596b6852833f59eea8761d09f996c626b0ce74b615630cb7494ea36a3e42b8ea

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2025-Sep-17 13:22:52
Detected languages English - United States
Debug artifacts C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb
FileVersion 6000.2.6.4869578
LegalCopyright (c) 2005-2025 Unity Technologies. All rights reserved.
ProductVersion 6000.2.6f2 (4a4dcaec6541)

Plugin Output

Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • GetProcAddress
  • LoadLibraryExW
Suspicious The PE is possibly a dropper. Resources amount for 83.3087% of the executable.
Info The PE is digitally signed. Signer: Dire Wolf Digital
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Suspicious No VirusTotal score. This file has never been scanned on VirusTotal.

Hashes

MD5 1e4a524449893f1c9ec9c0a68be1a041
SHA1 7e2cff672091df07c65f06be708240ba383d970d
SHA256 596b6852833f59eea8761d09f996c626b0ce74b615630cb7494ea36a3e42b8ea
SHA3 a8c5b3e75d6b65e679b91b84d7abf8602c0f36db924ef25a03294bf9e63e00b2
SSDeep 12288:HtVwZpUhUXLzKKWHgBmrqbsj0hiihQJO8XwOB6BhWvqOES:H/YWAyqjaxAOB6BsP
Imports Hash a136217cdd3247ff6a8766561064ca0b

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x110

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2025-Sep-17 13:22:52
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0xce00
SizeOfInitializedData 0x97000
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000001264 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0xa7000
SizeOfHeaders 0x400
Checksum 0xa7e7c
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 457fb5274ed18adc024e01b603e258a4
SHA1 159fdb99c377edc82c57d34217a711578edb0e63
SHA256 336709c08beca21a675f029c2d588ac0cae8cc8f42422039cbb827b6284374e5
SHA3 7d6db62af5f0503638e32b2c5a2ebd94056e5e490598ebed73cb0495875d3499
VirtualSize 0xcdb0
VirtualAddress 0x1000
SizeOfRawData 0xce00
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.45019

.rdata

MD5 f8d55f88803f218340b80eb3c9969b29
SHA1 6dcdeb027fdeb6973daadcc8ef63960bd7bf6be0
SHA256 638765f2d99233e40d0843c84cf60a68f333fa3ca078f99c1046ead51c373711
SHA3 87db75c68010e4773575b9248f7841c0fbcfbef548c52a325005659e7663b8e8
VirtualSize 0x977c
VirtualAddress 0xe000
SizeOfRawData 0x9800
PointerToRawData 0xd200
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.69242

.data

MD5 0822db25bce65451a1219de812eea533
SHA1 bf4c918ff2184dfeba8cd4f98b21e11d75de05e7
SHA256 8987031a7fb9e9ffe2b44dad568693d86af933f2b44447b6f5c1159bd0750a79
SHA3 83fbc2d299cd2e5b71ce2f669f319b95fcab94178c620dd04d72a1071efde7b0
VirtualSize 0x1d88
VirtualAddress 0x18000
SizeOfRawData 0xc00
PointerToRawData 0x16a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 1.90767

.pdata

MD5 017f81338461c6b246bdb8ce1bf5fc08
SHA1 aa79861d4dea94c5fd283f1359435734dfb03517
SHA256 d1cc88f6e981b629ad1f47d33507ac8b71f82346871b690375752ffc69c6063d
SHA3 e197cfb7530afb455ed4ebbd26984d4562c62ea8c9c65f07f5d04c80970ee830
VirtualSize 0xec4
VirtualAddress 0x1a000
SizeOfRawData 0x1000
PointerToRawData 0x17600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.60208

.rsrc

MD5 1276359595315521c2e2552a05888bed
SHA1 8df8a8ab5298d8b5084746b03126f50f76fd9e64
SHA256 dbfdfae0c815a2b1c4bda098786cae466ee7cff4b1daf3ae9fbaad537af35cb7
SHA3 c2ebda303f4797d2e87fcf65b65f25752669a40cc2462f226b231b55df06fdcf
VirtualSize 0x8a018
VirtualAddress 0x1b000
SizeOfRawData 0x8a200
PointerToRawData 0x18600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.50878

.reloc

MD5 3ab8a3a955e5040e25556085e21a2be2
SHA1 f29b173f0ea430d70ff0803cbaa89fa1d4d024d9
SHA256 119eed3c019ffdb0bba4cee06b80d85e78a679f1bb17317cbb6a352bb4102d7a
SHA3 a5c3cb0725d2fd68e14265c6e03629d6270e73c1f049eb78b3e40b7b2535d802
VirtualSize 0x658
VirtualAddress 0xa6000
SizeOfRawData 0x800
PointerToRawData 0xa2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 4.86735

Imports

UnityPlayer.dll UnityMain2
KERNEL32.dll HeapAlloc
WriteConsoleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
CloseHandle
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
CreateFileW

Delayed Imports

AmdPowerXpressRequestHighPerformance

Ordinal 1
Address 0x18004

D3D12SDKPath

Ordinal 2
Address 0x18008

D3D12SDKVersion

Ordinal 3
Address 0xe320

NvOptimusEnablement

Ordinal 4
Address 0x18000

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.09025
MD5 1af4ee0ae9f0f4d8b2b1436fc883c92e
SHA1 07072a00c484c92f18f1ea9e31188458601be9d0
SHA256 41bae74eefd2f5fcfde4b63185a1d225b4d123e6c79dd3942059da4d53177fc7
SHA3 e41df58f61e2e11ab20ff696fbe9454f9802181653aa25a04505208bd078d5e4

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.28464
MD5 1037b857a890366061c97a2661eb791d
SHA1 26ea2ebced8e2bcb677c3b3786ce1a2dd7e662c6
SHA256 8c4addb8cb7ce4afca907e487b0af7366e6607cde8e432284e0402d790d28931
SHA3 69d349dbc03d1af99d2b6b1fd886dd82fbf66472afb8cd532dad9d1dee3f330a

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.40782
MD5 9bd62e8bcb79f62cbd4b25459bea4d06
SHA1 aff40b1597e61f2423f75f070e221b3905b2bd8c
SHA256 a50886a441e6f6159c3e5b080b664a2f9434258dbb39074cc3e2a9e4d92c38b5
SHA3 a193ea8638343fb29065b52cb47580a0b1e662af5fa185500bb2c7fa20240150

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.41676
MD5 291db9859c363b20a5ed4d9146a28b6a
SHA1 ba4172f118fcc8e3d195767312061465c7da8cc6
SHA256 f7f57a5fe2257d2e8ae86d69985a489d193f72097d4c87d92c3e5b3c29e1c67f
SHA3 43ac6e0ed9e183b30315666e1f0bb82057bae3e84486287db4cc58012322e4ef

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.48713
MD5 fb167c651384cbb2da14a93bb011da43
SHA1 62341a7a82e3aa847e2f07970f1d852ba771f9ad
SHA256 b12996d94cb79d8575f1652a9027cffa35d5a9367bba62c73480ea0ec6c675ad
SHA3 d9425ebe223f9efb4c7716bcd552a078f2c1803b0d4d473daec2575f9501a287

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x94a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.50528
MD5 bbdfed66bad31f637aa11ff5ea8ccb97
SHA1 90b11f1eab354501758cd005edcba31ed8ffd842
SHA256 4396dc67d8d3e41ee25c49b66b6990c1739e979e7bc88875821732c90fdfe696
SHA3 3228a1cb414b420aa0232ab4e8c8f38e62e9ba82e5384bc44fc92bd99cbee080

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10828
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.50712
MD5 a12ad5bda209e7dcb57a410657b84a92
SHA1 502ada59ac5d932e22c0d2e2554ab89d239fc5e7
SHA256 6eeda3c607eea700926f295e048e361e56cf2671fd884d4534546239b06a84c5
SHA3 dd0628f8549e7764c49ec51cd40f152d6c65a4c74f1f8a4d0a8d9d4b85758818

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.51037
MD5 81bf8a23d25a901649bc57ac58f31ec0
SHA1 a6d20577d2d5951fc0ed6d04f2ecc3a43603070a
SHA256 c75337787e61ce8ed80a76770f013fdc1516d0a367258473ecd79ce71728c362
SHA3 286c2e3def7eb622f802c86b247c79e0b110425ee0fb21ee8d4ce78f2c19d278

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x42028
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 6.49643
MD5 6e2634fdf0e6ef2d9e9d35c1ebb91a3b
SHA1 f5046d6ccc8dfcddcdfec19724d5556b3c3ab6d1
SHA256 c3d377020dfeab7cf12e575d73ebda514977809618838d9e22d1c0c2c396b5a0
SHA3 c43ef7f9b514677d59ba4d66c7c584e1620017b4b8c181af7617e387d12dc0dc

103

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0x84
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.04448
Detected Filetype Icon file
MD5 3bf2dac037ce87794e66ff7f054e913f
SHA1 52ca961fd37ad960905a681d1db5157508ef1602
SHA256 2a87b1f32c5d0435090c72c392b75394f706e5750eff64fd85d25e1c622ee581
SHA3 8454d3273522657b5926068082b2cb88f6dbf352e7e9568008c0e33c792f349b

1 (#2)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x20c
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.54399
MD5 4275a4136c6f7b44f16ed56a53a338fd
SHA1 c4c3730074b61b0b4badf299d6447ad364b7d7d5
SHA256 2a03cd50f50381ae902aeb2122281a0dd52c9c3ac08bf03a67fa1cb81bf2d349
SHA3 5d8386dd221f72895fb87e1339cef7da174a28c08a1bb80a3f78f717fb675497

1 (#3)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x545
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.24993
MD5 9df530c2f4fbe460da74e130d5d351a9
SHA1 f8719b6c74e0179556c1a18f214d6c1bbff8f823
SHA256 3c357bd1125971bda05bc59eaeca279da41715741e2535e9e75c94273b1c3a1f
SHA3 ce3dd46f87bd462f8730fca18daea6df444422f8d88b810aefbd7b2e62536dee

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 6000.2.6.19914
ProductVersion 6000.2.6.19914
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_UNKNOWN
Language English - United States
FileVersion (#2) 6000.2.6.4869578
LegalCopyright (c) 2005-2025 Unity Technologies. All rights reserved.
ProductVersion (#2) 6000.2.6f2 (4a4dcaec6541)
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2025-Sep-17 13:22:52
Version 0.0
SizeofData 148
AddressOfRawData 0x15d68
PointerToRawData 0x14f68
Referenced File C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_i_r\WindowsPlayer_player_Master_il2cpp_x64.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2025-Sep-17 13:22:52
Version 0.0
SizeofData 20
AddressOfRawData 0x15dfc
PointerToRawData 0x14ffc

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2025-Sep-17 13:22:52
Version 0.0
SizeofData 836
AddressOfRawData 0x15e10
PointerToRawData 0x15010

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140018040

RICH Header

XOR Key 0x7914df52
Unmarked objects 0
ASM objects (28900) 5
C++ objects (28900) 138
C objects (28900) 10
Imports (28900) 2
ASM objects (34321) 9
C objects (34321) 16
C++ objects (34321) 40
Imports (34433) 3
Total imports 89
C++ objects (34433) 2
Exports (34433) 1
Resource objects (34433) 1
Linker (34433) 1

Errors

Leave a comment

No comments yet.