ge[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ge.rar
Size

60.0MB
MD5

c9b4f033e2ee017299755b1989835f83
SHA1

1743d2d464825d273ff0ff7543a01ddfcc0a0665
SHA256

05400a6e40c8af38dcd65b4d9b4a47c2846002e9dcce52bffe3c1e0d838e5cf8
SHA512

045dd3e91d3cd418b7695c249643d37fe7fb5f9956009aae5733780b3831abb557120e02d25b55e7326b5fe81bda2d135c0bb08cb0868694bbdc8c98985c07c1
SSDEEP

1572864:Y/Hw0wx6+cjj4YhU03dwts8+lGs3ZpGbWha:YwKBv4YhU02+lGYPy

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Engine.BuildInfo_Win32_Retail_dll.dll
unpack001/Need For Speed The Run.exe

Files

ge.rar
.rar
Engine.BuildInfo_Win32_Retail_dll.dll
.dll windows:5 windows x86 arch:x86

a21249f91f45814e0d53978ee6d1259a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcr90

_lock
__dllonexit
_except_handler4_common
_crt_debugger_hook
_unlock
__clean_type_info_names_internal
__CppXcptFilter
_adjust_fdiv
_amsg_exit
_initterm_e
_initterm
_decode_pointer
_encoded_null
free
_malloc_crt
_encode_pointer
_onexit
_purecall

kernel32

SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
IsDebuggerPresent

Exports

Exports

getBuildInfo

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 597B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GDFBinary_en_US.dll
.dll windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/07/2011, 00:00

Not After

03/10/2014, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e7:3a:2e:35:c4:4d:39:96:b8:cc:dd:d6:38:b9:9c:a4:61:bc:cf:ec
Signer

Actual PE Digest

e7:3a:2e:35:c4:4d:39:96:b8:cc:dd:d6:38:b9:9c:a4:61:bc:cf:ec

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 454KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
GDFBinary_zh_TW.dll
.dll windows:5 windows x86 arch:x86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/07/2011, 00:00

Not After

03/10/2014, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:86:66:ac:e7:d4:b9:da:98:7b:f1:87:9b:69:e7:f5:38:46:3c:cb
Signer

Actual PE Digest

2a:86:66:ac:e7:d4:b9:da:98:7b:f1:87:9b:69:e7:f5:38:46:3c:cb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 454KB - Virtual size: 454KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Need For Speed The Run.exe
.exe windows:5 windows x86 arch:x86

