ARK Survival Evolved[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

ARK Survival Evolved.rar
Size

2.6MB
MD5

86a80b73bb7e795e987b33bf22d2cef3
SHA1

29d4089d992a90a073afe39d2ec1dd08cd5d0984
SHA256

065308e696cf3e97073c9875fd54344aca6ea9dd9d9af39587319c6f71f62beb
SHA512

63c0179b41ec055e9ef04e456e666d72267c0f4e75bbfa8eea2083424f8d8c60af5e56ff9074308a74554b032e5fac681d84d3136c3305f555c6908d3d950891
SSDEEP

49152:0nKOpVJAIoyGhQH9iASXQMxidiQ31zt5hYQ5xgK5pMlOeW6Iw25uIAQA/:8cyOfVQMxk1zt5yQHz5pMlOerIblnK

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
unpack001/ARK Survival Evolved/ARKLauncher.exe
unpack001/ARK Survival Evolved/AppID_Patch.exe
unpack001/ARK Survival Evolved/InnoCallback.dll
unpack001/ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.dll
unpack001/ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.exe
unpack001/ARK Survival Evolved/ShooterGame/Binaries/Win64/steamclient64.dll
unpack001/ARK Survival Evolved/Style.dll
unpack001/ARK Survival Evolved/botva2.dll

Files

ARK Survival Evolved.rar
.rar
ARK Survival Evolved/ARKLauncher.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 906KB - Virtual size: 906KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ARK Survival Evolved/AppID_Patch.exe
.exe windows x86

a9ef463676a8b86fc8e7dc760ab1e793

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
GetFileSize
GetModuleHandleA
MapViewOfFile
SetFileAttributesA
CreateFileMappingA
WriteFile
lstrcatA
lstrcpyA
CloseHandle
CreateFileA
CopyFileA
UnmapViewOfFile

user32

IsDlgButtonChecked
LoadIconA
MessageBoxA
SendMessageA
SetDlgItemTextA
wsprintfA
GetDlgItemTextA
EndDialog
DialogBoxParamA
CheckDlgButton

comctl32

InitCommonControls

comdlg32

GetOpenFileNameA

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 790B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ARK Survival Evolved/ArkDownloader.bat
ARK Survival Evolved/Button.png
.png
ARK Survival Evolved/CLTheme.vsf
ARK Survival Evolved/CL_icon.ico
ARK Survival Evolved/InnoCallback.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

wrapcallback

Sections

CODE
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaEmu.ini
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.dll
.dll windows x64

6b1d7d0b86924dadfb79306be4e64c9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathRemoveFileSpecA

kernel32

OutputDebugStringW
ReadFile
GetCurrentThread
ExitProcess
GetModuleHandleExA
GetPrivateProfileIntA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
LoadLibraryExA
GetThreadContext
VirtualQuery
GetCurrentProcess
GetModuleHandleW
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
VirtualProtectEx
OpenThread
GetSystemInfo
GetThreadPriority
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
SuspendThread
ResumeThread
SetEndOfFile
CreateFileW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
GetLastError
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
EncodePointer
DecodePointer
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
ReadConsoleW
LoadLibraryExW
WriteFile
DeleteCriticalSection
FlushFileBuffers
GetConsoleCP
GetConsoleMode
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
SetLastError
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapReAlloc
SetStdHandle
SetFilePointerEx
GetStringTypeW
LCMapStringW
HeapSize

user32

MessageBoxA

Sections

.text
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 182KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ARK Survival Evolved/ShooterGame/Binaries/Win64/LumaGameLauncher_x64.exe
.exe windows x64

4680d07fbb5d69b2c35b9f1b84c243e9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

