4223fc23c72d348737d8746ccec089351682ff3116b65342994f98bf4333d6b7

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Dec-02 22:52:38
Detected languages English - United States
Debug artifacts C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb
FileVersion 6000.0.31.10618563
LegalCopyright (c) 2005-2024 Unity Technologies. All rights reserved.
ProductVersion 6000.0.31f1 (a206c360e2a8)

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 83.983% of the executable.
Safe VirusTotal score: 0/72 (Scanned on 2025-07-17 07:06:38) All the AVs think this file is safe.

Hashes

MD5 e66a4a1cafc45933ff80e9d4b19e4e78 🔍
SHA1 a14b7e3a7c904e0cf85bcbd6a8ba0249f0d64837 🔍
SHA256 4223fc23c72d348737d8746ccec089351682ff3116b65342994f98bf4333d6b7 🔍
SHA3 fe7181de622d483d2f8039a371444197ed7692e4ca017a319fd758f7c8b34bd6 🔍
SSDeep 12288:42NCD1Jr3dna03s66/X5GWwCV+3tQWLSJI:Mbkemi39L1 🔍
Imports Hash ce1183cc150987a99aef5749f22af81e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-Dec-02 22:52:38
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xde00
SizeOfInitializedData 0x97200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa9000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 a5e0bf1e14a18380e4aa8fcfecd45cfd 🔍
SHA1 320e758c261b51cdf475ac1fe2d2b8b0f65ee37a 🔍
SHA256 9f9a743b5e5c12b459f7533a90382644af884df3aef68c9d7ac7d662735f193e 🔍
SHA3 0371197b472ffeeb91e1e7c7a9605222c7eee7431b878edcb558990adc374905 🔍
VirtualSize 0xdc70
VirtualAddress 0x1000
SizeOfRawData 0xde00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.46141

.rdata

MD5 288b9171ac95a1cea3d2b73e4831b31f 🔍
SHA1 aac4046d733973acc5b40a586a47d951ff626a9b 🔍
SHA256 a1d998c769c0f2c665b462ecc3b3f99ee7acf30f89c8b89edf97f00bfdbac373 🔍
SHA3 ec8d4c947bb49c1f67419519d31ade533e45c8cab91f087de90ba339f6e339a0 🔍
VirtualSize 0x977a
VirtualAddress 0xf000
SizeOfRawData 0x9800
PointerToRawData 0xe200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.70129

.data

MD5 d284f7b260ed119794375a6998c5083c 🔍
SHA1 0944c690e2b7841e681f55d2a731910f8019f2ef 🔍
SHA256 79ebad17e73900bd4dd43a932cc832e1d907346973e16ac0af549524fa4b88b3 🔍
SHA3 0c023444d7239a9582798618879cf6e165fcae6d6eec1051c77592814b4894ad 🔍
VirtualSize 0x1d78
VirtualAddress 0x19000
SizeOfRawData 0xc00
PointerToRawData 0x17a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.89847

.pdata

MD5 583bf012d5970545541b47ad6f1b2dc4 🔍
SHA1 ed34342900f8481a1f09e9f73fe8bb0d1e528eb6 🔍
SHA256 a7a9a284c12beceaf69e80c98bb9708078c1ee29e3581bf7c44e24e7535c04eb 🔍
SHA3 e57cf3023698fe8882221ba469ca26d236b8a3d44b7d67f42d621316177425fe 🔍
VirtualSize 0xf24
VirtualAddress 0x1b000
SizeOfRawData 0x1000
PointerToRawData 0x18600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.67239

_RDATA

MD5 dd297010ea596c9b749ddc72fe421330 🔍
SHA1 3213e7a4b99366f1367f1b5dc97aa4853369a784 🔍
SHA256 420a70f17663b392f63eb448853ebc800a3f7cf9c6e0b78b7e421d671dd927fd 🔍
SHA3 f4660bd566f5561530bb0e40a752616d5a8180b7180fcf869790d48f9fb6e9bf 🔍
VirtualSize 0x1f4
VirtualAddress 0x1c000
SizeOfRawData 0x200
PointerToRawData 0x19600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 3.71477

