f[.]7z | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
f.7z
Size 34.7MB
Sample261014-ns5e2acv2t
SHA256 8fccaf758c9131b7e4bf4ef3bd2e3f0ee1d286e40d49f342ca00e5f69d024007
MD5 67886f9f237d248ae95ccaf1037a2f5a
SHA1 dcd2675af31e312a33ba370228c9c14111af8608
SHA512 bb589287f18817b9fbb921a81d08dd423982d475d34f9b49a864c3bbdf2a5d0548d5aed525af2f893d625d1d609ef8ef1e053cb5f335ca31894744cd8491236f
SSDEEP 786432:K9h/6RKACzV/6g6VbNvIvGZFvxiBvBnGRVcpuoMW3yPMRHqGZf:Kn/19yJlZaBGVcpuoZ3ywFt
TLSH
T1988733822B383DD75778D4ABE2C506DEE293747E446056F2A89B4BDB763E94894F00C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/f/GameAssembly.dll
unpack001/f/PixelWorlds.exe
unpack001/f/PixelWorldsMetadataTool_[unknowncheats.me]_.exe

File Explorer

f.7z

.7z .ps1 34.7MB
f/GameAssembly.dll

.dll 94.8MB
f/PixelWorlds.exe

.exe 651KB
f/PixelWorldsMetadataTool_[unknowncheats.me]_.exe

.exe 358KB
f/PixelWorlds_Data/il2cpp_data/Metadata/global-metadata.dat

14.9MB

f.7z

SHA256 8fccaf758c9131b7e4bf4ef3bd2e3f0ee1d286e40d49f342ca00e5f69d024007
MD5 67886f9f237d248ae95ccaf1037a2f5a
SHA1 dcd2675af31e312a33ba370228c9c14111af8608
SHA512 bb589287f18817b9fbb921a81d08dd423982d475d34f9b49a864c3bbdf2a5d0548d5aed525af2f893d625d1d609ef8ef1e053cb5f335ca31894744cd8491236f
SSDEEP 786432:K9h/6RKACzV/6g6VbNvIvGZFvxiBvBnGRVcpuoMW3yPMRHqGZf:Kn/19yJlZaBGVcpuoZ3ywFt
TLSH
T1988733822B383DD75778D4ABE2C506DEE293747E446056F2A89B4BDB763E94894F00C8
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

f/GameAssembly.dll

IMPHASH ea1714b5e16d4e6aec5ab0845cbca0ae
SHA256 69a6de68e833b3b89e9cf53091ebfe623672645688fbbe38629fbd8b1105b8f9
MD5 9ddf63b39d94b3e4a07eb0b515890c01
SHA1 fdf5f40c43c6b45a73e9baf89a77e9e5919b54b4
SHA512 05a133f6c33f769a3eb15635f3cba6180285f9e3867b156191846e6b23feab68c7fc877b0d97573e978938dc7388d19d88d1bb97b822682bc0230e4927fe382d
SSDEEP 786432:+frfwZQbjQwNBGlG7v3yZqQ2xIJpjqFnw:wNE87PyZqQ2xCpqFw
TLSH
T126282728E6BB8858C5A7D2B6C513819FFFF036141F706AC719505EAD1FB3AE56036A30
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5013232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\actions-runner\_work\pixelworldsclient\pixelworldsclient\Library\Bee\artifacts\WinPlayerBuildProgram\dk0qo\GameAssembly.pdb