shlwapi

PathRemoveFileSpecW
PathRemoveFileSpecA

kernel32

AllocConsole
WaitForSingleObject
GetPrivateProfileStringW
CreateRemoteThread
GetCommandLineA
OpenProcess
GetPrivateProfileIntA
VirtualFreeEx
Sleep
CreateProcessA
TerminateProcess
GetModuleFileNameW
GetProcAddress
VirtualAllocEx
GetPrivateProfileStringA
LoadLibraryA
Process32FirstW
SetEnvironmentVariableA
GetModuleHandleExA
Process32NextW
GetModuleHandleA
CreateToolhelp32Snapshot
CloseHandle
WriteProcessMemory
ResumeThread
CreateThread
CreateFileW
HeapReAlloc
LoadLibraryExW
GetConsoleCP
FlushFileBuffers
SetStdHandle
ReadConsoleW
GetConsoleMode
ReadFile
ExitProcess
OutputDebugStringW
SetFilePointerEx
GetModuleFileNameA
EnterCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
SetEndOfFile
LeaveCriticalSection
RtlUnwindEx
GetStdHandle
GetFileType
DeleteCriticalSection
GetStartupInfoW
HeapFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
HeapAlloc
RtlPcToFileHeader
RaiseException
GetModuleHandleExW
AreFileApisANSI
WideCharToMultiByte
HeapSize
WriteConsoleW
GetProcessHeap
WriteFile
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW

user32

CreateDialogParamA
PostQuitMessage
IsDialogMessageA
GetMessageA
GetWindowTextA
MessageBoxA
GetDlgItem
DispatchMessageA
DestroyWindow
TranslateMessage

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

Sections

.text
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ARK Survival Evolved/ShooterGame/Binaries/Win64/steamclient64.dll
.dll windows x64

4c749aab3c70a30fd91fc425d52d1710

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetLastError
GetProcAddress
GetModuleHandleA
ExitProcess
GetModuleHandleExA
MapViewOfFile
UnmapViewOfFile
lstrcpynA
FreeLibrary
SetEvent
GetPrivateProfileIntA
CreateEventA
GetEnvironmentVariableA
FindFirstFileA
SetLastError
FindClose
GetPrivateProfileStringA
GetLocalTime
CreateFileMappingA
WritePrivateProfileStringA
SetEnvironmentVariableA
GetModuleFileNameA
FindNextFileA
LoadLibraryExA
GetCurrentDirectoryA
GetFileTime
CreateDirectoryA
DeleteFileA
GetThreadContext
VirtualQuery
GetCurrentProcess
GetModuleHandleW
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
VirtualProtectEx
OpenThread
GetSystemInfo
GetThreadPriority
GetCurrentThreadId
CloseHandle
SuspendThread
ResumeThread
GetCommandLineA
LoadLibraryA
CreateFileW
GetTimeZoneInformation
MultiByteToWideChar
WriteFile
CreateFileA
GetCurrentProcessId
GetCurrentThread
HeapReAlloc
LCMapStringW
CompareStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEndOfFile
QueryPerformanceCounter
SetFilePointerEx
ReadConsoleW
SetStdHandle
HeapSize
GetProcessHeap
GetConsoleMode
IsDebuggerPresent
IsProcessorFeaturePresent
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
HeapFree
HeapAlloc
EncodePointer
DecodePointer
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
ReadFile
GetSystemTimeAsFileTime
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwindEx
DeleteCriticalSection
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
RtlPcToFileHeader
RaiseException
AreFileApisANSI
WideCharToMultiByte
OutputDebugStringW
LoadLibraryExW
FlushFileBuffers
GetConsoleCP

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey

shell32

SHCreateDirectoryExA

winhttp

WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCrackUrl
WinHttpOpenRequest
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpReceiveResponse

shlwapi

PathRemoveFileSpecA

wininet

InternetCheckConnectionA
DeleteUrlCacheEntryA

urlmon

URLDownloadToFileA

Exports

Exports

Breakpad_SetSteamID
Breakpad_SteamMiniDumpInit
Breakpad_SteamSetAppID
Breakpad_SteamWriteMiniDumpSetComment
Breakpad_SteamWriteMiniDumpUsingExceptionInfoWithBuildId
CreateInterface
Steam_BConnected
Steam_BGetCallback
Steam_BLoggedOn
Steam_BReleaseSteamPipe
Steam_ConnectToGlobalUser
Steam_CreateGlobalUser
Steam_CreateLocalUser
Steam_CreateSteamPipe
Steam_FreeLastCallback
Steam_GSBLoggedOn
Steam_GSBSecure
Steam_GSGetSteam2GetEncryptionKeyToSendToNewClient
Steam_GSGetSteamID
Steam_GSLogOff
Steam_GSLogOn
Steam_GSRemoveUserConnect
Steam_GSSendSteam2UserConnect
Steam_GSSendSteam3UserConnect
Steam_GSSendUserDisconnect
Steam_GSSendUserStatusResponse
Steam_GSSetServerType
Steam_GSSetSpawnCount
Steam_GSUpdateStatus
Steam_GetAPICallResult
Steam_GetGSHandle
Steam_InitiateGameConnection
Steam_LogOff
Steam_LogOn
Steam_ReleaseUser
Steam_SetLocalIPBinding
Steam_TerminateGameConnection
VR_GetGenericInterfaceInternal
VR_GetStringForHmdErrorInternal
VR_InitInternal
VR_IsHmdPresentInternal
VR_ShutdownInternal

Sections

.text
Size: 463KB - Virtual size: 463KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 234KB - Virtual size: 233KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 185KB - Virtual size: 200KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ARK Survival Evolved/StatusPanel.png
.png
ARK Survival Evolved/Style.dll
.dll windows x86

0e600f7ab8961ab00753fc20e9eec5ae

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Imports

oleaut32

SysFreeString
SysReAllocStringLen
SysAllocStringLen
GetErrorInfo
SysFreeString
SafeArrayPtrOfIndex
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayCreate
VariantChangeType
VariantCopy
VariantClear
VariantInit

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegUnLoadKeyW
RegSetValueExW
RegSaveKeyW
RegRestoreKeyW
RegReplaceKeyW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegLoadKeyW
RegFlushKey
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegConnectRegistryW
RegCloseKey

user32

MessageBoxA
CharNextW
LoadStringW
SetClassLongW
GetClassLongW
SetWindowLongW
GetWindowLongW
CreateWindowExW
WindowFromPoint
WaitMessage
UpdateWindow
UnregisterClassW
UnhookWindowsHookEx
TranslateMessage
TranslateMDISysAccel
TrackPopupMenu
SystemParametersInfoW
ShowWindow
ShowScrollBar
ShowOwnedPopups
ShowCaret
SetWindowRgn
SetWindowsHookExW
SetWindowTextW
SetWindowPos
SetWindowPlacement
SetTimer
SetScrollRange
SetScrollPos
SetScrollInfo
SetRect
SetPropW
SetParent
SetMenuItemInfoW
SetMenu
SetForegroundWindow
SetFocus
SetCursorPos
SetCursor
SetClipboardData
SetCapture
SetActiveWindow
SendMessageA
SendMessageW
ScrollWindow
ScreenToClient
RemovePropW
RemoveMenu
ReleaseDC
ReleaseCapture
RegisterWindowMessageW
RegisterClipboardFormatW
RegisterClassW
RedrawWindow
PtInRect
PostQuitMessage
PostMessageW
PeekMessageA
PeekMessageW
OpenClipboard
OffsetRect
MsgWaitForMultipleObjectsEx
MsgWaitForMultipleObjects
MessageBoxW
MessageBeep
MapWindowPoints
MapVirtualKeyW
LoadStringW
LoadKeyboardLayoutW
LoadIconW
LoadCursorW
LoadBitmapW
KillTimer
IsZoomed
IsWindowVisible
IsWindowUnicode
IsWindowEnabled
IsWindow
IsRectEmpty
IsIconic
IsDialogMessageA
IsDialogMessageW
IsChild
InvalidateRect
IntersectRect
InsertMenuItemW
InsertMenuW
InflateRect
HideCaret
GetWindowThreadProcessId
GetWindowTextW
GetWindowRect
GetWindowPlacement
GetWindowDC
GetTopWindow
GetSystemMetrics
GetSystemMenu
GetSysColorBrush
GetSysColor
GetSubMenu
GetScrollRange
GetScrollPos
GetScrollInfo
GetPropW
GetParent
GetWindow
GetMessagePos
GetMessageExtraInfo
GetMenuStringW
GetMenuState
GetMenuItemRect
GetMenuItemInfoW
GetMenuItemID
GetMenuItemCount
GetMenu
GetLastActivePopup
GetKeyboardState
GetKeyboardLayoutNameW
GetKeyboardLayoutList
GetKeyboardLayout
GetKeyState
GetKeyNameTextW
GetIconInfo
GetForegroundWindow
GetFocus
GetDlgItem
GetDlgCtrlID
GetDesktopWindow
GetDCEx
GetDC
GetCursorPos
GetCursor
GetClipboardData
GetClientRect
GetClassNameW
GetClassInfoExW
GetClassInfoW
GetCapture
GetAncestor
GetActiveWindow
FrameRect
FindWindowExW
FindWindowW
FillRect
EnumWindows
EnumThreadWindows
EnumChildWindows
EndPaint
EndMenu
EnableWindow
EnableScrollBar
EnableMenuItem
EmptyClipboard
DrawTextExW
DrawTextW
DrawMenuBar
DrawIconEx
DrawIcon
DrawFrameControl
DrawFocusRect
DrawEdge
DispatchMessageA
DispatchMessageW
DestroyWindow
DestroyMenu
DestroyIcon
DestroyCursor
DeleteMenu
DefWindowProcW
DefMDIChildProcW
DefFrameProcW
CreatePopupMenu
CreateMenu
CreateIconIndirect
CreateIcon
CreateAcceleratorTableW
CopyImage
CopyIcon
CloseClipboard
ClientToScreen
CheckMenuItem
CharUpperBuffW
CharUpperW
CharNextW
CharLowerBuffW
CharLowerW
CallWindowProcW
CallNextHookEx
BeginPaint
AdjustWindowRectEx
ActivateKeyboardLayout
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromPoint
MonitorFromRect
MonitorFromWindow

kernel32

Sleep
VirtualFree
VirtualAlloc
lstrlenW
lstrcpynW
VirtualQuery
QueryPerformanceCounter
GetTickCount
GetSystemInfo
GetVersion
CompareStringW
IsValidLocale
SetThreadLocale
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GetLocaleInfoW
WideCharToMultiByte
MultiByteToWideChar
GetACP
LoadLibraryExW
GetStartupInfoW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetCommandLineW
FreeLibrary
GetLastError
UnhandledExceptionFilter
RtlUnwind
RaiseException
ExitProcess
ExitThread
SwitchToThread
GetCurrentThreadId
CreateThread
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
FindFirstFileW
FindClose
WriteFile
GetStdHandle
CloseHandle
GetProcAddress
RaiseException
LoadLibraryA
GetLastError
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
LocalFree
LocalAlloc
FreeLibrary
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjectsEx
VirtualQueryEx
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
TryEnterCriticalSection
SwitchToThread
SuspendThread
Sleep
SizeofResource
SetThreadPriority
SetThreadLocale
SetLastError
SetFilePointer
SetEvent
SetErrorMode
SetEndOfFile
ResumeThread
ResetEvent
ReadFile
RaiseException
IsDebuggerPresent
OutputDebugStringW
MulDiv
LockResource
LocalFree
LoadResource
LoadLibraryW
LeaveCriticalSection
IsValidLocale
InitializeCriticalSection
GlobalUnlock
GlobalLock
GlobalFree
GlobalFindAtomW
GlobalDeleteAtom
GlobalAlloc
GlobalAddAtomW
GetVersionExW
GetVersion
GetTickCount
GetThreadPriority
GetThreadLocale
GetSystemInfo
GetStdHandle
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
GetLocaleInfoW
GetLocalTime
GetLastError
GetFullPathNameW
GetFileAttributesW
GetExitCodeThread
GetDiskFreeSpaceW
GetDateFormatW
GetCurrentThreadId
GetCurrentThread
GetCurrentProcessId
GetCurrentProcess
GetCPInfoExW
GetCPInfo
GetACP
FreeResource
InterlockedExchangeAdd
InterlockedExchange
InterlockedCompareExchange
FreeLibrary
FormatMessageW
FlushInstructionCache
FindResourceW
FindFirstFileW
FindClose
EnumSystemLocalesW
EnumResourceNamesW
EnumCalendarInfoW
EnterCriticalSection
DeleteCriticalSection
CreateThread
CreateFileW
CreateEventW
CompareStringW
CloseHandle
Sleep

msimg32

TransparentBlt
GradientFill
AlphaBlend

gdi32

UnrealizeObject
StretchDIBits
StretchBlt
StartPage
StartDocW
SetWorldTransform
SetWindowOrgEx
SetWinMetaFileBits
SetViewportOrgEx
SetTextColor
SetStretchBltMode
SetROP2
SetPixel
SetGraphicsMode
SetEnhMetaFileBits
SetDIBits
SetDIBColorTable
SetBrushOrgEx
SetBkMode
SetBkColor
SetAbortProc
SelectPalette
SelectObject
SaveDC
RoundRect
RestoreDC
Rectangle
RectVisible
RealizePalette
Polyline
Polygon
PolyBezierTo
PolyBezier
PlayEnhMetaFile
Pie
PatBlt
MoveToEx
MaskBlt
LineTo
IntersectClipRect
GetWindowOrgEx
GetWinMetaFileBits
GetViewportOrgEx
GetTextMetricsW
GetTextExtentPointW
GetTextExtentPoint32W
GetTextColor
GetSystemPaletteEntries
GetStockObject
GetRgnBox
GetPixel
GetPaletteEntries
GetObjectW
GetEnhMetaFilePaletteEntries
GetEnhMetaFileHeader
GetEnhMetaFileDescriptionW
GetEnhMetaFileBits
GetDeviceCaps
GetDIBits
GetDIBColorTable
GetCurrentPositionEx
GetCurrentObject
GetClipBox
GetBrushOrgEx
GetBkMode
GetBitmapBits
GdiFlush
FrameRgn
ExtTextOutW
ExtFloodFill
ExtCreateRegion
ExcludeClipRect
EnumFontsW
EnumFontFamiliesExW
EndPage
EndDoc
Ellipse
DeleteObject
DeleteEnhMetaFile
DeleteDC
CreateSolidBrush
CreateRoundRectRgn
CreateRectRgn
CreatePenIndirect
CreatePalette
CreateICW
CreateHalftonePalette
CreateFontIndirectW
CreateDIBitmap
CreateDIBSection
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
CreateBrushIndirect
CreateBitmap
CopyEnhMetaFileW
CombineRgn
Chord
BitBlt
ArcTo
Arc
AngleArc
AbortDoc

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

ole32

OleUninitialize
OleInitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoUninitialize
CoInitialize
IsEqualGUID

comctl32

InitializeFlatSB
FlatSB_SetScrollProp
FlatSB_SetScrollPos
FlatSB_SetScrollInfo
FlatSB_GetScrollPos
FlatSB_GetScrollInfo
_TrackMouseEvent
ImageList_GetImageInfo
ImageList_SetIconSize
ImageList_GetIconSize
ImageList_Write
ImageList_Read
ImageList_GetDragImage
ImageList_DragShowNolock
ImageList_DragMove
ImageList_DragLeave
ImageList_DragEnter
ImageList_EndDrag
ImageList_BeginDrag
ImageList_Copy
ImageList_LoadImageW
ImageList_GetIcon
ImageList_Remove
ImageList_DrawEx
ImageList_Replace
ImageList_Draw
ImageList_SetOverlayImage
ImageList_GetBkColor
ImageList_SetBkColor
ImageList_ReplaceIcon
ImageList_Add
ImageList_SetImageCount
ImageList_GetImageCount
ImageList_Destroy
ImageList_Create
InitCommonControls

winspool.drv

OpenPrinterW
EnumPrintersW
DocumentPropertiesW
ClosePrinter
GetDefaultPrinterW

shell32

Shell_NotifyIconW

msvcrt

memset
memcpy

Exports

Exports

LoadVCLStyleA
LoadVCLStyleW
UnLoadVCLStyles

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.itext
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 99KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ARK Survival Evolved/WizardImageUnInst.jpg
ARK Survival Evolved/botva2.dll
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

BtnCreate
BtnGetChecked
BtnGetEnabled
BtnGetPosition
BtnGetText
BtnGetVisibility
BtnRefresh
BtnSetChecked
BtnSetCursor
BtnSetEnabled
BtnSetEvent
BtnSetFont
BtnSetFontColor
BtnSetPosition
BtnSetText
BtnSetTextAlignment
BtnSetVisibility
CreateBitmapRgn
CreateFormFromImage
GetMinimizeAnimation
GetSysCursorHandle
ImgApplyChanges
ImgGetPosition
ImgGetVisibility
ImgGetVisiblePart
ImgLoad
ImgRelease
ImgSetPosition
ImgSetVisibility
ImgSetVisiblePart
SetMinimizeAnimation
gdipShutdown

Sections

CODE
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
ARK Survival Evolved/steamcmd.exe
.exe windows x86

b577ab37d933fff75ff8d0214ef60e64

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-11-2006 00:00

Not After

16-07-2036 23:59

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

28-09-2012 00:00

Not After

23-11-2015 23:59

Subject

CN=Valve,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Valve,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:df:78:f1:73:09:0a:05:db:01:b8:01:c9:bf:a6:a8:09:44:9e:ed
Signer

Actual PE Digest

a4:df:78:f1:73:09:0a:05:db:01:b8:01:c9:bf:a6:a8:09:44:9e:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

select
__WSAFDIsSet
WSASendTo
WSARecvFrom
closesocket
shutdown
accept
WSAGetLastError
bind
WSAIoctl
ioctlsocket
getsockname
gethostbyname
ntohl
ntohs
htons
htonl
recv
send
connect
setsockopt
WSASocketA
WSAStartup

kernel32

GetTickCount
GetCurrentProcess
LocalFree
GetFileAttributesW
FreeLibrary
LoadLibraryA
SetFileAttributesA
GetFileAttributesA
SetLastError
Sleep
DeleteFileA
GetModuleFileNameA
RemoveDirectoryW
GetFullPathNameW
GlobalUnlock
GlobalAlloc
GlobalLock
InterlockedIncrement
InterlockedDecrement
GetFileSize
FindClose
GetDriveTypeA
DeviceIoControl
HeapCreate
HeapSetInformation
ExitProcess
FindFirstFileExA
FileTimeToLocalFileTime
MoveFileA
RtlUnwind
GetFullPathNameA
PostQueuedCompletionStatus
CreateIoCompletionPort
GetVersion
GlobalFree
GetLocalTime
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
SetProcessAffinityMask
GetProcessAffinityMask
GetSystemInfo
CopyFileA
HeapAlloc
HeapFree
HeapSize
InterlockedExchangeAdd
HeapValidate
InterlockedCompareExchange
DebugBreak
InterlockedExchange
MoveFileExW
SetErrorMode
SetEnvironmentVariableA
GetModuleHandleA
GetProcAddress
CreateProcessA
GetConsoleOutputCP
SetConsoleOutputCP
GetLastError
WriteFile
ReadFile
CreateFileA
WideCharToMultiByte
InitializeCriticalSection
CreateEventA
CreateThread
GetVersionExA
GetCurrentThreadId
ResetEvent
SetEvent
DeleteCriticalSection
CloseHandle
MultiByteToWideChar
OutputDebugStringA
GetCurrentDirectoryA
WaitForSingleObject
LeaveCriticalSection
GetProcessHeaps
HeapQueryInformation
SetUnhandledExceptionFilter
GetCurrentDirectoryW
SetCurrentDirectoryW
EnterCriticalSection
HeapReAlloc
SetEnvironmentVariableW
IsProcessorFeaturePresent
UnhandledExceptionFilter
GetModuleFileNameW
VirtualFree
VirtualProtect
ResumeThread
SuspendThread
InitializeCriticalSectionAndSpinCount
TlsSetValue
TlsGetValue
GetACP
TlsFree
TlsAlloc
CreateMutexA
GetCurrentProcessId
WriteConsoleW
SetStdHandle
CompareStringW
VirtualQuery
RaiseException
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
PeekNamedPipe
GetConsoleMode
GetConsoleCP
GetStartupInfoW
GetFileType
SetHandleCount
GetStdHandle
IsValidCodePage
GetOEMCP
SetThreadAffinityMask
TerminateThread
GetCPInfo
GetThreadPriority
OpenThread
GetExitCodeThread
GetCurrentThread
LCMapStringW
LoadLibraryExA
LoadLibraryW
LoadLibraryExW
GetModuleHandleW
SetFilePointer
GetFileSizeEx
SetEndOfFile
FlushFileBuffers
GetFileInformationByHandle
FindNextFileW
SleepEx
CreateFileW
CreateDirectoryW
SetFilePointerEx
SetFileAttributesW
SetFileTime
GetFileTime
DeleteFileW
GetDiskFreeSpaceA
GetDiskFreeSpaceExW
GetDriveTypeW
FindFirstFileW
WriteFileEx
VirtualAlloc
GetProcessHeap
HeapUnlock
HeapWalk
HeapLock
TerminateProcess
GetCommandLineA
IsDebuggerPresent
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime

user32

MessageBoxA
SetDlgItemTextA
SetDlgItemInt
GetWindowRect
GetDesktopWindow
SetWindowPos
EndDialog
DialogBoxParamA
IsWindowVisible
GetDlgItemInt
EnumWindows
GetWindowThreadProcessId
CloseClipboard
SetClipboardData
wsprintfA
GetDlgItem
EmptyClipboard
OpenClipboard
GetWindowTextLengthA

advapi32

CryptGenRandom
RegCloseKey
SetSecurityDescriptorDacl
RegQueryValueExA
InitializeSecurityDescriptor
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
RegOpenKeyA

shell32

ord680
SHGetFileInfoW

oleaut32

VariantClear

Exports

Exports

CanSetClientBeta
ClientUpdateRunFrame
CreateInterface
GetBaseUserContentDir
GetBaseUserContentDirUTF8
GetBaseUserDir
GetBaseUserDirUTF8
GetBootstrapperVersion
GetClientUpdateBytesDownloaded
GetClientUpdateBytesToDownload
GetCurrentClientBeta
GetEUniverse
GetSteamExePath
GetSteamExePathUTF8
GetSteamInstallDir
GetSteamInstallDirUTF8
IsCheckingForUpdates
IsClientUpdateAvailable
PermitDownloadClientUpdates
SetClientBeta
StartCheckingForUpdates
g_dwDllEntryThreadId

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 283KB - Virtual size: 283KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 564KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 26KB - Virtual size: 26KB

.sdata Size: 512B - Virtual size: 312B

.rsrc Size: 906KB - Virtual size: 906KB

.reloc Size: 512B - Virtual size: 12B

a9ef463676a8b86fc8e7dc760ab1e793

Headers

File Characteristics

Imports

kernel32

user32

comctl32

comdlg32

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 790B

.data Size: 512B - Virtual size: 2.3MB

.rsrc Size: 10KB - Virtual size: 10KB

Headers

File Characteristics

Exports

Exports

Sections

CODE Size: 47KB - Virtual size: 47KB

DATA Size: 1KB - Virtual size: 1KB

BSS Size: - Virtual size: 1KB

.idata Size: 2KB - Virtual size: 2KB

.edata Size: 512B - Virtual size: 80B

.reloc Size: 4KB - Virtual size: 4KB

.rsrc Size: 6KB - Virtual size: 6KB

6b1d7d0b86924dadfb79306be4e64c9b

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

Sections

.text Size: 122KB - Virtual size: 121KB

.rdata Size: 47KB - Virtual size: 47KB

.data Size: 173KB - Virtual size: 182KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 2KB

4680d07fbb5d69b2c35b9f1b84c243e9

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

kernel32

user32

advapi32

Sections

.text Size: 77KB - Virtual size: 76KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 7KB - Virtual size: 16KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 199KB - Virtual size: 198KB

.reloc Size: 2KB - Virtual size: 1KB

4c749aab3c70a30fd91fc425d52d1710

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

.text
Size: 26KB - Virtual size: 26KB

.sdata
Size: 512B - Virtual size: 312B

.rsrc
Size: 906KB - Virtual size: 906KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 790B

.data
Size: 512B - Virtual size: 2.3MB

.rsrc
Size: 10KB - Virtual size: 10KB

CODE
Size: 47KB - Virtual size: 47KB

DATA
Size: 1KB - Virtual size: 1KB

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 80B

.reloc
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 6KB - Virtual size: 6KB

.text
Size: 122KB - Virtual size: 121KB

.rdata
Size: 47KB - Virtual size: 47KB

.data
Size: 173KB - Virtual size: 182KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 77KB - Virtual size: 76KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 7KB - Virtual size: 16KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 199KB - Virtual size: 198KB

.reloc
Size: 2KB - Virtual size: 1KB

.text
Size: 463KB - Virtual size: 463KB

.rdata
Size: 234KB - Virtual size: 233KB

.data
Size: 185KB - Virtual size: 200KB

.pdata
Size: 31KB - Virtual size: 31KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 10KB - Virtual size: 10KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.itext
Size: 8KB - Virtual size: 8KB

.data
Size: 37KB - Virtual size: 36KB

.bss
Size: - Virtual size: 99KB

.idata
Size: 14KB - Virtual size: 14KB

.didata
Size: 2KB - Virtual size: 2KB

.edata
Size: 512B - Virtual size: 132B

.reloc
Size: 150KB - Virtual size: 149KB

.rsrc
Size: 24KB - Virtual size: 24KB

CODE
Size: 25KB - Virtual size: 25KB

DATA
Size: 512B - Virtual size: 244B

BSS
Size: - Virtual size: 1KB

.idata
Size: 2KB - Virtual size: 2KB

.edata
Size: 1024B - Virtual size: 851B

.reloc
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 2KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

18:da:d1:9e:26:7d:e8:bb:4a:21:58:cd:cc:6b:3b:4a
Certificate

47:a9:38:ed:c7:ae:ac:8d:c7:1d:cb:b4:b4:f6:11:f8
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate