70c579746d69ea1061a5e5828c94ac65e91c7f8052b8b3c
- MD5 8fc46ef571ce345a63599f1e7ef07253
- SHA1 692a5e7c1ae6496167e4f8b231038a0251319117
- SHA512 84bc174a39fac38236852150b41eca4ac4a2161ae7c7e17bb19c698a81445a00ff978bb7b6620de89eed192fbf9ca48c077cd1193543c74eec88fe249fe005c5
- TLSH T16AE092983004AD362268EB34ECC9B17551A829779088F905BDB56C4C8F4669AA1AE291
- MD5 SHA1 SHA512 TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/login.swf
- SHA256 3a67a5e3c77a7c1599643b91b0c62deea28e25f58f165dcb8969b5c86c093f7d
- MD5 e1e244c0a6f0ed1d7116f05d67112e81
- SHA1 e518b182c7397c0aa417fdb8014fce1f86082519
- SHA512 a7e464206ebfc9fdd93b2770b3c34da6ec3b7629c9770b5bfb0c254f06065fb6d23bbfb123dab3d5c2b7bb28e3820eaf3e22558a7dafef27bd96b0529e235afa
- SSDEEP 3072:O0jrrK72U33Hx8PtwwHyOjF3bMnvzy/QNCRNYIwcdaxjqtWjKoory1MiqLMWCvG:5jMVHHgww1F3IvzyLYI5iHjKveMXkG
- TLSH T1981423CB870F057E89B05BF3E7C8677064B906C3F59D26B1201C9751AAAF7AC1972239
- MD5 SHA1 SHA512 SSDEEP TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/logo.png
- SHA256 c5aa037d809961099e79bacdd0ab151afa3965a4a6d7014d0aef1cf83b284afb
- MD5 2fefc916659722fa8355519dd87a0082
- SHA1 1eba322c7ed629092dad8d5c6dec8931a91f0f3f
- SHA512 d457fc9aff011f106df6815b6ff4102df12555314ee2ffae511e6f31e8f3e2e42f5bc28faa59c572601a26598686aa57e3f56fb1e4164984f2fe30d9acf56c43
- SSDEEP 24576:fXjHeUSil1qzzEB6xPPNHkKprzlhCaQpX4l/FMENX0kgFeNy4m1yACV9azd:fEsqzQBuPjpvlhCaQml/F34F4VAFd
- TLSH T1E0753366FA8AC7F9CA4F586533499544568A0060F31CA97EC43CEECF583239216CAFDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Client_Game_TTDL/TruyenThuyetDoLong/LauncherClient/version.ini
- SHA256 b3e9dc9975a8f9e200d6c345375200fe81991e79a2b0dc6fb59f2966248b9e11
- MD5 61164907d2019a584aa2420143073bff
- SHA1 16e5c47d5370a3bf57850ad32c7fe04305bcc17d
- SHA512 ae75c11f853cb4857e85c846ee2701627690de99e7cd737bdb7c02466cabf62f2ee13ff56d295efa8a8bdd1ecbb5c0e9d8384a240985f326a09e1d63757aa08f
- MD5 SHA1 SHA512
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/FlashPlayer.exe
- IMPHASH dd6a86d80fd8f29e61800e4c4b4f6a5e
- SHA256 a4b333ac1da12026989549015303d82231982838bccfb544ba5fd188746066f0
- MD5 08c13d0cc4ccdac79b38821e846a53b7
- SHA1 7736efc1c76e6a80132a22e1f9fc87a5884fa375
- SHA512 87e953e053e249a5c202ff4639aee6fa5915b0b86e69ad5eee76d9091545aa4d201a8477d1c2525db9d3ebb053476cfd9ef31a8c7b232a4dcf84c2dd86f35860
- SSDEEP 393216:nZl05YflfxgkTVfdBL/tEJ1+lFj99e2xXX+QU9DrFkpBK:nZl05Yt+kTVTL/xlFVaPP
- TLSH T12EF69D23A60144B1C182217DCC3AEEAD617DAE15873415C753A47C1BAA72FC3AA3DB5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
b7:c5:fb:d8:52:34:68:8c:ee:6e:b7:bd:57:a0:3c:31:08:07:35:5c:cc:1c:3b:d3:b0:e6:fe:83:3b:bb:ca:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Nov 24, 2020
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Flash Player,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:2c:ac:cd:3e:9e:ec:06:73:84:10:ba:31:bf:65:95
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 31, 2019 - Feb 3, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
1
Major OS version
5
Entry point
3992035
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
E:\r\ws\St_Make\code\build\win\results\standalone\Release\Win32\FlashPlayer.pdb
kernel32
GetCommandLineA
GetCommandLineW
GetSystemDirectoryW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
RemoveDirectoryW
CreateFileA
CreateFileW
GetFileAttributesA
DeleteFileW
FindFirstFileW
CopyFileW
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
HeapSize
HeapLock
HeapUnlock
HeapWalk
DebugBreak
CreateThread
OpenThread
SetThreadPriority
QueueUserAPC
TlsAlloc
TlsFree
SleepEx
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
FreeLibrary
GetProcessTimes
GetCurrentProcess
GlobalAlloc
GlobalSize
GlobalLock
GlobalUnlock
LoadLibraryA
GetModuleHandleExW
SetCurrentDirectoryW
GetCurrentDirectoryW
QueryPerformanceCounter
QueryPerformanceFrequency
GetACP
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
SetUnhandledExceptionFilter
FindNextFileW
GetCPInfo
IsDBCSLeadByte
VerSetConditionMask
LockResource
GlobalFree
ExitThread
LoadResource
CreateProcessA
FindResourceExA
FindResourceExW
GetSystemDirectoryA
GetFileAttributesW
MoveFileExW
GetVersionExW
VerifyVersionInfoW
GetUserDefaultUILanguage
GetUserDefaultLangID
GetLongPathNameW
GetFileInformationByHandle
GetFileSizeEx
DeviceIoControl
SetFilePointerEx
lstrlenW
CreateMutexA
CreateProcessW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
OutputDebugStringA
GetTempPathA
GetTempFileNameA
GetSystemWow64DirectoryW
CreateDirectoryA
GetFullPathNameW
GetFileAttributesExW
DeleteFileA
GetVolumeInformationW
SetLastError
SetEvent
ResetEvent
GetStartupInfoW
GetTickCount
CreateEventW
GetSystemTime
GetTimeZoneInformation
SystemTimeToFileTime
GetCurrentThread
GetExitCodeThread
DuplicateHandle
MapViewOfFile
UnmapViewOfFile
LCMapStringW
GetLocaleInfoW
TerminateThread
CreateWaitableTimerW
ReleaseSemaphore
CreateSemaphoreW
SetThreadAffinityMask
ReleaseMutex
CreateFileMappingA
CompareFileTime
IsDebuggerPresent
OutputDebugStringW
EncodePointer
GetProcessHeap
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
LoadLibraryExA
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
RtlUnwind
LoadLibraryExW
GetStdHandle
GetStringTypeW
GetFileType
GetDateFormatW
GetTimeFormatW
CompareStringW
GetUserDefaultLCID
EnumSystemLocalesW
SetConsoleCtrlHandler
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
ReadConsoleW
FormatMessageW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryW
TlsSetValue
TlsGetValue
GetSystemInfo
CloseHandle
FindClose
SetFilePointer
SetEndOfFile
ReadFile
WriteFile
GetFileSize
Sleep
WaitForSingleObject
DeleteCriticalSection
TryEnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetLastError
GetCurrentThreadId
SwitchToThread
RaiseException
GetExitCodeProcess
ExitProcess
CreateEventA
CreateSemaphoreA
GlobalMemoryStatusEx
SetSystemTime
FileTimeToSystemTime
GetVersionExA
ResumeThread
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
GetVersion
VerifyVersionInfoA
GetProcessAffinityMask
GetNumberFormatW
GetCurrencyFormatW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FreeLibraryAndExitThread
GetProcAddress
InterlockedCompareExchange
CreateTimerQueueTimer
DeleteTimerQueueTimer
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
WaitForMultipleObjects
DecodePointer
advapi32
CryptHashData
CryptImportKey
CryptGetHashParam
CryptSetKeyParam
CryptAcquireContextA
RegOpenKeyA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
CryptReleaseContext
CryptAcquireContextW
RegSetValueExW
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExW
RegCreateKeyExA
RegCloseKey
CryptEncrypt
IAEModule_AEModule_PutKernel
IAEModule_IAEKernel_LoadModule
IAEModule_IAEKernel_UnloadModule
_WinMainSandboxed@20
Name
.text
Size
10.0MB
Virtual Size
10.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rodata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
825KB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.gfids
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1.8MB
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
407KB
Virtual Size
406KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=47, id=241, version=40116,
count=184, id=243, version=40116,
count=34, id=242, version=40116,
count=1, id=199, version=41118,
count=26, id=259, version=24123,
count=20, id=260, version=24123,
count=3, id=261, version=23013,
count=30, productName=Unmarked objects (old),
count=18, id=264, version=24233,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=670, id=1, productName=Unmarked objects,
count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=787, id=260, version=24233,
count=48, id=261, version=24123,
count=1178, id=261, version=24233,
count=1, id=256, version=24233,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=2, id=151,
count=1, id=258, version=24233,
Client_Game_TTDL/TruyenThuyetDoLong/ProjectorClient/StartGame.bat
- SHA256 d37d9c48915b35b10b9aa8e297fdf229cf0bca108cf9fe14388aaba77e3660e7
- MD5 467941e971d5cabf4f4a64099ff548fe
- SHA1 15a0e044e2c1efa27a1a488c29bdc5ac23f6d2f2
- SHA512 177d1ec9a12c063d3bc616a6c18e97535f45eff1bb5caf6801a79f1b8480bbb1059604389c16bfc312b6a5014c87da2f35ed8158e26a65db4cd47e79fb07cf14
- TLSH T1691100A9A20E220CAB733E4160D1849BE38A67A2434191ADE002D7590D4C4B7F7E9B63
- MD5 SHA1 SHA512 TLSH
Client_Game_TTDL/TruyenThuyetDoLong/README_CLIENT.txt
- SHA256 3b6a994bfd17d3e49dababc6c0dbc2ad7906d8d2222d44253e1cb135577aaeef
- MD5 1cd623db6de346774fcebd70e9041ca1
- SHA1 73143e29f6b783c96a25a306829734bf1ff5ec69
- SHA512 fd04dabd59f830b3fea64e460ab0caa0b3d9401d412cf9c421ee4d914b03bdc692abd6c8d37998f56c78f574d0470156367100e3a86940cfb73f3e4b758efeb1
- TLSH T13021DD4126A13D26897D833CCB55B93AEBC1841EDB968A703D7841BC1A6D81A5FA41CF
- MD5 SHA1 SHA512 TLSH