de121d28eecccb3bbd6d8668bdef060c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetModuleFileNameA
IsDebuggerPresent
GetSystemTime
SetCurrentDirectoryW
OutputDebugStringW
GetTempFileNameW
GlobalLock
GetModuleHandleA
GetProcAddress
GetCurrentThreadId
GetModuleHandleW
CreateProcessW
lstrcmpiW
InterlockedDecrement
GetFullPathNameA
ReleaseSemaphore
CreateSemaphoreA
GetLocaleInfoW
GetCurrentProcess
Module32Next
GlobalUnlock
GlobalMemoryStatusEx
CreateDirectoryW
OpenProcess
TerminateProcess
SetLastError
ReleaseMutex
SetPriorityClass
CreateToolhelp32Snapshot
Process32First
SetThreadIdealProcessor
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoA
IsProcessorFeaturePresent
InterlockedCompareExchange
GlobalFree
GlobalAlloc
GetPriorityClass
SetEnvironmentVariableA
GetDateFormatA
GetTimeFormatA
GetTimeZoneInformation
TryEnterCriticalSection
GetThreadPriority
SetWaitableTimer
GetCurrentProcessId
Module32First
Process32Next
CreateWaitableTimerA
GetLogicalDrives
lstrcatA
GetProcessHeap
HeapAlloc
HeapFree
CreateProcessA
CreateMutexA
SetErrorMode
Sleep
OpenMutexA
lstrcmpiA
lstrcpyA
InterlockedExchange
GetUserGeoID
GetGeoInfoA
CancelIo
GetLogicalDriveStringsA
GetDriveTypeA
GetLogicalDriveStringsW
GetModuleFileNameW
GetFullPathNameW
GetWindowsDirectoryW
GetDriveTypeW
GetVolumePathNameW
GetVolumeInformationW
GetDiskFreeSpaceExW
GetTempPathW
GetLongPathNameW
CopyFileA
MoveFileExW
GetFileAttributesW
GetLastError
SetEndOfFile
FindFirstChangeNotificationW
WaitForMultipleObjects
FindNextChangeNotification
FindCloseChangeNotification
FindFirstFileA
FindNextFileA
GetVersionExA
InterlockedExchangeAdd
MultiByteToWideChar
LoadLibraryW
VirtualProtect
GetUserDefaultLangID
DebugBreak
SetFileTime
GetFileAttributesA
SetFileAttributesA
MoveFileW
RemoveDirectoryW
DeleteFileW
CopyFileW
SetFileAttributesW
CreateFileW
WideCharToMultiByte
FindNextFileW
FlushFileBuffers
GetFileSizeEx
SetFilePointerEx
GetLocalTime
SystemTimeToFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GetCurrentDirectoryW
FindClose
FindFirstFileW
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
DeleteFileA
CreateFileA
GetDiskFreeSpaceA
FileTimeToLocalFileTime
FileTimeToSystemTime
LoadLibraryExA
GetCurrentDirectoryA
GetCurrentProcessorNumber
GetModuleHandleExA
IsBadStringPtrA
CreateThread
WaitForSingleObject
Thread32First
Thread32Next
OpenThread
GetThreadContext
SetThreadContext
GetCommandLineA
GetEnvironmentVariableA
GetExitCodeProcess
ExitProcess
ReadFile
GetSystemInfo
GetComputerNameA
GetWindowsDirectoryA
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
FormatMessageA
LocalFree
ResetEvent
SetEvent
CreateEventA
SetThreadAffinityMask
SetThreadPriority
WaitForMultipleObjectsEx
WaitForSingleObjectEx
SleepEx
SwitchToThread
QueueUserAPC
ResumeThread
SuspendThread
RaiseException
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
WriteFile
GetExitCodeThread
GetSystemTimeAsFileTime
GetTickCount
VirtualQuery
DuplicateHandle
VirtualAlloc
InitializeCriticalSectionAndSpinCount
GlobalMemoryStatus
VirtualFree
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentThread
LoadLibraryA
FreeLibrary
OutputDebugStringA
SetFilePointer
CloseHandle
InitializeCriticalSection
GetModuleFileNameW
GetModuleHandleW
TerminateProcess
GetCurrentProcess
DeleteCriticalSection
LoadLibraryW
CreateEventW
CompareStringW
SetLastError
GetModuleHandleA
VirtualProtect
GetTickCount
EnterCriticalSection
LeaveCriticalSection
VirtualFree
VirtualAlloc
WriteProcessMemory
CreateToolhelp32Snapshot
GetCurrentProcessId
GetCurrentThreadId
Thread32First
OpenThread
Thread32Next
CloseHandle
SuspendThread
ResumeThread
GetSystemInfo
FreeLibrary
LoadResource
MultiByteToWideChar
WideCharToMultiByte
FindResourceExW
FindResourceExA
GetThreadLocale
GetUserDefaultLCID
GetSystemDefaultLCID
EnumResourceNamesA
EnumResourceNamesW
EnumResourceLanguagesA
EnumResourceLanguagesW
EnumResourceTypesA
EnumResourceTypesW
GetSystemTime
GetLocalTime
SystemTimeToFileTime
CompareFileTime
GetCommandLineA
GetLastError
HeapFree
HeapAlloc
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
WriteFile
GetStdHandle
GetModuleFileNameA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetSystemTimeAsFileTime
HeapReAlloc
HeapSize
LoadLibraryA
GetLocaleInfoA
RtlUnwind
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
VirtualQuery
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess

user32

GetWindowTextA
IsIconic
PostMessageA
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
GetWindowLongA
SetWindowLongA
DestroyWindow
MoveWindow
SetFocus
GetDesktopWindow
wsprintfW
ShowWindow
GetWindowThreadProcessId
RegisterRawInputDevices
DefWindowProcA
EnumDisplaySettingsW
CallWindowProcA
MessageBoxA
GetForegroundWindow
UpdateWindow
CreateWindowExA
SetCursorPos
GetWindowInfo
ShowCursor
ClipCursor
SetWindowPos
GetDlgItem
SetWindowTextA
GetParent
FindWindowExW
MessageBoxW
PeekMessageA
PostQuitMessage
RegisterClassExA
LoadIconA
GetSysColorBrush
GetFocus
LoadStringA
EnumDisplaySettingsA
CloseWindow
MapWindowPoints
DispatchMessageA
TranslateMessage
GetClientRect
GetMonitorInfoA
MonitorFromWindow
GetKeyState
EmptyClipboard
SetClipboardData
GetWindowRect
GetWindow
SystemParametersInfoA
SetClipboardViewer
EndDialog
ChangeClipboardChain
SendMessageA
SetParent
PostThreadMessageA
IsWindowVisible
CloseClipboard
GetMessageA
SetTimer
AttachThreadInput
LoadCursorA
SetCursor
SetForegroundWindow
RegisterDeviceNotificationA
wsprintfA
KillTimer
UnregisterDeviceNotification
FindWindowA
CharUpperA
CharNextA
GetRawInputData
MessageBoxW
CharUpperBuffW
wsprintfW