.rsrc

MD5 22f6784f4a88f622b75f97b8b877b453 🔍
SHA1 a8a827ce3c4e4e96242cc55f1f5f1e94a5ce4c06 🔍
SHA256 db1e8079e8ff4369b40654dc9db2429d37d28c9a8067167f226496641bf6c920 🔍
SHA3 1b5852941fb29efb4d770ee60d4209d6162d447097aaaad4d298f25e0b4257a8 🔍
VirtualSize 0x8a020
VirtualAddress 0x1d000
SizeOfRawData 0x8a200
PointerToRawData 0x19800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.10047

.reloc

MD5 79918e2814a23b917e4a5494067a35d5 🔍
SHA1 eab8dd05e160cbff9fa1c348b6c35e7f161cf459 🔍
SHA256 cccb376562c958fee6ec06051a48d2c5c0232065e1000ce2d4b0775e46737238 🔍
SHA3 0fcd95a99b9b4e77c2e23089f450965a4028a243ef56d1928fdcfcebcc4b7120 🔍
VirtualSize 0x658
VirtualAddress 0xa8000
SizeOfRawData 0x800
PointerToRawData 0xa3a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.87002

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x19004

D3D12SDKPath

Ordinal 2
Address 0x19008

D3D12SDKVersion

Ordinal 3
Address 0xf320

NvOptimusEnablement

Ordinal 4
Address 0x19000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.88297
MD5 b83334f4303498ad7aaf7b3eea877d4c 🔍
SHA1 f37928bf87cda98573004a3c7fa97e1b5aa96fa1 🔍
SHA256 18374b2e21316472cd0082564d9ebd89d37fb24018605fc1e6070361f28bec71 🔍
SHA3 52d48f4544df75452b7d96f1a8b4bab71828c23d150ae2bc1b601e30f33eb657 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.02365
MD5 9eab3e7f1484d7239e4f422a1d7f2e25 🔍
SHA1 f9ad631be08e0c71e9d0202e4eb8b721401d9ea0 🔍
SHA256 0e119848e084672850966d42be26bde4b6dff7fe3964f19ecdc556a4bcaf1d2d 🔍
SHA3 e713837fc3031e8a4e3808535cbd0c1efedcc76a532aa8a7fd41c364e969e3a4 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.07379
MD5 25a79315c100e5963e7fdfca41d203b6 🔍
SHA1 22b2d0fe540b602ab923b2a3f87561a103136346 🔍
SHA256 b663f65b2ebcb1079e9b71da62023ef2cefad92ff348b049b30fda0aa5dfeace 🔍
SHA3 98ff312b729471b3e921db73258e6fba8188e63bf30e238e5d6645b2f0f428f6 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06598
MD5 75a18f14b1343bb5019be36cfbf38dd2 🔍
SHA1 c46cefb82a3a16eecc6b53cf9e54dbdd81533bae 🔍
SHA256 1be8a79728f7d7b38602f25ca53ee6640e007bf6fa7f06eb2b0e413ae972490a 🔍
SHA3 f35a41d9e4efefd96be832f3a7691eeceaba8e94f3cf9bd05a3576f8430ca50c 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.1156
MD5 2eefb52899e2794da32e44b6334824ce 🔍
SHA1 b610a23608cff53c5183ec72b7584b4b637f0b7c 🔍
SHA256 1f4cab3c93a7c8295360552a51ab4b5a7f90639dfd84b22e330e6a650faff6a7 🔍
SHA3 80acc9caaf1839199c496023fba705bc0361bb2efa64ca61b785f0a5178c4218 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.10294
MD5 1405946401ab1bba3cf8cb42a0c3e0a7 🔍
SHA1 b8a3c1b17777f9aba95e480659c080c0b318baea 🔍
SHA256 d9bea30175644e2889b1d4a358f586e528d89791c89ff585cee7c4c727a29d4f 🔍
SHA3 180fe00401fd3ae21f641eabeb1db185a05ebf53fae231d952dda3bb65f38391 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.66422
MD5 d49b5e9e7e576cacba8520dc253ad130 🔍
SHA1 3a8612cef5f13ae647756e7332db6e70fd6eb5f7 🔍
SHA256 1e708ece577135d09862c3e20b2378acb9e0510cbfc90ee4ece59d128192d74d 🔍
SHA3 229ae346375b69c10b1bf1b4905cae884593ba6cf6aa031c77aed6d490b4e367 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.11466
MD5 6771de172c893099eb2828c84956c8fd 🔍
SHA1 e5111675e701fcd6236242e96193ac2718db6f97 🔍
SHA256 1aca9f7d09d2432f3103822bd1ae416c40d4e156e5c5d366525fe2950836c1fa 🔍
SHA3 f0f4e0110e19acaf56be0294924ac446c1da908c5ef9c9e5d0f28a31a923ff23 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.11382
MD5 c35522b17a193566a4dbba1b3dd8e978 🔍
SHA1 b5c10acc2cea380cc4727ce7eafb1d4310a53747 🔍
SHA256 115db0666906e662791a0accbf6b65b6e4d5c3b105dd3647497bd152ef65e482 🔍
SHA3 4a720347db57b9d90f09c48a6cdd905e9c4d538507b7242672db68410a1caa81 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 3bf2dac037ce87794e66ff7f054e913f 🔍
SHA1 52ca961fd37ad960905a681d1db5157508ef1602 🔍
SHA256 2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581 🔍
SHA3 8454d3273522657b5926068082b2cb88f6dbf352e7e9568008c0e33c792f349b 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x214
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49068
MD5 69dcea127718cd731dea745bea11bae8 🔍
SHA1 25ba6e412283d93b0bcda0f215f184f80321f814 🔍
SHA256 c9161335b8d9c151b69899430123d49f262d40cc94784e3a6a5e2a1e3a6515bc 🔍
SHA3 1ac5c42831b174ed0a7fd64ce6e6c8a56e1bdf72ac9163f599de0c3afc6ee569 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x545
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.24993
MD5 9df530c2f4fbe460da74e130d5d351a9 🔍
SHA1 f8719b6c74e0179556c1a18f214d6c1bbff8f823 🔍
SHA256 3c357bd1125971bda05bc59eaeca279da41715741e2535e9e75c94273b1c3a1f 🔍
SHA3 ce3dd46f87bd462f8730fca18daea6df444422f8d88b810aefbd7b2e62536dee 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 6000.0.31.1731
ProductVersion 6000.0.31.1731
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 6000.0.31.10618563
LegalCopyright (c) 2005-2024 Unity Technologies. All rights reserved.
ProductVersion (#2) 6000.0.31f1 (a206c360e2a8)
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2024-Dec-02 22:52:38
Version 0.0
SizeofData 148
AddressOfRawData 0x16d58
PointerToRawData 0x15f58
Referenced File C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2024-Dec-02 22:52:38
Version 0.0
SizeofData 20
AddressOfRawData 0x16dec
PointerToRawData 0x15fec

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Dec-02 22:52:38
Version 0.0
SizeofData 852
AddressOfRawData 0x16e00
PointerToRawData 0x16000

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140019040

RICH Header

XOR Key 0x7139305b
Unmarked objects 0
ASM objects (28900) 5
C++ objects (28900) 138
C objects (28900) 10
Unmarked objects (#2) 1
Imports (28900) 2
C++ objects (33218) 40
C objects (33218) 16
ASM objects (33218) 17
Imports (33523) 3
Total imports 89
C++ objects (33523) 2
Exports (33523) 1
Resource objects (33523) 1
Linker (33523) 1

Errors

Leave a comment

No comments yet.