kernel32

CreateDirectoryW GetFileInformationByHandleEx FindFirstFileExW FindNextFileW VirtualAlloc RemoveDirectoryW FindClose UnmapViewOfFile Sleep OutputDebugStringW K32GetModuleBaseNameW GetSystemInfo GetCurrentDirectoryW GetCurrentProcessId CreateFileMappingW MapViewOfFile VirtualQuery IsDebuggerPresent GetExitCodeProcess InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockShared GetModuleFileNameA GetLongPathNameW GetModuleFileNameW GetThreadLocale GetTempPathW GetLocaleInfoW GetACP WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection ReadFile GetLogicalDrives GetFileSizeEx GetFullPathNameW GetStdHandle WriteFile GetDynamicTimeZoneInformation CreatePipe SetEndOfFile LocalAlloc GetThreadDescription SetFileAttributesW MultiByteToWideChar GetConsoleMode FormatMessageW GetTimeZoneInformation GetFileAttributesExW SetFileInformationByHandle DeleteFileW GetNativeSystemInfo CancelIoEx GetOverlappedResult SetFilePointerEx LocalFree MoveFileExW ReplaceFileW CopyFile2 LocalReAlloc GetFileType DeleteVolumeMountPointW SetThreadErrorMode CopyFileExW GetTimeZoneInformationForYear FlushFileBuffers SleepConditionVariableCS WakeAllConditionVariable GetSystemTimes SetEnvironmentVariableW InitializeConditionVariable GetEnvironmentVariableW FreeEnvironmentStringsW QueryPerformanceFrequency GetComputerNameW GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW GetModuleHandleA K32GetModuleInformation VirtualFree SetFilePointer SuspendThread ResumeThread GetThreadContext GetProcAddress GetModuleHandleW WriteConsoleW SetStdHandle GetProcessHeap GetCommandLineW GetCommandLineA ReadConsoleW GetConsoleOutputCP SwitchToThread CreateThread RaiseException CloseHandle GlobalFree GlobalAlloc GetCurrentThread RtlCaptureStackBackTrace DuplicateHandle GetCurrentThreadId CreateFileW SetThreadPriority GetOEMCP IsValidCodePage HeapQueryInformation HeapSize HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale LCMapStringW CompareStringW LoadLibraryExW VirtualProtect RtlUnwind HeapFree HeapAlloc UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent GetModuleHandleExW FreeLibrary GetCurrentProcess SetLastError SetThreadDescription TlsFree TlsGetValue TerminateProcess ExitProcess FlsFree FlsSetValue FlsGetValue FlsAlloc InterlockedFlushSList RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead SleepConditionVariableSRW GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx InitOnceBeginInitialize InitOnceComplete AreFileApisANSI CreateFile2 FindFirstFileW GetLocaleInfoEx FormatMessageA RtlPcToFileHeader TlsAlloc GetLastError GetVersionExW TlsSetValue

user32

MessageBoxA

advapi32

EventWrite EventWriteString EnumerateTraceGuidsEx EventUnregister EventSetInformation GetDynamicTimeZoneInformationEffectiveYears EnumDynamicTimeZoneInformation EventRegister EventWriteTransfer GetUserNameW EventActivityIdControl EventWriteEx

ole32

CoUninitialize CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc CoGetApartmentType CoInitializeEx

oleaut32

SysFreeString SysStringLen SysAllocStringLen SafeArrayGetDim SafeArrayDestroy SafeArrayGetUBound SafeArrayAccessData SafeArrayCreate SafeArrayUnaccessData SafeArrayGetVartype SafeArrayGetLBound

shell32

SHGetFolderPathW SHGetKnownFolderPath

ws2_32

WSAGetLastError setsockopt getnameinfo ioctlsocket sendto freeaddrinfo WSAPoll htons inet_ntop htonl getsockopt WSARecv recvfrom gethostname WSACleanup __WSAFDIsSet accept bind WSAIoctl closesocket WSASend select ntohl shutdown listen inet_pton getaddrinfo WSAStartup getpeername inet_addr getsockname gethostbyaddr send socket ntohs connect inet_ntoa

iphlpapi

GetAdaptersAddresses GetIfEntry GetNetworkParams

api-ms-win-core-winrt-error-l1-1-0

GetRestrictedErrorInfo RoSetErrorReportingFlags

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString WindowsGetStringRawBuffer WindowsDeleteString WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-robuffer-l1-1-0

RoGetBufferMarshaler

bcrypt

BCryptGenRandom

dbghelp

SymInitialize SymFromAddr

baselib

?Baselib_DynamicLibrary_GetFunction@il2cpp_baselib@@YAPEAXUBaselib_DynamicLibrary_Handle@1@PEBDPEAUBaselib_ErrorState@1@@Z ?Baselib_DynamicLibrary_OpenUtf16@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@PEBGPEAUBaselib_ErrorState@1@@Z ?Baselib_DynamicLibrary_Close@il2cpp_baselib@@YAXUBaselib_DynamicLibrary_Handle@1@@Z ?Baselib_ErrorState_Explain@il2cpp_baselib@@YAIPEBUBaselib_ErrorState@1@QEADIW4Baselib_ErrorState_ExplainVerbosity@1@@Z ?Baselib_DynamicLibrary_FromNativeHandle@il2cpp_baselib@@YA?AUBaselib_DynamicLibrary_Handle@1@_KIPEAUBaselib_ErrorState@1@@Z ?Baselib_Timer_GetHighPrecisionTimerTicks@il2cpp_baselib@@YA_KXZ ?Detail_Baselib_Cpu_FeatureData_CpuIdArray@il2cpp_baselib@@3QBUDetail_Baselib_Cpu_FeatureData_CpuId@1@B ?Baselib_SystemFutex_Wait@il2cpp_baselib@@YAXPEAHHI@Z ?Baselib_SystemFutex_Notify@il2cpp_baselib@@YAXPEAHIW4Baselib_WakeupFallbackStrategy@1@@Z ?Baselib_Thread_GetCurrentThreadId@il2cpp_baselib@@YA_JXZ ?Baselib_Thread_YieldExecution@il2cpp_baselib@@YAXXZ ?Baselib_Timer_TickToNanosecondsConversionFactor@il2cpp_baselib@@3NB

AVwLjSpbbkn AeMtCDRZgnF AhepYwxKYwr AkpPZjEaURs AugFkYOcGZu AwgRCbfcwhp BHDxKUEsMOc BPlbnxRiLuw BrPvUqPiDWo BtQJSUDZtSA CRHKRFGpq_j CcjOnmehRZm ClWrGXGv_hr CloseNLSocket CloseZStream CreateNLSocket CreateZStream CvrkwtJm_o_ DAiXMbuydQH DJmsCBBfSyg DUMEsDXsAvj DWiNePItbLS DeICOLxbRxh DeUoKepYLIB DkZcFItgkBI DllCanUnloadNow DllGetActivationFactory EBDeFrkmnyq EgGBmQctCWc EjUNLYdaLsu EktbbgJvnAs EqqSjWVrrZO FEFnKYKvYul Flush GAHozkIFLEj GDpTfDRwxsC GGyBVyMayoZ GJLnUR_eZwl GWiZCrFVggG GrzrwDqXZFH HUwfJbAqgeI IAwrVhHLRHw IVIvCRvshEm IVs_OfDNoEV IhIQDeAdXLQ IpnsCTntzFZ JBKzMXNQJvK JRAzTaLWQWq JTwtEsOleFX JaSkVFnqQFk JetmQAFxSaA JlBmnPN_Kxs JrM_iCBevTC KXCxYWCmbiF LavtxlaZWyc LdiInTWswWG MKXZALqOBFJ MUfkahoAnET MaryvpZPUPv MjRqsPsOINp MqGlOrUuMnU NNBxqeKIkMn NUBulNBxIaG NYPCikOeYFX NZnjyxfxYFS NarX_OHuxvu NbRZjeazJNy NcAEVgUJiUq NnSyQZJjeSJ NsrxvssaNQo NszXZURNGsd OCPWahqexRN OXPbHHPuwjs OZWVzKSFdCS OfXCzyhaydY PDcMxuMyWMq PLUtbbTrkMQ PjseRNUNsXy QfJxNjwKXbj RDOZB_rAnzU RGCSgiWYhxj RawZhUqsJOk RcfhJSUqeZI ReadEvents ReadZStream RhrrwuifuSX RpSsIJCaGey RsEbXQTvCga SqWJl_fERmF TMkZuwRCmEM TqXy_xisSLX TvszkaaYyIU UCSXIqYRmAZ UDtMAAiBzgv UFPyDOgXttP UHPtvMZYzCC UMXPHYQelkZ UUPbHeKCpSy UWBdKOZiAwO UlEiAteCGqz UuElYViRahM UubAe_qfaJh VGFQLuhJgPr VLEQMCrSyOO VNYGCpoyOCH VWALJPowWnw VbBEGwPDJCK WINzRdLUNoE WMtxMBeA_GI WYpETiWGx_H Wbiiunsb_XE WhQqDxZaygy WriteZStream WtWtVlOkYSX WvfzmKNFKtY WvzoTzsWyit XJIWHxloSl_ XVteeifvYth YQElEZyvvYa YaSipYyTvPU YcxXcIePyqM YePzEVMNNrA YfNEUpsCDCg ZMJdFaPyBnH ZZpCTzoKqCE ZalQmHWwSNl ZccTSBJpoip ZzFrQuCfcxg _EopAoJiJKp _QUlRn_KqAd _aVrUPCZgUN _oxorZkhDEX aMDnJrxXuJu adYbOUwpqeO ajOf_mNTzeV amSwVRAzQwi ayflrpYfrEh bBqshardekf bCLtmKKOuxH baMgTOkCtfI bebywDTAYVK boQEgZrhmcf cIDBeTKGOcl cKkGwxAKFJy cZViVwzPsWH cncLSxpKUnk coEmFmq_nbV dPCHCmLPWWC dTmElCBWoYk dmVLjfStrcl dnP_LEJiOyc dogbvaiqrGn eGokLUVBBsM eJsZmICdPHg eNOOtl_esXe ePQpGfXxSZh edFsrWHttOb efFKpWyznhd ejzcRSdibKP eqtEjuccOXz fBNmMuhOkFP fiIjQqQMrVw fpCPDzsllFp gIIbwvpsKdM gbvvYuwPTKA glbyUSzEqYA grelHLdcbzs gxzfXrvuiiw hNcRLUEhIvy hsMdWRaxMKQ jAcU_lHjkrq jSvxhILyKKZ jdLHerjBKce jzSOnQmuALo kSZVXCrqRmQ kizxbEfkNbS kmYzdvIUMtA koPZlwvRKOb kwPwbkpznje lCmghmvqhzt llsbHBbScvr lsgdGXprQAW lySokNbyKVF lzxCVfMMkZn mbTaTQdFdTu nEXlDglQnsc nWsGgmaMKXE netQBFwkEGD nlXtkrqHZjC nnPfSvYVpoi obbiHPfekqn pJrWYrRUeen pQfdmrMOZGL pUbzsNxcBmv pXxbECIVZbX p_ZtDzBxqAB qDs_CDWTrep qONclyuQ_OQ qSRnXBlkDhA qhzmQ_cjIpB qogqvHX_eZK qrfgwXXfkC_ qtriQkwf_Ja rJFERxiGMab rMxc_uEJjZA rO_KsQWlyvZ sRzHiGBVnwr sXsxISPdBFe sceznGAMHjM soBhqHUoiaD tAvyTkXfpKD tDbwBBlky__ tHXa_rizEUy tYhppMUzADa tYnJcwekgvY teHkZkJGEdf uHSxJSICXAm uLbOfDvNPiu uQHjGuscdey uzpvDuIrfmN vBIBVcPcjbN vMZvpOhiutL vmFVOsiloXr vuYmbbgPnuE wNBSUVgLYHO wXgBkZymFlG wdUtZuMzxfV wkQuBtkeZVd wzlhJoGAWlX xDKaiByEbwb xTTIPGvrxSK xZZwrgaNPxm xrEhykwos_I yMqNcpMdRMe yNbaEOrcHdz yRQRjSWYoub yTCZe_rcXHF yTqXgnsLKRO yUvlN_sfzHt yVSLSuXIKOx yVdutXSKmJg yeTzcDbuyvr yjtj_ahUnIS yuGfZhckeQI yvSMmcwZsdK yyrXBKrdCoa zId_SnRGGVM zQMMszjITHO zndVJiUMhGU zrekurhDdMK zzxLyQxrrGL

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

il2cpp

Size

74.3MB

Virtual Size

74.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9.1MB

Virtual Size

9.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.0MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

935KB

Virtual Size

934KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f/PixelWorlds.exe

IMPHASH a136217cdd3247ff6a8766561064ca0b
SHA256 372d25fccfdddec6b0271065780eccb38b51e11e4816f68bab1023246a4c83b9
MD5 93b58aa84149f44e9abc54a7085595dc
SHA1 eb49fc69960d01dc9141733078c3cac59c005df1
SHA512 1ca196c7b09fe996894baeb5225a79c0b72ebfb14838c94478bc221727ecf393ac74672cbd86acb48d5bbb648af041f880fc9c0736ce09a3ad587aaffed58db7
SSDEEP 12288:etVwZpmhlz09E22CDf3VkkkmUAsm2duOB81YDtbIIMIIIrG/5Q7WgS:e/rQ9MYoAsmMy1YDtbIIMIIIC/5Q7W5
TLSH
T14CE43A6E6CC21AECE0E7743DA286C5998762DC751B17411503F7FE52FEB3E40AE86608
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_MT_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

unityplayer

UnityMain2

kernel32

HeapAlloc WriteConsoleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW CloseHandle RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW

f/PixelWorldsMetadataTool_[unknowncheats.me]_.exe

IMPHASH b73402068ec6f4e98096220adabce02b
SHA256 7a7c5ad115ecd334fa93e002d4dc51dec04a2328711a47281c925f3157026426
MD5 19944b84149b6634303e2a21cbf29477
SHA1 b0a492127f194b085fa8b203079e924719a58709
SHA512 e7805c07bec6c1aee0100dc804be294faa6b04059d714b2e719ac87528037802f117e4c9f4059c0d97a4067a2e040426d49d8123bca557255736a6bb5b218866
SSDEEP 6144:Wxj5ZYCzkrFmBkA59RAjRW4gyYi+0/CRDo2wF4Hvdf2Lb3mW2Sm:40Jmz59RA9CyB+0/CRlHvd+X3mZ
TLSH
T137747D16F6A814F9E277D178C9534906E7B27C5A4370ABCF23A00A572F27AD48E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegGetValueW

kernel32

CreateFileW FlushFileBuffers WriteFile CloseHandle GetStdHandle GetCurrentProcessId OpenProcess GetLocalTime GetModuleFileNameW QueryFullProcessImageNameW GetConsoleMode CreateToolhelp32Snapshot Process32FirstW Process32NextW LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFullPathNameW CreateFile2 AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW SetEndOfFile RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW HeapFree RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW IsValidCodePage GetACP GetOEMCP HeapReAlloc GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW RtlUnwind

Name

.text

Size

242KB

Virtual Size

242KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

f.7z

f/GameAssembly.dll

kernel32

user32

advapi32

ole32

oleaut32

shell32

ws2_32

iphlpapi

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-winrt-robuffer-l1-1-0

bcrypt

dbghelp

baselib

generic

f/PixelWorlds.exe

unityplayer

kernel32

generic

f/PixelWorldsMetadataTool_[unknowncheats.me]_.exe

advapi32

kernel32

generic

f/PixelWorlds_Data/il2cpp_data/Metadata/global-metadata.dat