GameSaveManager_3[.]1[.]517[.]0[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

GameSaveManager_3.1.517.0.zip
Size

8.6MB
MD5

1bf6b803566d8976d61014b350b588c8
SHA1

c8512604066168178162ed6c58e355bdadb4efb8
SHA256

8f1bc529e7415b2c13b2425dbe3504bad29e11de53c7fedd6b85945644ae1fb5
SHA512

08b8e1fcfe88cd269544af50fb7d3eafee3e9badb0552bdfdb0fd3c5a1eeadff713dc6a071d5d07a0cfe4f06c10e8851db3e32f87d6e0fe2709fb2d29fed56f0
SSDEEP

196608:n+RROeYjvVBy4bJE+m/HVL6Kz4uRL25+TAJmLX2CESP1BBPtD:nZzz2oE+gH9FPAJmkKBPtD

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
static1/unpack001/gs_mngr_3.exe	upx

Files

GameSaveManager_3.1.517.0.zip
.zip
Known Issues.txt
bin/7z.exe
.exe windows x64

6e09a21f99222f0db6d234115575bc66

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysStringLen
VariantClear
VariantCopy
SysAllocString
SysFreeString
SysAllocStringLen

user32

CharUpperW
CharPrevExA

advapi32

OpenProcessToken
SystemFunction036
GetFileSecurityW
SetFileSecurityW
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey

msvcrt

_c_exit
_XcptFilter
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
__C_specific_handler
_beginthreadex
exit
_isatty
realloc
memset
strlen
wcsstr
wcscmp
_exit
memmove
fflush
fputc
fputs
_iob
fgetc
fclose
free
malloc
memcmp
_purecall
__CxxFrameHandler
_CxxThrowException
memcpy
_cexit
__getmainargs
__initenv
_initterm
__setusermatherr
_commode
_fmode
__set_app_type
strcmp

kernel32

SetThreadAffinityMask
CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
GetVersionExW
SetFileTime
ResumeThread
WaitForSingleObject
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
GetConsoleMode
SetConsoleMode
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
GetProcessTimes
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteCriticalSection
SetProcessAffinityMask
OpenEventW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
WaitForMultipleObjects
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatusEx
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
SetLastError
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetLogicalDriveStringsW
DeviceIoControl
GetFileSize
SetFilePointer

Sections

.text
Size: 917KB - Virtual size: 916KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 247KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/7za.exe
.exe windows x86

abae283b9febd6b6c99aae6c6b3d9202

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear

user32

CharPrevExA
CharUpperW

advapi32

OpenProcessToken
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
LookupPrivilegeValueW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
exit
_ftol
realloc
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
malloc
memcmp
_purecall
memcpy
_CxxThrowException
__CxxFrameHandler
_isatty
_fileno

kernel32

CreateEventW
SetEvent
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
ResumeThread
SetFileAttributesW
WaitForSingleObject
InterlockedIncrement
VirtualFree
VirtualAlloc
GetOEMCP
LocalFileTimeToFileTime
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
SetFileTime
CreateFileW
ReadFile
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
GetLogicalDriveStringsW
GetFileSize
SetFilePointer
DeviceIoControl
SetThreadAffinityMask

Sections

.text
Size: 672KB - Virtual size: 672KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Plugins/FTP/FTP.lmd
.dll windows x86

bb89fb53a85dd0a1ae3244c8f323d12e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lua5.1

lua_gettop
lua_pushboolean
lua_error
lua_tonumber
luaL_openlib
lua_isnumber
lua_toboolean
lua_type
lua_tolstring
lua_isstring
lua_remove
lua_pcall
lua_pushvalue
lua_gettable
lua_pushlstring
lua_pushstring
lua_settable
lua_settop
lua_pushnumber
lua_pushnil
lua_createtable
lua_getfield

kernel32

HeapSize
HeapQueryInformation
SetStdHandle
GetFileType
IsValidCodePage
VirtualQuery
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetTimeZoneInformation
IsProcessorFeaturePresent
LCMapStringW
GetStdHandle
SetHandleCount
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetStringTypeW
CompareStringW
GetConsoleCP
GetConsoleMode
WriteConsoleW
CreateFileW
SetEnvironmentVariableA
GetSystemInfo
VirtualAlloc
RaiseException
HeapFree
HeapAlloc
GetCommandLineA
GetDateFormatA
GetTimeFormatA
DecodePointer
EncodePointer
RtlUnwind
GetSystemTimeAsFileTime
FindResourceExW
VirtualProtect
SearchPathA
Sleep
GetProfileIntA
InitializeCriticalSectionAndSpinCount
GetNumberFormatA
GetWindowsDirectoryA
GetACP
GetOEMCP
GetCPInfo
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetSystemDirectoryW
GlobalFlags
GetCurrentDirectoryA
FindResourceA
FreeResource
GlobalFindAtomA
GetVersionExA
LoadLibraryW
lstrcmpW
GlobalGetAtomNameA
SetErrorMode
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
CreateThread
LocalAlloc
GetCurrentProcess
DuplicateHandle
UnlockFile
LockFile
FlushFileBuffers
lstrcmpiA
GetCurrentProcessId
GlobalAddAtomA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
WaitForSingleObject
ResumeThread
SetThreadPriority
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
GetModuleFileNameA
GetUserDefaultUILanguage
ConvertDefaultLocale
GetSystemDefaultUILanguage
GetLocaleInfoA
LoadLibraryExA
CompareStringA
LoadLibraryA
GetModuleHandleW
GetProcAddress
lstrcmpA
FreeLibrary
InterlockedDecrement
GetModuleFileNameW
ActivateActCtx
ReleaseActCtx
CreateActCtxW
DeactivateActCtx
GlobalFree
CopyFileA
GlobalSize
GlobalAlloc
GlobalLock
GlobalUnlock
FormatMessageA
LocalFree
lstrlenW
MultiByteToWideChar
MulDiv
SetLastError
WriteFile
DeleteFileA
GetFileSize
GetLastError
SetEndOfFile
GetTempPathA
GetTempFileNameA
GetTickCount
lstrlenA
lstrcpyA
GetFileAttributesA
InterlockedIncrement
GetFullPathNameA
GetVolumeInformationA
lstrcpynA
FindFirstFileA
FindClose
FileTimeToLocalFileTime
FileTimeToSystemTime
CreateFileA
SetFilePointer
ReadFile
InterlockedExchange
CloseHandle
WideCharToMultiByte
FindResourceW
LoadResource
LockResource
SizeofResource
ExitThread
ExitProcess
LeaveCriticalSection
HeapReAlloc
UnhandledExceptionFilter
lstrcatA

user32

IsCharLowerA
GetKeyNameTextA
MapVirtualKeyExA
SubtractRect
MapDialogRect
DrawIcon
DestroyCursor
GetWindowRgn
TranslateMDISysAccel
DrawMenuBar
DefMDIChildProcA
DefFrameProcA
UnpackDDElParam
ReuseDDElParam
LoadMenuA
LoadAcceleratorsA
InsertMenuItemA
TranslateAcceleratorA
GetNextDlgGroupItem
LoadImageA
CopyImage
GetIconInfo
EnableScrollBar
HideCaret
InvertRect
GetMenuDefaultItem
CreateDialogIndirectParamA
GetNextDlgTabItem
EndDialog
LockWindowUpdate
BringWindowToTop
SetCursorPos
SetRect
CreateAcceleratorTableA
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
MapVirtualKeyA
ToAsciiEx
CopyAcceleratorTableA
DrawFocusRect
DrawFrameControl
DrawEdge
DrawIconEx
DrawStateA
MessageBeep
ReleaseCapture
SetCapture
GetSystemMenu
LoadMenuW
SetClassLongA
GetAsyncKeyState
NotifyWinEvent
WindowFromPoint
CreatePopupMenu
DestroyAcceleratorTable
SetParent
RedrawWindow
SetWindowRgn
IsZoomed
OffsetRect
IsRectEmpty
IntersectRect
DestroyMenu
GetMenuItemInfoA
InflateRect
DestroyIcon
IsIconic
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
SystemParametersInfoA
SetRectEmpty
KillTimer
SetTimer
InvalidateRect
GetDesktopWindow
RealChildWindowFromPoint
EndPaint
BeginPaint
GetWindowDC
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
FillRect
DeleteMenu
RegisterWindowMessageA
GetDoubleClickTime
LoadIconA
WinHelpA
IsChild
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
GetForegroundWindow
SetActiveWindow
BeginDeferWindowPos
EndDeferWindowPos
GetTopWindow
GetMessageTime
GetMessagePos
MonitorFromWindow
GetMonitorInfoA
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
SetForegroundWindow
ShowScrollBar
UpdateWindow
GetClientRect
GetClassInfoExA
AdjustWindowRectEx
GetWindowRect
ScreenToClient
EqualRect
DeferWindowPos
GetScrollInfo
SetScrollInfo
CopyRect
PtInRect
SetWindowPlacement
GetWindowPlacement
CallWindowProcA
GetMenu
LoadCursorA
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
UnregisterClassA
GetSystemMetrics
GetWindowThreadProcessId
GetLastActivePopup
MessageBoxA
ShowOwnedPopups
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
ModifyMenuA
EnableMenuItem
CheckMenuItem
PostMessageA
GetWindowTextLengthA
GetWindowTextA
GetFocus
SetFocus
SetWindowPos
GetParent
EnableWindow
IsWindowEnabled
ShowWindow
MoveWindow
GetDlgCtrlID
SetWindowTextA
IsDialogMessageA
CharUpperBuffA
CopyIcon
RegisterClipboardFormatA
LoadImageW
EmptyClipboard
CloseClipboard
SetClipboardData
OpenClipboard
GetUpdateRect
FrameRect
IsClipboardFormatAvailable
SetMenuDefaultItem
WaitMessage
PostThreadMessageA
SendDlgItemMessageA
GetDlgItem
CheckDlgButton
GetWindow
UnhookWindowsHookEx
CreateMenu
IsMenu
UpdateLayeredWindow
UnionRect
LoadIconW
MonitorFromPoint
GetMenuState
GetMenuStringA
AppendMenuA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
GetClassInfoA
RegisterClassA
CreateWindowExA
SendMessageA
DestroyWindow
GetWindowLongA
DefWindowProcA
SetWindowLongA
DispatchMessageA
TranslateMessage
wsprintfA
IsWindow
CharUpperA
PeekMessageA
PostQuitMessage
ClientToScreen

gdi32

DeleteDC
CreatePatternBrush
CreateCompatibleDC
GetStockObject
SelectPalette
GetObjectType
CreatePen
CreateSolidBrush
SetViewportExtEx
CreateHatchBrush
CreateDIBitmap
CreateFontIndirectA
CreateCompatibleBitmap
CreateRectRgnIndirect
GetTextMetricsA
EnumFontFamiliesA
GetTextCharsetInfo
GetTextExtentPoint32A
SetRectRgn
CombineRgn
PatBlt
DPtoLP
CreateDIBSection
CreateRoundRectRgn
CreatePolygonRgn
GetBkColor
GetTextColor
CreateEllipticRgn
Polyline
Ellipse
Polygon
CreatePalette
ExtSelectClipRgn
GetNearestPaletteIndex
RealizePalette
OffsetRgn
GetRgnBox
SetDIBColorTable
StretchBlt
SetPixel
Rectangle
EnumFontFamiliesExA
LPtoDP
GetWindowOrgEx
GetViewportOrgEx
PtInRegion
FillRgn
FrameRgn
GetBoundsRect
ExtFloodFill
SetPaletteEntries
GetTextFaceA
SetPixelV
OffsetViewportOrgEx
SetViewportOrgEx
SelectObject
GetPaletteEntries
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetClipBox
SetMapMode
SetROP2
SetPolyFillMode
SetBkMode
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
CreateBitmap
CreateDCA
CopyMetaFileA
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
GetSystemPaletteEntries
GetDeviceCaps
GetPixel
BitBlt
GetWindowExtEx
GetViewportExtEx
CreateRectRgn
SelectClipRgn
DeleteObject
SetLayout
GetLayout
SetTextAlign
MoveToEx
LineTo
IntersectClipRect
ExcludeClipRect
ScaleViewportExtEx

msimg32

TransparentBlt
AlphaBlend

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
OpenPrinterA
ClosePrinter

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyA
RegCloseKey
RegEnumValueA
RegQueryValueA

shell32

SHAppBarMessage
FindExecutableA
SHGetFileInfoA
SHGetDesktopFolder
SHBrowseForFolderA
ShellExecuteA
DragQueryFileA
DragFinish
SHGetSpecialFolderLocation
SHGetPathFromIDListA

comctl32

ImageList_GetIconSize

shlwapi

PathFindFileNameA
PathStripToRootA
PathIsUNCA
PathFindExtensionA
PathRemoveFileSpecW

ole32

CoTaskMemFree
ReleaseStgMedium
CoTaskMemAlloc
OleDuplicateData
CoCreateGuid
CoCreateInstance
CoUninitialize
CoInitialize
CoInitializeEx
RevokeDragDrop
CoLockObjectExternal
RegisterDragDrop
OleGetClipboard
DoDragDrop
CreateStreamOnHGlobal
OleLockRunning
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor

oleaut32

VariantChangeType
VariantClear
SysStringLen
SysAllocStringLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VarBstrFromDate
VariantInit
SysAllocString
SysFreeString

wsock32

closesocket
shutdown
recv
send
inet_ntoa
select
htonl
getsockname
ntohs
inet_addr
accept
sendto
ioctlsocket
htons
recvfrom
setsockopt
gethostbyname
WSAGetLastError
WSAStartup
WSACleanup
gethostname
socket
connect
bind
listen

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

gdiplus

GdipCreateBitmapFromStream
GdipDrawImageI
GdipGetImageGraphicsContext
GdipBitmapUnlockBits
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDrawImageRectI
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipBitmapLockBits
GdipCreateBitmapFromScan0

imm32

ImmGetOpenStatus
ImmReleaseContext
ImmGetContext

winmm

PlaySoundA

Exports

Exports

irPlg_Action_RegisterActions
irPlg_GetAuthorInfo
irPlg_GetLuaVersion
irPlg_GetPluginActionXML
irPlg_GetPluginName
irPlg_GetPluginVersion
irPlg_GetSDKVersion
irPlg_ShowHelpForAction
irPlg_ShowHelpForPlugin
irPlg_ValidateLicense

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 266KB - Virtual size: 265KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 104KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Plugins/SHAPE/SHAPE.APO
.dll windows x86

96c912c7e683eb60ac64ab8b4fe0567d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

lua5.1

lua_pcall
luaL_openlib
lua_isnumber
lua_tonumber
lua_getfield
lua_pushstring
lua_gettable
lua_remove
lua_type
lua_pushnumber
lua_tolstring
lua_error
lua_gettop

kernel32

RtlUnwind
GetCommandLineA
RaiseException
HeapAlloc
HeapFree
ExitProcess
TerminateProcess
HeapSize
HeapReAlloc
GetACP
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
SetUnhandledExceptionFilter
LCMapStringA
LCMapStringW
VirtualAlloc
IsBadWritePtr
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
FlushFileBuffers
SetFilePointer
WriteFile
GetCurrentProcess
WritePrivateProfileStringA
GetOEMCP
GetCPInfo
GetProcessVersion
GlobalFlags
GetLastError
SetErrorMode
TlsGetValue
LocalReAlloc
TlsSetValue
EnterCriticalSection
GlobalReAlloc
LeaveCriticalSection
TlsFree
GlobalHandle
DeleteCriticalSection
TlsAlloc
InitializeCriticalSection
LocalAlloc
CloseHandle
GetModuleFileNameA
LocalFree
GlobalAlloc
GetCurrentThread
lstrcpynA
GlobalFree
GlobalLock
GlobalUnlock
MulDiv
SetLastError
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
FreeLibrary
FindResourceA
LoadResource
LockResource
GetVersion
lstrcatA
GetCurrentThreadId
GlobalGetAtomNameA
lstrcmpiA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
GetModuleHandleA
GetProcAddress
GetFileAttributesA
lstrcmpA
lstrlenA
FreeEnvironmentStringsW
lstrcpyA

user32

SendDlgItemMessageA
UpdateWindow
PostMessageA
LoadIconA
wvsprintfA
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
IsWindowEnabled
GetNextDlgTabItem
EnableMenuItem
CheckMenuItem
SetMenuItemBitmaps
ModifyMenuA
GetMenuState
LoadBitmapA
GetMenuCheckMarkDimensions
ClientToScreen
GetDC
ReleaseDC
BeginPaint
EndPaint
TabbedTextOutA
DrawTextA
GrayStringA
WindowFromPoint
GetCursorPos
CreateDialogIndirectParamA
GetActiveWindow
EndDialog
PostQuitMessage
SetCursor
ValidateRect
TranslateMessage
GetMessageA
UnregisterClassA
GetClassNameA
LoadCursorA
GetSysColorBrush
DestroyMenu
LoadStringA
MapWindowPoints
PeekMessageA
DispatchMessageA
GetFocus
SetActiveWindow
SetFocus
AdjustWindowRectEx
ScreenToClient
IsWindowVisible
GetTopWindow
MessageBoxA
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextLengthA
GetWindowTextA
GetDlgCtrlID
GetKeyState
DestroyWindow
CreateWindowExA
SetWindowsHookExA
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
RemovePropA
DefWindowProcA
GetMessageTime
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
GetWindow
GetWindowLongA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
IsIconic
GetWindowPlacement
wsprintfA
InvalidateRect
ReleaseCapture
GetMessagePos
PtInRect
GetClientRect
GetCapture
SetCapture
SystemParametersInfoA
EnableWindow
SetRect
IsWindow
RedrawWindow
CopyRect
GetSystemMetrics
DrawFrameControl
DrawEdge
InflateRect
OffsetRect
DrawFocusRect
GetWindowRect
GetParent
SendMessageA
GetSysColor
CallNextHookEx
CallWindowProcA

gdi32

Rectangle
GetDeviceCaps
DeleteObject
Ellipse
RoundRect
SelectObject
GetStockObject
CreateSolidBrush
GetClipBox
SetTextColor
SetBkColor
GetObjectA
CreateBitmap
DeleteDC
SaveDC
RestoreDC
SelectPalette
SetBkMode
SetMapMode
SetViewportOrgEx
OffsetViewportOrgEx
SetViewportExtEx
CreatePen
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
GetTextExtentPoint32A
CreateFontIndirectA
PtVisible
RectVisible
TextOutA
ExtTextOutA
Escape
CreatePalette
RealizePalette

comdlg32

ChooseColorA

winspool.drv

ClosePrinter
DocumentPropertiesA
OpenPrinterA

advapi32

RegCloseKey
RegCreateKeyExA
RegOpenKeyExA
RegSetValueExA

shell32

ShellExecuteA

comctl32

ord17

Exports

Exports

irPlg_GetAuthorInfo
irPlg_GetIRPluginObjectVersion
irPlg_GetLuaVersion
irPlg_GetPluginActionXML
irPlg_GetPluginName
irPlg_GetPluginVersion
irPlg_GetSDKVersion
irPlg_Object_CreateObject
irPlg_Object_DeleteObject
irPlg_ShowHelpForAction
irPlg_ShowHelpForPlugin
irPlg_ValidateLicense

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
bin/Plugins/SQLite3/SQLite3.lmd
.dll windows x86

c80e57c24891a3a8ece58981a30da8c8

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
GetProcAddress
VirtualAlloc
VirtualFree

lua5.1

lua_settable

shell32

ShellExecuteA

Exports

Exports

irPlg_Action_RegisterActions
irPlg_GetAuthorInfo
irPlg_GetLuaVersion
irPlg_GetPluginActionXML
irPlg_GetPluginName
irPlg_GetPluginVersion
irPlg_GetSDKVersion
irPlg_ShowHelpForPlugin
irPlg_ValidateLicense

Sections

.text
Size: 188KB - Virtual size: 428KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/Plugins/sb_Windows7.png
.png
bin/SteamSpreader_gcf.ini
bin/config.ini.bk
bin/dat01/ap1.dat
bin/dat01/ap10.dat
.png
bin/dat01/ap11.dat
.png
bin/dat01/ap12.dat
.png
bin/dat01/ap13.dat
.png
bin/dat01/ap14.dat
.png
bin/dat01/ap15.dat
.png
bin/dat01/ap16.dat
.png
bin/dat01/ap17.dat
.png
bin/dat01/ap18.dat
.png
bin/dat01/ap19.dat
.png
bin/dat01/ap2.dat
.png
bin/dat01/ap20.dat
.png
bin/dat01/ap21.dat
.png
bin/dat01/ap22.dat
.png
bin/dat01/ap23.dat
.png
bin/dat01/ap24.dat
.png
bin/dat01/ap25.dat
.png
bin/dat01/ap26.dat
.png
bin/dat01/ap27.dat
.png
bin/dat01/ap28.dat
.png
bin/dat01/ap29.dat
.png
bin/dat01/ap3.dat
.png
bin/dat01/ap30.dat
.png
bin/dat01/ap31.dat
.png
bin/dat01/ap32.dat
.png
bin/dat01/ap33.dat
.png
bin/dat01/ap34.dat
.png
bin/dat01/ap35.dat
.png
bin/dat01/ap36.dat
.png
bin/dat01/ap37.dat
.png
bin/dat01/ap38.dat
.png
bin/dat01/ap39.dat
.png
bin/dat01/ap4.dat
.png
bin/dat01/ap40.dat
.png
bin/dat01/ap41.dat
.png
bin/dat01/ap42.dat
.png
bin/dat01/ap43.dat
.png
bin/dat01/ap44.dat
.png
bin/dat01/ap45.dat
.png
bin/dat01/ap46.dat
.png
bin/dat01/ap47.dat
.png
bin/dat01/ap48.dat
.png
bin/dat01/ap49.dat
.png
bin/dat01/ap5.dat
.png
bin/dat01/ap50.dat
.png
bin/dat01/ap51.dat
.png
bin/dat01/ap52.dat
.gif
bin/dat01/ap53.dat
.png
bin/dat01/ap54.dat
.png
bin/dat01/ap55.dat
.png
bin/dat01/ap56.dat
.png
bin/dat01/ap57.dat
.png
bin/dat01/ap58.dat
.png
bin/dat01/ap59.dat
.png
bin/dat01/ap6.dat
.png
bin/dat01/ap7.dat
.png
bin/dat01/ap8.dat
.png
bin/dat01/ap9.dat
.png
bin/games.db
bin/icons_cmd
bin/icons_debug
bin/icons_gsba
bin/icons_gsdu
bin/icons_gsms
bin/icons_task
bin/icons_uninstall
bin/junction.exe
.exe windows x86

3affd188264f59594a90b036270f340e

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:cf:3e:00:00:00:00:00:0f
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/12/2009, 22:40

Not After

07/03/2011, 22:40

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:05:a2:30:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:01

Not After

25/07/2013, 19:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:85D3-305C-5BCF,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

72:96:cb:3c:cf:4a:19:97:6d:61:01:7d:1b:ad:e8:cf:2e:da:d0:b2
Signer

Actual PE Digest

72:96:cb:3c:cf:4a:19:97:6d:61:01:7d:1b:ad:e8:cf:2e:da:d0:b2

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

07/09/2010, 22:38
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileW
RemoveDirectoryW
CreateDirectoryW
GetVolumeInformationW
GetFullPathNameW
GetCurrentDirectoryW
CompareStringW
FindNextFileW
CreateFileA
GetTimeZoneInformation
GetLocaleInfoW
HeapSize
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FindClose
CreateFileW
GetLastError
GetFileAttributesW
DeviceIoControl
FormatMessageW
CloseHandle
GetCommandLineW
GetProcAddress
LocalAlloc
LoadLibraryW
LocalFree
CompareStringA
GetModuleHandleW
HeapAlloc
HeapFree
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
Sleep
ExitProcess
DeleteCriticalSection
FatalAppExitA
VirtualFree
VirtualAlloc
HeapCreate
HeapDestroy
WriteFile
GetStdHandle
GetModuleFileNameA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
GetCurrentThread
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GetStartupInfoA
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
SetFilePointer
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEnvironmentVariableA

user32

DialogBoxIndirectParamW
GetDlgItem
GetSysColorBrush
EndDialog
SetWindowTextW
LoadCursorW
SetCursor
InflateRect
SendMessageW

gdi32

SetMapMode
StartDocW
StartPage
EndPage
EndDoc
GetDeviceCaps

comdlg32

PrintDlgW

advapi32

RegQueryValueExW
RegSetValueExW
RegCloseKey
RegCreateKeyW

Sections

.text
Size: 110KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
bin/md5.exe
.exe windows x86

a440a8b83507b2f137d344cedae2c199

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
ExitProcess
GetModuleHandleA
GetCommandLineA
GetVersionExA
GetACP
GetOEMCP
GetCPInfo
FindNextFileA
FindFirstFileA
FindClose
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapFree
GetLastError
CloseHandle
ReadFile
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
WriteFile
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
VirtualProtect
GetSystemInfo
VirtualQuery
GetLocaleInfoA
LoadLibraryA
HeapSize
SetEndOfFile
RtlUnwind

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bin/releasehistory.db
bin/script
bin/scripts/Anno2070
bin/scripts/SidMeier'sCivilizationV
bin/scripts/TheElderScrollsVSkyrim
bin/scripts/TheWitcher2AssassinsofKings-EnhancedEdition
commandline_help.bat
debug_mode.bat
gs_mngr_3.cdd
.zip
gs_mngr_3.exe
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 4.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 145KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lang/czech/backup.xml
.xml
lang/czech/customentries.xml
.xml
lang/czech/global.xml
.xml
lang/czech/info.ini
lang/czech/mainmenu.xml
.xml
lang/czech/restore.xml
.xml
lang/czech/scheduled.xml
.xml
lang/czech/settings.xml
.xml
lang/czech/steamspreader.xml
.xml
lang/czech/sync&link.xml
.xml
lang/czech/updates.xml
.xml
lang/english/backup.xml
.xml
lang/english/customentries.xml
.xml
lang/english/global.xml
.xml
lang/english/info.ini
lang/english/mainmenu.xml
.xml
lang/english/restore.xml
.xml
lang/english/scheduled.xml
.xml
lang/english/settings.xml
.xml
lang/english/steamspreader.xml
.xml
lang/english/sync&link.xml
.xml
lang/english/updates.xml
.xml
lang/french/backup.xml
.xml
lang/french/customentries.xml
.xml
lang/french/global.xml
.xml
lang/french/info.ini
lang/french/mainmenu.xml
.xml
lang/french/restore.xml
.xml
lang/french/scheduled.xml
.xml
lang/french/settings.xml
.xml
lang/french/steamspreader.xml
.xml
lang/french/sync&link.xml
.xml
lang/french/updates.xml
.xml
lang/german/backup.xml
.xml
lang/german/customentries.xml
.xml
lang/german/global.xml
.xml
lang/german/info.ini
lang/german/mainmenu.xml
lang/german/restore.xml
lang/german/scheduled.xml
.xml
lang/german/settings.xml
.xml
lang/german/steamspreader.xml
.xml
lang/german/sync&link.xml
.xml
lang/german/updates.xml
.xml
lang/hungarian/backup.xml
.xml
lang/hungarian/customentries.xml
.xml
lang/hungarian/global.xml
.xml
lang/hungarian/info.ini
lang/hungarian/mainmenu.xml
.xml
lang/hungarian/restore.xml
.xml
lang/hungarian/scheduled.xml
.xml
lang/hungarian/settings.xml
.xml
lang/hungarian/steamspreader.xml
.xml
lang/hungarian/sync&link.xml
.xml
lang/hungarian/updates.xml
.xml
lang/italian/backup.xml
.xml
lang/italian/customentries.xml
.xml
lang/italian/global.xml
.xml
lang/italian/info.ini
lang/italian/mainmenu.xml
.xml
lang/italian/restore.xml
.xml
lang/italian/scheduled.xml
.xml
lang/italian/settings.xml
.xml
lang/italian/steamspreader.xml
.xml
lang/italian/sync&link.xml
.xml
lang/italian/updates.xml
.xml
lang/portuguese/backup.xml
lang/portuguese/customentries.xml
lang/portuguese/global.xml
lang/portuguese/info.ini
lang/portuguese/mainmenu.xml
lang/portuguese/restore.xml
lang/portuguese/scheduled.xml
lang/portuguese/settings.xml
lang/portuguese/steamspreader.xml
lang/portuguese/sync&link.xml
lang/portuguese/updates.xml
lang/russian/backup.xml
.xml
lang/russian/customentries.xml
.xml
lang/russian/global.xml
.xml
lang/russian/info.ini
lang/russian/mainmenu.xml
.xml
lang/russian/restore.xml
.xml
lang/russian/scheduled.xml
.xml
lang/russian/settings.xml
.xml
lang/russian/steamspreader.xml
.xml
lang/russian/sync&link.xml
.xml
lang/russian/updates.xml
.xml
lang/slovenian/backup.xml
.xml
lang/slovenian/customentries.xml
.xml
lang/slovenian/global.xml
.xml
lang/slovenian/info.ini
lang/slovenian/mainmenu.xml
.xml
lang/slovenian/restore.xml
.xml
lang/slovenian/scheduled.xml
.xml
lang/slovenian/settings.xml
.xml
lang/slovenian/steamspreader.xml
.xml
lang/slovenian/sync&link.xml
.xml
lang/slovenian/updates.xml
.xml
lang/spanish/backup.xml
.xml
lang/spanish/customentries.xml
.xml
lang/spanish/global.xml
.xml
lang/spanish/info.ini
lang/spanish/mainmenu.xml
.xml
lang/spanish/restore.xml
.xml
lang/spanish/scheduled.xml
.xml
lang/spanish/settings.xml
.xml
lang/spanish/steamspreader.xml
.xml
lang/spanish/sync&link.xml
.xml
lang/spanish/updates.xml
.xml
lang/turkish/backup.xml
.xml
lang/turkish/customentries.xml
.xml
lang/turkish/global.xml
.xml
lang/turkish/info.ini
lang/turkish/mainmenu.xml
.xml
lang/turkish/restore.xml
.xml
lang/turkish/scheduled.xml
.xml
lang/turkish/settings.xml
.xml
lang/turkish/steamspreader.xml
.xml
lang/turkish/sync&link.xml
.xml
lang/turkish/updates.xml
.xml
lang/ukrainian/backup.xml
.xml
lang/ukrainian/customentries.xml
.xml
lang/ukrainian/global.xml
.xml
lang/ukrainian/info.ini
lang/ukrainian/mainmenu.xml
.xml
lang/ukrainian/restore.xml
.xml
lang/ukrainian/scheduled.xml
.xml
lang/ukrainian/settings.xml
.xml
lang/ukrainian/steamspreader.xml
.xml
lang/ukrainian/sync&link.xml
.xml
lang/ukrainian/updates.xml
.xml
lang/vietnamese/backup.xml
.xml
lang/vietnamese/customentries.xml
.xml
lang/vietnamese/global.xml
.xml
lang/vietnamese/info.ini
lang/vietnamese/mainmenu.xml
.xml
lang/vietnamese/restore.xml
.xml
lang/vietnamese/scheduled.xml
.xml
lang/vietnamese/settings.xml
.xml
lang/vietnamese/steamspreader.xml
.xml
lang/vietnamese/sync&link.xml
.xml
lang/vietnamese/updates.xml
.xml
lua5.1.dll
.dll windows x86

15d95afb470c5f82193b2d9e98fc96d1

Code Sign

47:8a:8e:fb:59:e1:d8:3f:0c:e1:42:d2:a2:87:07:be
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

10/05/2010, 00:00

Not After

10/05/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

73:6f:48:4c:38:26:9b:f8:c4:42:73:1c:1f:ac:a3:ed
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

01/03/2011, 00:00

Not After

28/02/2014, 23:59

Subject

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave Suite 200,L=Winnipeg,ST=MB,C=CA

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:cd:92:b0:62:42:24:2d:cf:b7:65:8e:50:2d:62:bb:e7:98:13:59
Signer

Actual PE Digest

25:cd:92:b0:62:42:24:2d:cf:b7:65:8e:50:2d:62:bb:e7:98:13:59

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Indigo Rose Software Design Corporation,O=Indigo Rose Software Design Corporation,POSTALCODE=R3B 0R3,STREET=123 Bannatyne Ave Suite 200,L=Winnipeg,ST=MB,C=CA

05/12/2011, 14:14
Valid: false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
FormatMessageA
GetLastError
FreeLibrary
LoadLibraryA
GetProcAddress
EnterCriticalSection
LeaveCriticalSection
HeapReAlloc
HeapAlloc
HeapFree
GetModuleHandleW
Sleep
ExitProcess
RtlUnwind
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
DeleteFileA
MoveFileA
GetTimeFormatA
GetDateFormatA
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
GetCommandLineA
GetModuleHandleA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
MultiByteToWideChar
ReadFile
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
HeapDestroy
VirtualFree
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WriteFile
InitializeCriticalSectionAndSpinCount
GetFileAttributesA
CreatePipe
GetExitCodeProcess
WaitForSingleObject
GetCurrentProcessId
CreateFileA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
FlushFileBuffers
RaiseException
GetTimeZoneInformation
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
CompareStringA
CompareStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
SetStdHandle
HeapSize
GetLocaleInfoW
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEnvironmentVariableA

Exports

Exports

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 223KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
lua51.dll
.dll windows x86

a1b69e6994ef9135a30507dd76a0652e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

lua5.1

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Exports

Exports

luaD_growstack
luaF_newproto
luaL_addlstring
luaL_addstring
luaL_addvalue
luaL_argerror
luaL_buffinit
luaL_callmeta
luaL_checkany
luaL_checkinteger
luaL_checklstring
luaL_checknumber
luaL_checkoption
luaL_checkstack
luaL_checktype
luaL_checkudata
luaL_error
luaL_findtable
luaL_getmetafield
luaL_gsub
luaL_loadbuffer
luaL_loadfile
luaL_loadstring
luaL_newmetatable
luaL_newstate
luaL_openlib
luaL_openlibs
luaL_optinteger
luaL_optlstring
luaL_optnumber
luaL_prepbuffer
luaL_pushresult
luaL_ref
luaL_register
luaL_typerror
luaL_unref
luaL_where
luaM_realloc_
luaM_toobig
luaS_newlstr
luaU_dump
lua_atpanic
lua_call
lua_checkstack
lua_close
lua_concat
lua_cpcall
lua_createtable
lua_dump
lua_equal
lua_error
lua_gc
lua_getallocf
lua_getfenv
lua_getfield
lua_gethook
lua_gethookcount
lua_gethookmask
lua_getinfo
lua_getlocal
lua_getmetatable
lua_getstack
lua_gettable
lua_gettop
lua_getupvalue
lua_insert
lua_iscfunction
lua_isnumber
lua_isstring
lua_isuserdata
lua_lessthan
lua_load
lua_newstate
lua_newthread
lua_newuserdata
lua_next
lua_objlen
lua_pcall
lua_pushboolean
lua_pushcclosure
lua_pushfstring
lua_pushinteger
lua_pushlightuserdata
lua_pushlstring
lua_pushnil
lua_pushnumber
lua_pushstring
lua_pushthread
lua_pushvalue
lua_pushvfstring
lua_rawequal
lua_rawget
lua_rawgeti
lua_rawset
lua_rawseti
lua_remove
lua_replace
lua_resume
lua_setallocf
lua_setfenv
lua_setfield
lua_sethook
lua_setlocal
lua_setmetatable
lua_settable
lua_settop
lua_setupvalue
lua_status
lua_toboolean
lua_tocfunction
lua_tointeger
lua_tolstring
lua_tonumber
lua_topointer
lua_tothread
lua_touserdata
lua_type
lua_typename
lua_xmove
lua_yield
luaopen_base
luaopen_debug
luaopen_io
luaopen_math
luaopen_os
luaopen_package
luaopen_string
luaopen_table

Sections

.text
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6e09a21f99222f0db6d234115575bc66

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

advapi32

msvcrt

kernel32

Sections

.text Size: 917KB - Virtual size: 916KB

.rdata Size: 248KB - Virtual size: 247KB

.data Size: 2KB - Virtual size: 30KB

.pdata Size: 61KB - Virtual size: 60KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 8KB

abae283b9febd6b6c99aae6c6b3d9202

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

user32

advapi32

msvcrt

kernel32

Sections

.text Size: 672KB - Virtual size: 672KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 2KB - Virtual size: 28KB

.sxdata Size: 512B - Virtual size: 4B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 29KB - Virtual size: 29KB

bb89fb53a85dd0a1ae3244c8f323d12e

Headers

DLL Characteristics

File Characteristics

Imports

lua5.1

kernel32

user32

gdi32

msimg32

comdlg32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

wsock32

oleacc

gdiplus

imm32

winmm

Exports

Exports

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 266KB - Virtual size: 265KB

.data Size: 23KB - Virtual size: 104KB

.rsrc Size: 39KB - Virtual size: 39KB

.reloc Size: 164KB - Virtual size: 164KB

96c912c7e683eb60ac64ab8b4fe0567d

Headers

File Characteristics

Imports

lua5.1

kernel32

user32

gdi32

comdlg32

winspool.drv

.text
Size: 917KB - Virtual size: 916KB

.rdata
Size: 248KB - Virtual size: 247KB

.data
Size: 2KB - Virtual size: 30KB

.pdata
Size: 61KB - Virtual size: 60KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 8KB

.text
Size: 672KB - Virtual size: 672KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 2KB - Virtual size: 28KB

.sxdata
Size: 512B - Virtual size: 4B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 29KB - Virtual size: 29KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 266KB - Virtual size: 265KB

.data
Size: 23KB - Virtual size: 104KB

.rsrc
Size: 39KB - Virtual size: 39KB

.reloc
Size: 164KB - Virtual size: 164KB

.text
Size: 92KB - Virtual size: 90KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 16KB - Virtual size: 38KB

.rsrc
Size: 20KB - Virtual size: 17KB

.reloc
Size: 16KB - Virtual size: 14KB

.text
Size: 188KB - Virtual size: 428KB

.rsrc
Size: 5KB - Virtual size: 8KB

.reloc
Size: 512B - Virtual size: 4KB

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:01:cf:3e:00:00:00:00:00:0f
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

61:05:a2:30:00:00:00:00:00:08
Certificate

72:96:cb:3c:cf:4a:19:97:6d:61:01:7d:1b:ad:e8:cf:2e:da:d0:b2
Signer

07/09/2010, 22:38
Valid: false

.text
Size: 110KB - Virtual size: 109KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.text
Size: 32KB - Virtual size: 31KB

.rdata
Size: 8KB - Virtual size: 5KB

.data
Size: 4KB - Virtual size: 7KB