2abd113031f03cb397e71bf430c60e6da6afefb98f876619134cc4c60f352ecf

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2024-Dec-10 21:18:23
Detected languages English - United States
Debug artifacts C:\build\output\unity\unity\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb
FileVersion 2022.3.55.10434369
LegalCopyright (c) 2005-2024 Unity Technologies. All rights reserved.
ProductVersion 2022.3.55f1 (9f374180d209)

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 84.7496% of the executable.
Safe VirusTotal score: 0/72 (Scanned on 2025-08-16 05:10:32) All the AVs think this file is safe.

Hashes

MD5 0e4812ec197a804863d87ce739469d21 🔍
SHA1 b2a60668409c8bebc1c509626fbe9189a1cc172e 🔍
SHA256 2abd113031f03cb397e71bf430c60e6da6afefb98f876619134cc4c60f352ecf 🔍
SHA3 3300f7500eb4b8539c8dfd6433033782321954c5f40ce69d2a0bf80c8891e687 🔍
SSDeep 6144:z/7FG9mpcJ/OD8xWlMdEgRVKpHa89ykdEDPqORe96LiZyepxk8GA+z+FpQfL2PP:z/744aOD815S93Vc 🔍
Imports Hash ce1183cc150987a99aef5749f22af81e 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2024-Dec-10 21:18:23
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xca00
SizeOfInitializedData 0x97000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001260 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa8000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 c908b9c0303dc1f82726ca4dae00b772 🔍
SHA1 e81e70cb017880d2883f88a85d9a5ba6176ebcc1 🔍
SHA256 6e577d9deae653a5181b5a961bc5d68133d0e0c5371dc8bf2e7a30f6ef4d5cb2 🔍
SHA3 deefbce421cada627162918879ac6eda8099d036762180ad5ebfb4cbd66be7e2 🔍
VirtualSize 0xc8b0
VirtualAddress 0x1000
SizeOfRawData 0xca00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.41078

.rdata

MD5 ebda6cf884b12a4be363577c6d9249ca 🔍
SHA1 3910734c542edff8694ac9ee35d2584f1eab60fe 🔍
SHA256 b64f82cff42a20b0445901318457b3209851c596887736093739e16bef07f27e 🔍
SHA3 b0052b817be2bede65be17a051e1d04f5d42fbd7b3cc4dfdc17ac66c535f40ed 🔍
VirtualSize 0x948a
VirtualAddress 0xe000
SizeOfRawData 0x9600
PointerToRawData 0xce00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.65327

.data

MD5 90815aa5dc65a7dd3f93bad1bd78a77e 🔍
SHA1 608f3e69047b216dda6b0df73c30912e2fef5544 🔍
SHA256 435cb9af1df25f501f68a9700182c4d25de99c3f8e8c1ba6b16c0ca98911ff87 🔍
SHA3 e5ea90d4dd767bfa3d88e3fa2e107c2e40cac10f43498d5abd74f15888477d18 🔍
VirtualSize 0x1d38
VirtualAddress 0x18000
SizeOfRawData 0xc00
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.87032

.pdata

MD5 c69bce38ac69d0b835120a5590e69f0c 🔍
SHA1 c063139b665bfd43ee632f0741b4b5279a71f404 🔍
SHA256 1d79cfdb10b0e6f61968ed084c55a6ae07421354bf9072b12d090926728f3852 🔍
SHA3 5b320838ebff98a9e30dc5b9258ca4079fcb7cde4304c61cfe2dd57bb750842e 🔍
VirtualSize 0xef4
VirtualAddress 0x1a000
SizeOfRawData 0x1000
PointerToRawData 0x17000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.62843

_RDATA

MD5 f87f407c2a1cab208757ad1d23a2de6f 🔍
SHA1 cd739c36958f9ba7505883ae868f1a6ca71e880f 🔍
SHA256 6e4ba525d12ef66132e0738191d3a928ba74c0091a6f82bc48f892a41e2fc242 🔍
SHA3 0611ad194d9c623281cb358dbc2f2d28bb01b6eab682677ec8d16136d74414ab 🔍
VirtualSize 0x94
VirtualAddress 0x1b000
SizeOfRawData 0x200
PointerToRawData 0x18000
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 1.11888

.rsrc

MD5 445dbe5f774def757d088bf133487b25 🔍
SHA1 5b1030bbff38390dccf34d9c851e950a72d25d6c 🔍
SHA256 b78edb630444585d4163b6d48a2262231af4b055878f8dac3a88d7238e329c78 🔍
SHA3 b5c02ee3ca93ba0c41c36e21ea259690c44dadcc0fae80bdd8ecf8803178f0e9 🔍
VirtualSize 0x8a1a0
VirtualAddress 0x1c000
SizeOfRawData 0x8a200
PointerToRawData 0x18200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.93342

.reloc

MD5 ef1e558d46106d87320dd822be1ddc48 🔍
SHA1 10f7b05d107451bd01cf446da512c619fc35bf50 🔍
SHA256 34d7b771018e478ba05cd24ec377fd34919d65ec63c43f49e1ab319785368929 🔍
SHA3 cc295f58e62efe5c59cad1febf1ce620404450135f442c20ba55235b492ddac9 🔍
VirtualSize 0x654
VirtualAddress 0xa7000
SizeOfRawData 0x800
PointerToRawData 0xa2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.84209

Imports

UnityPlayer.dll UnityMain
KERNEL32.dll HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x18004

NvOptimusEnablement

Ordinal 2
Address 0x18000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.7366
MD5 18894771f8ed4763bd83aaddcebc9c26 🔍
SHA1 365bbb51d41b1c927673869c618a531327a7ff55 🔍
SHA256 92fb70cb5fd87195909a2dca1ea321cd218f811c184ed1f09467c4c2f4638492 🔍
SHA3 8e558081463454de877c47dfdf3216b7c23f801f967eb25a91ce8e9043687826 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.84694
MD5 c274d779d9f7154ae719b33c2a6dce37 🔍
SHA1 4954616cfe34de611dcd5ba6ed0577ff65438447 🔍
SHA256 d12b2dcc6c627a78cf93f05890dce886a58fca256cb069939335ce6b9daf7470 🔍
SHA3 304190477bc3eb85dc09f4fe00936283dd1d91155a9af87ace6004fb0f20ba2d 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.99844
MD5 6fec6cb16ac28255b9b333cbadd907ec 🔍
SHA1 9f3ececd8b7f1bad0b71133fa0a1c360d4ac1eba 🔍
SHA256 a8b186144564406864e1a3b2508730bc13ce36fa3beac3351b0469996046f3c2 🔍
SHA3 0c1ebe904c3e5ea52bf2f144ea3db53b3ca7a316f190768d5d983a9ec9b262e5 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.23212
MD5 3601911767b246c4fc86789582bb9f74 🔍
SHA1 0a3aa423faefa58d5518fafce01fd8e2a1f8cf7e 🔍
SHA256 38a0200d6a405b4fc3da86518164474b914174b1c18e8e9573d4facc19cd8d99 🔍
SHA3 db6ca94d78df9326c1b85ba2cc6c089ca7b24815cfb4afd378b8fb475ad98f2e 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.43969
MD5 c50e5754ec138a9236d31f9c11a3ab83 🔍
SHA1 1a74dc6512c007d47c8aefa77a54e7da4b8c9c51 🔍
SHA256 e8c949becbef27ed09eac3e6619f719f74913f3e7fef14135229956854ee3b49 🔍
SHA3 fcf35983060e6096ce0fd31eb51b815c9f954c5d968556d1810c675a7abbfc2d 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.52469
MD5 f0f0190b1419f9e8355ca9cc71228784 🔍
SHA1 e5b1f303b1eb62caa94a593413f71cac45b2d843 🔍
SHA256 ce1dabe56f72573cddc15c036a0dacf777309f3154d70065fd64aca3eba538b5 🔍
SHA3 600074baf4d498eebcabf311030fc42d4a2ad4d03426e6640e270f75c69c80c3 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.89598
MD5 a00641f43f08248d7629ea40429fa3d9 🔍
SHA1 fdd68374730d29162a2e16303185500a2a5e378a 🔍
SHA256 4e7b0da516470cc22700e1927572190b2f603431f13281b2ded12d443e5c8038 🔍
SHA3 bdf109df4481d9edcf103bdc56b5465a8804b65813b9b453548e2da0ffe84988 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.06585
MD5 b3ce5a3d2d16a5976cf5b0ba4d12ab42 🔍
SHA1 c2b3d475151fb5cb1f5ad3167b3d0bb48d0c7928 🔍
SHA256 0b391ea9b7dc130376fbd4ebb567b6642e696d6a70d7c47326def0e2db211247 🔍
SHA3 04eef06de5360f5db78f125c63115fc55c748aa69c0d59ab2b99a5b67d3cf5f0 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.20004
MD5 8b5fef2590595d6375b16fd57cd8fa6b 🔍
SHA1 695583d0240320be89fb1aedea0c30b9439e1691 🔍
SHA256 14d6e9b7b2c18cb26f3f1bb0e48dc6443c9af042a79e3c485bc52b75cea1e773 🔍
SHA3 3826673bc14fe9c16d0c10da00cbc37f44ad1a99dc2b33772161b488efbe3b74 🔍

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 f7731730720cfe035cf030b40d0e2eb6 🔍
SHA1 d046e23f2ee2b93ad96be8e1dc9120ecf3915091 🔍
SHA256 5c92a41adaf3265071482fd1a182ae8702c168636a7d9ff51798ee3a1dfc8500 🔍
SHA3 6f2d12e4c63c131a3f7f48293996e2be05da351536d013affe5d2265965ce657 🔍

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x214
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.52857
MD5 e37907543bedab000532fe87a8dcfeaa 🔍
SHA1 53fe90fabcae047152f62a41e9fe1f2f4730f9d7 🔍
SHA256 27375d13877e7e69386abaa8804ad0f41dd787672664ab2cff9acad6a100ed11 🔍
SHA3 6ced1ae713ad7b367f22e162f2ac0da6583013bf833f8bf19d3945b8d3bb0af5 🔍

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x6c1
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.37708
MD5 aab7e8aafe7b06ab3d003b54ab5e18ed 🔍
SHA1 dccf0408f43059df37b755f3241a8b4b35c728af 🔍
SHA256 fb88b19523afd8fed48eddfd10805a3a0a45997bbf8fac04d595ddf93c1a88a8 🔍
SHA3 a981b8e907b79cd9448766ace938dfd96560d11c29e6ba165912a8508bd52ca7 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 2022.3.55.14145
ProductVersion 2022.3.55.14145
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 2022.3.55.10434369
LegalCopyright (c) 2005-2024 Unity Technologies. All rights reserved.
ProductVersion (#2) 2022.3.55f1 (9f374180d209)
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2024-Dec-10 21:18:23
Version 0.0
SizeofData 143
AddressOfRawData 0x15aec
PointerToRawData 0x148ec
Referenced File C:\build\output\unity\unity\artifacts\WindowsPlayer\Win64_VS2019_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2024-Dec-10 21:18:23
Version 0.0
SizeofData 20
AddressOfRawData 0x15b7c
PointerToRawData 0x1497c

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2024-Dec-10 21:18:23
Version 0.0
SizeofData 768
AddressOfRawData 0x15b90
PointerToRawData 0x14990

TLS Callbacks

Load Configuration

Size 0x138
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140018030

RICH Header

XOR Key 0xe5e06b0d
Unmarked objects 0
ASM objects (28900) 5
C++ objects (28900) 138
C objects (28900) 10
Imports (28900) 2
C++ objects (VS 2015/2017/2019 runtime 29118) 39
C objects (VS 2015/2017/2019 runtime 29118) 16
ASM objects (VS 2015/2017/2019 runtime 29118) 9
Imports (VS2019 Update 8 (16.8.0-1) compiler 29333) 3
Total imports 89
C++ objects (VS2019 Update 8 (16.8.0-1) compiler 29333) 3
Exports (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Resource objects (VS2019 Update 8 (16.8.0-1) compiler 29333) 1
Linker (VS2019 Update 8 (16.8.0-1) compiler 29333) 1

Errors

Leave a comment

No comments yet.