gdi32

SetDCBrushColor
GetStockObject
DeleteDC
ExtEscape
CreateDCA

winmm

timeEndPeriod
timeGetDevCaps
timeGetTime
waveOutPrepareHeader
waveInPrepareHeader
waveOutUnprepareHeader
waveInMessage
waveOutMessage
waveInStop
waveInGetPosition
waveInAddBuffer
waveInStart
waveOutSetVolume
waveOutWrite
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutReset
waveOutOpen
waveOutClose
waveInGetNumDevs
waveInGetDevCapsA
waveInReset
waveInOpen
waveInClose
waveInUnprepareHeader
timeBeginPeriod

urlmon

URLOpenBlockingStreamA
URLDownloadToCacheFileA

advapi32

GetCurrentHwProfileA
RegQueryValueExW
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegOpenKeyExW
RegSetValueExA
RegGetValueA
RegCloseKey

shell32

SHBrowseForFolderW
SHCreateDirectoryExW
SHGetMalloc
ShellExecuteExW
SHFileOperationW
SHGetFolderPathW
ShellExecuteA
SHGetPathFromIDListW

oleaut32

SysFreeString
SysAllocString

msvcp90

?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
??0?$allocator@D@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??Bios_base@std@@QBEPAXXZ
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?eof@?$char_traits@D@std@@SAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBEHXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?length@?$char_traits@D@std@@SAIPBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z

shlwapi

SHGetValueA
StrNCatA
StrStrIA
StrStrA
PathQuoteSpacesA
StrChrA

msvcr90

_wfopen
_aligned_free
_waccess_s
fwprintf
iswalpha
strncat_s
_strlwr
_wtof
wcsncpy
strtoul
fread
fgetpos
fsetpos
feof
fgets
fputs
_control87
strncat
getenv
_atoi64
atol
toupper
strcpy
strlen
__iob_func
fprintf
fseek
ldexp
isdigit
floor
_CIexp
_CIatan
_CIfmod
vsprintf
_errno
_HUGE
abort
_CItan
_CIasin
strcpy_s
_vsnwprintf
ceil
_fullpath
tolower
strncpy_s
sprintf_s
_set_output_format
_set_purecall_handler
isxdigit
rand
srand
_CIlog
qsort
_beginthreadex
_endthreadex
atoi
_mktime64
_gmtime64
_difftime64
_except_handler3
_wcslwr
_wcsupr
_wcsnicmp
_wcsicmp
vswprintf_s
sscanf
_CIpow
_CIlog10
strrchr
strstr
isspace
vsprintf_s
atof
bsearch
_vsnprintf_s
_CIatan2
strncmp
strtok
strncpy
sprintf
asctime
_time64
_localtime64
fwrite
fflush
_aligned_malloc
fclose
setvbuf
_vsnprintf
strtod
strtol
malloc
strchr
free
realloc
_CIsqrt
_CIsin
modf
_CIcos
_CIacos
strcat_s
printf
_snprintf
memset
memcpy
memmove
__argv
__argc
exit
_purecall
_wtoi
wcsncmp
wcsncat_s
_fseeki64
_ftelli64
__libm_sse2_acos
__libm_sse2_atan2
_utime64
_wutime64
?_wopen@@YAHPB_WHH@Z
__RTtypeid
??0exception@std@@QAE@ABQBDH@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__libm_sse2_sin
__libm_sse2_cos
__libm_sse2_pow
_gmtime64_s
_gmtime32_s
_localtime32_s
strtok_s
_controlfp
_wsplitpath_s
_i64toa_s
_invalid_parameter_noinfo
sscanf_s
_itoa_s
_ftime64
strspn
wcscoll
_wcsicoll
_wstat64
_wfopen_s
rewind
wcscat_s
wcsncpy_s
wcscpy_s
ftell
clearerr
fscanf
_popen
_pclose
setlocale
strftime
clock
rename
remove
system
strpbrk
memchr
islower
ispunct
isupper
frexp
_CItanh
_CIcosh
_CIsinh
isalnum
localeconv
iscntrl
strcoll
longjmp
_setjmp3
strcspn
getc
strerror
_ecvt
_strupr
_strnicmp
_stricmp
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_isnan
_finite
_fcvt
_strtoui64
fgetc
ungetc
ferror
_get_tzname
_tzset
__timezone
__daylight
__CxxFrameHandler3
memmove_s
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
_strdup
??0exception@std@@QAE@XZ
_mbscmp
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
swscanf
wcsstr
_localtime64_s
isalpha
isprint
_wchdir
_wgetcwd
_stat64i32
fopen
_wstat64i32

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

dwmapi

ord102

dinput8

DirectInput8Create

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceInstanceIdA
SetupDiGetClassDevsA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

ws2_32

ntohs
ntohl
gethostbyname
WSASocketA
WSAIoctl
inet_addr
htonl
htons
gethostname
WSACleanup
WSAGetLastError
ioctlsocket
setsockopt
socket
listen
bind
getpeername
send
sendto
recv
WSAStartup
select
recvfrom
connect
accept
WSAAsyncSelect
inet_ntoa
__WSAFDIsSet
getsockopt
getsockname
WSAGetOverlappedResult
WSACreateEvent
shutdown
WSACloseEvent
WSASetEvent
WSARecv
WSARecvFrom
WSAResetEvent
WSAWaitForMultipleEvents
closesocket

dbghelp

SymGetModuleInfo64
MiniDumpWriteDump
SymGetModuleInfo
SymFromAddr
SymSetOptions
SymGetLineFromAddr64
StackWalk64
SymGetModuleBase64
SymLoadModuleEx
SymFunctionTableAccess64
SymInitialize

psapi

EnumProcesses
GetModuleBaseNameW
GetModuleBaseNameA
GetModuleFileNameExA
GetModuleInformation
EnumProcessModules

iphlpapi

GetAdaptersAddresses

dsound

ord1
ord9

d3d11

D3D11CreateDevice

d3dx11_43

D3DX11SaveTextureToMemory

xinput9_1_0

XInputGetState
XInputGetCapabilities
XInputSetState

d3dcompiler_43

D3DReflect

ole32

CoCreateInstance
CoInitialize
CoSetProxyBlanket
CoUninitialize
CoInitializeEx

comdlg32

GetSaveFileNameW
GetOpenFileNameW

netapi32

Netbios

Exports

Exports

gf��,&��Q/��ca�m��1� K��ϳ�I�<�i��Ln-a|_MTˤ<>��L�ښSOL� wgnH�Qxu��!�c��Z��r�/s�N�n��x�q�7=`��5�o�WY%��^.0-7j�-yVR��+��%�2%=L��͌E�2�૿�^J�� S�()T��#��I��)��t}F�FU₠EB^�r-��B��(ئ[R}-]>t63/�!��*��rp+�O��n_��`wd9�Ԃ��@V�(��U�_��@�O�t��9��a9�N��|�.06-7��%i�a;��w��l��Ȧ�+�ƭ��g��䴪K[��A"�Io��O2�;c�w^�^]��Z��&8��S��/X2_Wy��KC��6iGjy�.��ў�� )��հ� Qv��3d@��70S�&A�!�S�ػ߽J rL�� Z��8aIU��(4�d��Y �݆�X�Ļ�Z��~~hI,)��j�M��]��vW��cdY�2w�d;6 �ԑ��b�*�p0��9^|�\+rK�~�=�@+��o�y��Q��C�>�U��գ�-�*��ǭ�}#-�x ��ƞ� ��W9�վ S�E�+�Aw�C�$G��&nA��5䖨bs-�M=f<�V2p{c�T9�K> W3��,�:�1�t�(��0��i��0-qy(��H��:ٍ W�[�l�$gnx�o�&��6!�Ǡ\�bO\sE�o(#=��E1��A3u&��N�Q�d�P�% �nd��_�2-]�Rʺs/��,�jA��Y\��Nm��)��j��X�^��N/�g4��Xʢ�[r ��P��Y&��ONԎ�چ�uu��񗔺`L�ŕ��O��2?n��:a��0SC��a)3ܯ�!l�Zm¹�/��S+wH՚`@�]*U��[��pQ��w]�H��I]�&�ߺ:T��l�hr�'wx��8JZ�Iy��cϓ1�Z�Ӗw�j;�oA�x��Tʁ�#��A��У �OQT�(��&9��XQ�=O�� q�`�W��K��԰Λ�#��*�Z�b�RS]p8ɀ�Ơ�o��&��g�<��b�]�*俢Gj�]��)�C�]&b�#��L==:2�@��M�Q^S��aJ3H�wHM�T�C��J�ŝH��^�S�$v�2�##�iJ�z� �M��q��97��K��_]�H�W��߷��ׅZ�X�*��h%�Ԇ��ԃ��hT�m��#�(�C�h�ܚ��:Ԉ��bǏcsp��w� D�?�O�LŁ"M]�:��]��j�u�`N��o��|q�cS�{+�h�E�l㖞4�o&YS�[��}� ��J̫�� }��]xܿm�⁬%�>[�� Ā;A��?K��ȊvպT��?oAi|�A�S E�B9�~Z�e�T+�ځ3m�ω ��Ҽ�r;)��o��s�7w��W��<n� �ሻ��i�?�*"u��~�u$s��D��W��Ő>23� #�#*;t*�.!ѷ4߳��ˊ��C�"a�ȧ��h�o��(k�?��9�3�3C��'��s5� TRXj�/�K��]�O��Z��dWof�g�긘##Ѐu��/ʖw2�W�^�S�cڀ�) ��:?�:��K�ٿ�n��:a�&�*ݤFA<�LG�z�r5��%� �[�N�%�v�׹X��e9f��+ۻ��6�a�L� 2.�n�i� ,5��ZkZ \A�A��1+��Q{��5��2�)%��8i�e�=�h�{�0��,�"vO�;��u��`b��S(W�@YW�ݱc|�Hy��Y�F��2Ѿ.��~��5+_,��LEs��n5!��64��$�%��%~�%�-b�eVl�b��ݽ=Ud]�Ixʀ^�"��F�}�v�;3|Z�?��2��P��tA�AT��]��W|b��x�=Ω!Y$�f]DR�Nj"A:�6É5Ƙ[�1�� -�L�;�M0 �i�-�~>s��L�eV�^�YhV�;�� =�%��hBu7�� S�٘�Nˤ��l񔧣}$9��nw]x�q��R�C��zx`'�D8�w��,9NE��'P��S� L�ȸ?��7��V��v��Vcp�JW��C��,5��T��z\vd�_ T�0xM�{h��/��4л�)E��H��zU�h_2�vW�ڔ��C�ni��<�d�,�U�~�S��6sZY��w�1��Y&:��4�nb��`�EܩcCbepL�8& ?}��Qt+�e�z��ߠ1��z��|P��M|U��;H+��ؙK��qRj5��~H��W��u�=��mЋi�bJ�� h[ȇ˵_��e�A q�u$$��*�H��B/��\Y��o�@Al��y��T��q�6�Ҕ0��%nx��??�al�Y�U�xq|�d&8��ۉp#]}\ID6a�ي3�[��f�s��Vէ;��m��a�q��V�4�x��e0�a�gb~T�0q�f��Ч�;�]n��ē��ѥ�� #��U�#)5�s�@�N<@2Ec8�R��w��ՠ��N7��4�`2km��1 �6(��B qYɷ�婐�-V��z\�?K��:��O�tG@cѹ�h>��Sg��G��|c�3N��)R1�M�L�⮽X��K8�& ��+a� N0K��Ӵ� _��ȇ��v� ��~ݚ��]ߡVdl;<v@`�S��.�f�� G�i�� Y�)��GVJ��'�#>�� [�,��O�ǒ?΍�o?�_�=t}�i��.7�E.e��[��kv��s��8�q5Y{繿D�ͦJ�N*�j��J�Х$w��[��2�&�_�r_�b�Y�.�{�R�'(�

Sections

.text
Size: - Virtual size: 30.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ctr
Size: - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

typeinfo
Size: - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fieldinf
Size: - Virtual size: 240KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 312B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI2130
Size: - Virtual size: 437KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALI2131
Size: 11.1MB - Virtual size: 11.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Need For Speed The Run.exe.org.1.1.bkup
.exe windows:5 windows x86 arch:x86

abe232adb1b9575d3a0a702dc057cbbe

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/07/2011, 00:00

Not After

03/10/2014, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f4:01:9d:f9:d5:f7:ab:c7:e1:3d:a3:00:e5:e1:b2:22:1d:4e:a4:94
Signer

Actual PE Digest

f4:01:9d:f9:d5:f7:ab:c7:e1:3d:a3:00:e5:e1:b2:22:1d:4e:a4:94

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathFileExistsW

kernel32

FreeLibrary
SetDllDirectoryW
GetShortPathNameW
GetModuleHandleExW
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
LoadLibraryW
GetModuleHandleW
GetProcAddress

user32

MessageBoxW

Sections

.text
Size: 30.0MB - Virtual size: 30.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

ctr
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 255KB - Virtual size: 3.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

typeinfo
Size: 414KB - Virtual size: 414KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

fieldinf
Size: 236KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 851B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 271KB - Virtual size: 270KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Need For Speed The Run.par
Support/mnfst.txt
Update/Patch/Data/Win32/AudioSuperBundle.sb
Update/Patch/Data/Win32/AudioSuperBundle.toc
Update/Patch/Data/Win32/Chunks0.sb
Update/Patch/Data/Win32/Chunks0.toc
Update/Patch/Data/Win32/Chunks1.sb
Update/Patch/Data/Win32/Chunks1.toc
Update/Patch/Data/Win32/Chunks2.sb
Update/Patch/Data/Win32/Chunks2.toc
Update/Patch/Data/Win32/LoadScreenBundle.sb
Update/Patch/Data/Win32/LoadScreenBundle.toc
Update/Patch/Data/Win32/Loc/en.sb
Update/Patch/Data/Win32/Loc/en.toc
Update/Patch/Data/Win32/Loc/lg.sb
Update/Patch/Data/Win32/Loc/lg.toc
Update/Patch/Data/Win32/Loc/zh.sb
Update/Patch/Data/Win32/Loc/zh.toc
Update/Patch/Data/Win32/ShippingVehicles.sb
Update/Patch/Data/Win32/ShippingVehicles.toc
Update/Patch/Data/Win32/UI.sb
Update/Patch/Data/Win32/UI.toc
Update/Patch/Data/Win32/_c4/GameConfigurations/NFSGame.sb
Update/Patch/Data/Win32/_c4/GameConfigurations/NFSGame.toc
Update/Patch/Data/Win32/_c4/Levels/FE/FrontEnd/FrontEnd.sb
Update/Patch/Data/Win32/_c4/Levels/FE/FrontEnd/FrontEnd.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0100_SanFrancisco/Level_0100_SanFrancisco.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0100_SanFrancisco/Level_0100_SanFrancisco.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0200_AltamontPass/Level_0200_AltamontPass.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0200_AltamontPass/Level_0200_AltamontPass.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0250_YosemiteApproach/Level_0250_YosemiteApproach.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0250_YosemiteApproach/Level_0250_YosemiteApproach.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0300_YosemiteSouth/Level_0300_YosemiteSouth.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0300_YosemiteSouth/Level_0300_YosemiteSouth.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0400_SierraPass/Level_0400_SierraPass.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0400_SierraPass/Level_0400_SierraPass.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0500_DesertHills/Level_0500_DesertHills.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0500_DesertHills/Level_0500_DesertHills.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0600_DesertValley/Level_0600_DesertValley.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0600_DesertValley/Level_0600_DesertValley.toc
Update/Patch/Data/Win32/_c4/Levels/Level_0800_LasVegasEast/Level_0800_LasVegasEast.sb
Update/Patch/Data/Win32/_c4/Levels/Level_0800_LasVegasEast/Level_0800_LasVegasEast.toc
Update/Patch/Data/Win32/_c4/Levels/Level_1100_MillionDollar/Level_1100_MillionDollar.sb
Update/Patch/Data/Win32/_c4/Levels/Level_1100_MillionDollar/Level_1100_MillionDollar.toc
Update/Patch/Data/Win32/_c4/Levels/Level_1300_IndependencePass/Level_1300_IndependencePass.sb
Update/Patch/Data/Win32/_c4/Levels/Level_1300_IndependencePass/Level_1300_IndependencePass.toc
Update/Patch/Data/Win32/_c4/Levels/Level_1700_MountainInterstate/Level_1700_MountainInterstate.sb
Update/Patch/Data/Win32/_c4/Levels/Level_1700_MountainInterstate/Level_1700_MountainInterstate.toc
Update/Patch/Data/Win32/_c4/Levels/Level_2300_BuffaloGap/Level_2300_BuffaloGap.sb
Update/Patch/Data/Win32/_c4/Levels/Level_2300_BuffaloGap/Level_2300_BuffaloGap.toc
Update/Patch/Data/Win32/_c4/Levels/Level_2400_PlainsInterstate/Level_2400_PlainsInterstate.sb
Update/Patch/Data/Win32/_c4/Levels/Level_2400_PlainsInterstate/Level_2400_PlainsInterstate.toc
Update/Patch/Data/Win32/_c4/Levels/Level_2500_RuralFarms/Level_2500_RuralFarms.sb
Update/Patch/Data/Win32/_c4/Levels/Level_2500_RuralFarms/Level_2500_RuralFarms.toc
Update/Patch/Data/Win32/_c4/Levels/Level_2600_RuralHighway/Level_2600_RuralHighway.sb
Update/Patch/Data/Win32/_c4/Levels/Level_2600_RuralHighway/Level_2600_RuralHighway.toc
Update/Patch/Data/Win32/_c4/Levels/Level_2800_ChicagoInterstate/Level_2800_ChicagoInterstate.sb
Update/Patch/Data/Win32/_c4/Levels/Level_2800_ChicagoInterstate/Level_2800_ChicagoInterstate.toc
Update/Patch/Data/Win32/_c4/Levels/Level_3000_ChicagoDowntown/Level_3000_ChicagoDowntown.sb
Update/Patch/Data/Win32/_c4/Levels/Level_3000_ChicagoDowntown/Level_3000_ChicagoDowntown.toc
Update/Patch/Data/Win32/_c4/Levels/Level_3050_LakeShore/Level_3050_LakeShore.sb
Update/Patch/Data/Win32/_c4/Levels/Level_3050_LakeShore/Level_3050_LakeShore.toc
Update/Patch/Data/Win32/_c4/Levels/Level_3100_ChicagoIndustrial/Level_3100_ChicagoIndustrial.sb
Update/Patch/Data/Win32/_c4/Levels/Level_3100_ChicagoIndustrial/Level_3100_ChicagoIndustrial.toc
Update/Patch/Data/Win32/_c4/Levels/Level_3500_SmokyMountains/Level_3500_SmokyMountains.sb
Update/Patch/Data/Win32/_c4/Levels/Level_3500_SmokyMountains/Level_3500_SmokyMountains.toc
Update/Patch/Data/Win32/_c4/Levels/Level_4000_NewJersey/Level_4000_NewJersey.sb
Update/Patch/Data/Win32/_c4/Levels/Level_4000_NewJersey/Level_4000_NewJersey.toc
Update/Patch/Data/Win32/_c4/Levels/Level_4050_NewYorkApproach/Level_4050_NewYorkApproach.sb
Update/Patch/Data/Win32/_c4/Levels/Level_4050_NewYorkApproach/Level_4050_NewYorkApproach.toc
Update/Patch/Data/Win32/_c4/Levels/Level_4100_NewYork/Level_4100_NewYork.sb
Update/Patch/Data/Win32/_c4/Levels/Level_4100_NewYork/Level_4100_NewYork.toc
Update/Patch/Data/Win32/default_settings_Win32.sb
Update/Patch/Data/Win32/default_settings_Win32.toc
Update/Patch/Data/common.dat
Update/Patch/Data/initfs_Win32
Update/Patch/Data/layout.toc
Update/Patch/package.mft
__Installer/Cleanup.dat
__Installer/Cleanup.exe
.exe windows:5 windows x86 arch:x86

5d5b71f55231a0be3a6e63d0446bac71

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/07/2011, 00:00

Not After

03/10/2014, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:65:c3:c7:84:dc:e8:19:8a:32:38:f7:c1:3f:88:de:59:c1:fb:76
Signer

Actual PE Digest

54:65:c3:c7:84:dc:e8:19:8a:32:38:f7:c1:3f:88:de:59:c1:fb:76

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

CreateThread
GetEnvironmentStrings
FreeEnvironmentStringsA
GetProcessHeap
SetEndOfFile
GetModuleHandleA
CreatePipe
GetFileAttributesA
DeleteFileA
MoveFileA
DuplicateHandle
CreateProcessA
FormatMessageA
FindResourceW
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
GetCurrentThreadId
GetFileSize
FindFirstFileW
FindResourceExW
LoadResource
WriteFile
GetUserDefaultLangID
WideCharToMultiByte
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetProcAddress
FindClose
Process32FirstW
RemoveDirectoryW
GetSystemInfo
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
SetFileAttributesW
SetFilePointer
GetDriveTypeW
CreateDirectoryW
LoadLibraryW
FlushFileBuffers
GetNativeSystemInfo
CreateProcessW
CopyFileW
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
RaiseException
DeleteFileW
HeapAlloc
HeapFree
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
ExitProcess
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetTimeZoneInformation
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetFullPathNameW
CloseHandle
ReleaseMutex
Sleep
GetModuleHandleW
WaitForSingleObject
CreateMutexW
RtlUnwind
GetEnvironmentVariableW

user32

DispatchMessageW
SetWindowTextW
SendMessageW
SetWindowsHookExW
CallNextHookEx
GetDlgItem
MessageBoxW
UnhookWindowsHookEx
DestroyWindow
GetMessageW
PostMessageW
TranslateMessage
IsDialogMessageW
LoadIconW
ShowWindow
CreateDialogParamW
IsWindow
SetDlgItemTextW
GetSystemMetrics

shell32

SHFileOperationW
SHCreateDirectoryExW
SHGetFolderPathW
ord165
ShellExecuteW

shlwapi

SHDeleteKeyW
PathRemoveFileSpecW

msi

ord113

advapi32

RegQueryValueExW
RegDeleteKeyW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegEnumKeyW

ole32

CoInitializeEx
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocString
VariantClear

Sections

.text
Size: 344KB - Virtual size: 344KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
__Installer/Touchup.dat
__Installer/Touchup.exe
.exe windows:5 windows x86 arch:x86

df18b71b73b2b539cf25f309416ac9ce

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

27/07/2011, 00:00

Not After

03/10/2014, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

75:d7:ab:76:d9:58:fe:16:6f:63:7a:69:a4:6e:b0:3e:cc:15:dd:04
Signer

Actual PE Digest

75:d7:ab:76:d9:58:fe:16:6f:63:7a:69:a4:6e:b0:3e:cc:15:dd:04

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Imports

kernel32

GetCurrentThreadId
GetFileSize
FindFirstFileW
FindResourceExW
LoadResource
WriteFile
GetUserDefaultLangID
WideCharToMultiByte
Sleep
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
GetLastError
GetCurrentDirectoryW
GetProcAddress
FindClose
Process32FirstW
RemoveDirectoryW
GetSystemInfo
Process32NextW
FindNextFileW
CreateToolhelp32Snapshot
CloseHandle
DeleteFileW
SetFileAttributesW
SetFilePointer
GetDriveTypeW
CreateDirectoryW
LoadLibraryW
FlushFileBuffers
GetNativeSystemInfo
CreateProcessW
WaitForSingleObject
CopyFileW
GetExitCodeProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetSystemTimeAsFileTime
RaiseException
RtlUnwind
HeapAlloc
HeapFree
GetFileAttributesA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetStdHandle
GetModuleFileNameA
MoveFileA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetTimeZoneInformation
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
CreateProcessA
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
FreeLibrary
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetConsoleCP
GetConsoleMode
FreeEnvironmentStringsA
GetEnvironmentStrings
CompareStringA
CompareStringW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
DuplicateHandle
FormatMessageA
FindResourceW
LockResource
SizeofResource
GlobalAlloc
GlobalLock
GlobalUnlock
DeleteFileA
CreatePipe
GetModuleHandleA
SetEndOfFile
GetProcessHeap
ExitProcess
GetModuleHandleW
GlobalFree
GetFullPathNameW

user32

MessageBoxW
SetWindowsHookExW
SendMessageW
GetSystemMetrics
LoadIconW
GetDlgItem
SetDlgItemTextW
UnhookWindowsHookEx
CallNextHookEx

shlwapi

PathRemoveFileSpecW
SHDeleteKeyW

msi

ord113

advapi32

RegCloseKey
RegEnumKeyW
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

SHFileOperationW
SHGetFolderPathW
SHCreateDirectoryExW
ord165

ole32

CoInitializeEx
StringFromGUID2
CoCreateGuid
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysFreeString
VariantClear
SysAllocString

Sections

.text
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
__Installer/installerdata.xml

Sharing

General

Malware Config

Signatures

Files

a21249f91f45814e0d53978ee6d1259a

Headers

DLL Characteristics

File Characteristics

Imports

msvcr90

kernel32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 597B

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

e7:3a:2e:35:c4:4d:39:96:b8:cc:dd:d6:38:b9:9c:a4:61:bc:cf:ecSigner

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 454KB - Virtual size: 454KB

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5Certificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2a:86:66:ac:e7:d4:b9:da:98:7b:f1:87:9b:69:e7:f5:38:46:3c:cbSigner

Headers

DLL Characteristics

File Characteristics

Sections

.rsrc Size: 454KB - Virtual size: 454KB

de121d28eecccb3bbd6d8668bdef060c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

winmm

urlmon

advapi32

shell32

oleaut32

msvcp90

shlwapi

msvcr90

bcrypt

dxgi

dwmapi

dinput8

setupapi

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 597B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

e7:3a:2e:35:c4:4d:39:96:b8:cc:dd:d6:38:b9:9c:a4:61:bc:cf:ec
Signer

.rsrc
Size: 454KB - Virtual size: 454KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2a:86:66:ac:e7:d4:b9:da:98:7b:f1:87:9b:69:e7:f5:38:46:3c:cb
Signer

.rsrc
Size: 454KB - Virtual size: 454KB

.text
Size: - Virtual size: 30.0MB

ctr
Size: - Virtual size: 1.8MB

.rdata
Size: - Virtual size: 3.3MB

.data
Size: - Virtual size: 3.5MB

.idata
Size: - Virtual size: 28KB

typeinfo
Size: - Virtual size: 416KB

fieldinf
Size: - Virtual size: 240KB

.tls
Size: 312B - Virtual size: 4KB

ALI2130
Size: - Virtual size: 437KB

ALI2131
Size: 11.1MB - Virtual size: 11.1MB

.rsrc
Size: 222KB - Virtual size: 222KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0c:61:8e:5c:55:72:5b:09:15:8b:62:14:9c:42:5b:a5
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

f4:01:9d:f9:d5:f7:ab:c7:e1:3d:a3:00:e5:e1:b2:22:1d:4e:a4:94
Signer

.text
Size: 30.0MB - Virtual size: 30.0MB

ctr
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 3.3MB - Virtual size: 3.3MB

.data
Size: 255KB - Virtual size: 3.5MB

.idata
Size: 27KB - Virtual size: 26KB

typeinfo
Size: 414KB - Virtual size: 414KB

fieldinf
Size: 236KB - Virtual size: 236KB

.tls
Size: 1024B - Virtual size: 851B

.rsrc
Size: 271KB - Virtual size: 270KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate