d00ec3b2112486cb5c0bb8169b016817355314fbe4cb32468087980146571955[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

d00ec3b2112486cb5c0bb8169b016817355314fbe4cb32468087980146571955.exe
Size

3.2MB
MD5

5e04589f57e4dba6b71a1f8d1fa0c2ec
SHA1

c77c8b75bb44c3dd2295505ff69d8ca1ec548f8c
SHA256

d00ec3b2112486cb5c0bb8169b016817355314fbe4cb32468087980146571955
SHA512

c5bc1af4e08e2a010838a8be317c0232b0b12e5b87237c1627df9fe991a87ab012deff54f31ab3902fd726bcf1d4f28e8596d46f2f1ffb6ef536fdcf6434edca
SSDEEP

98304:EgIEkFQ9fJqDSk0iZndPFI4z/hJc9WeNX:Egln9hqWk0iZnNFIAhC

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstGameInfoHelperIplay.exe
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/iWinGames.exe

NSIS installer 6 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_1
static1/unpack001/Uninstall.exe	nsis_installer_2
static1/unpack001/iWinGames.exe	nsis_installer_1
static1/unpack001/iWinGames.exe	nsis_installer_2

Files

d00ec3b2112486cb5c0bb8169b016817355314fbe4cb32468087980146571955.exe
.exe windows:4 windows x86 arch:x86

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

c3:9d:f1:d1:d5:d7:bb:d9:44:42:20:53:4f:17:86:f2:96:2f:5a:0d
Signer

Actual PE Digest

c3:9d:f1:d1:d5:d7:bb:d9:44:42:20:53:4f:17:86:f2:96:2f:5a:0d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary

user32

CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GameuxInstallHelper.dll
.dll windows:6 windows x86 arch:x86

d46feae5913f2b33d6159af1367e8ee7

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:ac
Signer

Actual PE Digest

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

GameuxInstallHelper.pdb

Imports

kernel32

GetFileAttributesW
GetWindowsDirectoryW
MultiByteToWideChar
DeleteFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetCommandLineA
GetVersionExA
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThreadId
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
OutputDebugStringA
CreateFileW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA
FlushFileBuffers
ReadFile
CloseHandle
GetCurrentProcessId
GetFullPathNameW
GetVersionExW
TerminateProcess
WriteFile

ole32

CoSetProxyBlanket
StringFromGUID2
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

msi

ord74
ord145
ord70

oleaut32

VariantClear
SysAllocString
SysFreeString

shell32

ShellExecuteW
SHGetFolderPathW
SHCreateDirectoryExW
SHFileOperationW

shlwapi

SHDeleteKeyW
PathAddBackslashW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegSetValueExW
RegCloseKey

Exports

Exports

AddToGameExplorerA
AddToGameExplorerUsingMSI
AddToGameExplorerW
CreateTaskA
CreateTaskW
GenerateGUID
RegisterWithMediaCenterA
RegisterWithMediaCenterW
RemoveFromGameExplorer
RemoveFromGameExplorerUsingMSI
RemoveRichSavedGamesA
RemoveRichSavedGamesW
RemoveTasks
RetrieveGUIDForApplicationA
RetrieveGUIDForApplicationW
SetMSIGameExplorerProperties
SetupRichSavedGamesA
SetupRichSavedGamesW
UnRegisterWithMediaCenterA
UnRegisterWithMediaCenterW

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstGameInfoHelperIplay.exe
.exe windows:5 windows x86 arch:x86

2f05f2531b6da725824fc913b1b92aff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Work\DownloadGames\games\GameManagerIPlay\Runnable\InstGameInfoHelper.pdb

Imports

wininet

InternetOpenUrlA
InternetCloseHandle
InternetOpenA
InternetReadFile

oleaut32

OleLoadPicture
OleSavePictureFile

ole32

CreateStreamOnHGlobal

kernel32

GetStdHandle
GetProcessHeap
SetEndOfFile
LCMapStringW
LCMapStringA
GlobalAlloc
GlobalFree
CreateFileA
GetFileSize
CloseHandle
GlobalLock
ReadFile
GlobalUnlock
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
Sleep
HeapSize
ExitProcess
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
HeapFree
HeapAlloc
RaiseException
RtlUnwind
SetFilePointer
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
MultiByteToWideChar
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
VirtualAlloc
LoadLibraryA
InitializeCriticalSectionAndSpinCount
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
FlushFileBuffers
GetLocaleInfoA
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 835B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 586B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ftdownload.dat
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

6b7d154c806f1e47db325229c300c6df

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleA
lstrlenA
GetExitCodeProcess
WaitForSingleObject
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
lstrcpynA
ReadFile
PeekNamedPipe
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
GetProcAddress
GlobalLock
DeleteFileA
lstrcmpiA
GetCurrentProcess
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GlobalFree
GlobalAlloc
GetModuleFileNameA
ExitProcess
GetCommandLineA
CreatePipe
GetVersionExA
lstrcatA

user32

SendMessageA
OemToCharBuffA
FindWindowExA
CharNextA
wsprintfA
CharPrevA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 458B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/version.txt
AdminWorker.exe
.exe windows:5 windows x86 arch:x86

3b5152cb17569578f8cc6b7698c665bc

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

76:3c:61:4a:b9:dc:f3:58:1a:0d:12:ad:6f:f9:67:a9:2c:3d:4b:06
Signer

Actual PE Digest

76:3c:61:4a:b9:dc:f3:58:1a:0d:12:ad:6f:f9:67:a9:2c:3d:4b:06

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

SHGetValueW
SHGetValueA

kernel32

GetCurrentDirectoryW
CloseHandle
GetFullPathNameW
DeleteFileA
GetModuleFileNameA
GetModuleFileNameW
DeleteFileW
WriteFile
Sleep
GetModuleHandleA
GetDateFormatW
FindClose
FileTimeToSystemTime
FindNextFileW
FindFirstFileW
SystemTimeToFileTime
FormatMessageA
OpenProcess
SetLastError
CreateFileW
HeapAlloc
RemoveDirectoryW
TerminateProcess
WaitForSingleObject
CopyFileW
ReadFile
GetFileSize
CreateProcessA
CopyFileA
CompareStringW
CompareStringA
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
MultiByteToWideChar
GetTempPathW
WideCharToMultiByte
CreateDirectoryW
GetSystemTime
GetLastError
GetVersionExA
FreeLibrary
LoadLibraryA
GetProcAddress
GetCurrentDirectoryA
GetStringTypeW
HeapFree
SetEnvironmentVariableA
GetStringTypeA
InitializeCriticalSectionAndSpinCount
SetFilePointer
SetStdHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetLocaleInfoA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
GetCommandLineA
GetStartupInfoA
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapSize
ExitProcess
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings

user32

PostMessageA
SetActiveWindow
ShowWindow
EnumWindows
SendMessageA
GetWindowThreadProcessId
FindWindowA
MessageBoxA
SetForegroundWindow

advapi32

RegDeleteValueW
RegEnumKeyW
RegEnumValueW
RegDeleteKeyA
RegOpenKeyW
RegEnumKeyA
RegOpenKeyA
RegCreateKeyExA
RegEnumValueA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExW

shell32

SHFileOperationA
ShellExecuteA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetPathFromIDListW
SHFileOperationW
SHGetPathFromIDListA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 199KB - Virtual size: 199KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 363KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IplayGames.exe
.exe windows:5 windows x86 arch:x86

bcc1f4006d44ed5f80c74930f1181a6f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

ef:08:af:19:f8:ba:63:7b:c9:ca:fb:bc:d0:a7:82:6d:b3:9e:07:a0
Signer

Actual PE Digest

ef:08:af:19:f8:ba:63:7b:c9:ca:fb:bc:d0:a7:82:6d:b3:9e:07:a0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

WSAGetLastError
inet_addr
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
getservbyport
ntohs
WSASetLastError
closesocket
connect
socket
ioctlsocket
send
WSACleanup
recv
WSAStartup
gethostbyname

winmm

PlaySoundW
PlaySoundA
joyGetPosEx
timeGetTime

msimg32

TransparentBlt
GradientFill

shlwapi

SHGetValueW
SHGetValueA
PathFindFileNameA
PathFindExtensionA
PathStripToRootA
PathIsUNCA

kernel32

EnterCriticalSection
GlobalReAlloc
GlobalHandle
InitializeCriticalSection
TlsAlloc
TlsSetValue
LocalReAlloc
DeleteCriticalSection
TlsFree
GlobalFlags
GetCPInfo
GetOEMCP
FileTimeToLocalFileTime
GetUserDefaultLCID
GetFileAttributesA
GetProfileIntA
RaiseException
UnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
VirtualProtect
VirtualQuery
GetSystemTimeAsFileTime
RemoveDirectoryA
HeapReAlloc
GetCommandLineA
GetStartupInfoA
ExitThread
HeapSize
HeapCreate
GetStdHandle
GetACP
IsValidCodePage
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetConsoleCP
GetConsoleMode
GetStringTypeA
GetStringTypeW
InitializeCriticalSectionAndSpinCount
TlsGetValue
GetEnvironmentStrings
QueryPerformanceCounter
GetTimeFormatA
GetDateFormatA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
InterlockedCompareExchange
LoadLibraryExA
FindResourceExA
GetUserDefaultLangID
GetNumberFormatA
GetCurrencyFormatA
lstrcpyA
WinExec
IsBadWritePtr
IsBadReadPtr
GetVersionExA
GetTickCount
GetLastError
LocalFree
CloseHandle
LocalAlloc
GetCurrentProcess
WideCharToMultiByte
MultiByteToWideChar
LoadLibraryA
LoadLibraryW
GetTempPathA
GetTempPathW
GetCurrentDirectoryA
GetCurrentDirectoryW
CreateDirectoryA
LeaveCriticalSection
SetEvent
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
GetThreadLocale
SetEndOfFile
UnlockFile
LockFile
GetPrivateProfileStringA
WritePrivateProfileStringA
lstrcmpA
GetCurrentProcessId
GetCurrentThreadId
GlobalGetAtomNameA
GlobalAddAtomA
GlobalFindAtomA
GlobalDeleteAtom
lstrcmpW
GlobalSize
SetErrorMode
SetUnhandledExceptionFilter
GetCurrentThread
GetExitCodeThread
SetThreadPriority
ResumeThread
SuspendThread
DuplicateHandle
FormatMessageW
GetEnvironmentStringsW
CreateDirectoryW
DeleteFileA
DeleteFileW
GetFullPathNameA
GetFullPathNameW
FreeEnvironmentStringsW
GetFileAttributesW
FreeResource
FlushFileBuffers
SystemTimeToFileTime
FileTimeToSystemTime
GetDateFormatW
CreateEventA
GetMailslotInfo
GlobalFree
CreateMailslotA
GetModuleHandleW
ExitProcess
GetWindowsDirectoryA
GetFileTime
FindFirstFileA
FindNextFileA
FindFirstFileW
FindNextFileW
FindClose
GlobalAlloc
GlobalLock
GlobalUnlock
GetSystemTime
GetTimeZoneInformation
GetLocalTime
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetComputerNameA
HeapAlloc
HeapFree
SetLastError
OpenProcess
GetModuleHandleA
ReleaseMutex
TerminateProcess
GetExitCodeProcess
WriteFile
ReadFile
GetFileSize
CreateThread
GetVolumeInformationA
GetSystemInfo
CreateFileA
GetDiskFreeSpaceExA
Sleep
TerminateThread
WaitForSingleObject
VirtualFree
VirtualAlloc
GetSystemDirectoryA
FreeLibrary
GetProcAddress
FormatMessageA
GetEnvironmentVariableW
lstrlenA
lstrcmpiA
CompareStringW
CompareStringA
lstrlenW
GetVersion
InterlockedExchange
MulDiv
FindResourceA
LoadResource
LockResource
SizeofResource
CopyFileW
CopyFileA
CreateProcessW
CreateProcessA
SetCurrentDirectoryW
SetCurrentDirectoryA
GetModuleFileNameW
GetModuleFileNameA
MoveFileW
MoveFileA
OpenMutexW
OpenMutexA
CreateMutexW
CreateMutexA
CreateFileW
FreeEnvironmentStringsA

user32

BringWindowToTop
SetMenu
TranslateAcceleratorA
ValidateRect
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
ModifyMenuA
EnableMenuItem
CheckMenuItem
EndPaint
BeginPaint
GetWindowDC
IsWindowEnabled
IsDialogMessageA
SendDlgItemMessageA
WinHelpA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
GetPropA
RemovePropA
GetWindowTextLengthA
GetLastActivePopup
GetDlgItem
GetTopWindow
UnhookWindowsHookEx
GetMessageTime
GetMessagePos
MapWindowPoints
ScrollWindow
TrackPopupMenu
SetScrollRange
GetScrollRange
SetScrollPos
GetScrollPos
ShowScrollBar
GetMenu
GetClassInfoExA
RegisterClassA
AdjustWindowRectEx
EqualRect
GetScrollInfo
SetScrollInfo
SetWindowPlacement
GetDlgCtrlID
CallWindowProcA
SystemParametersInfoA
GetMenuState
GetMenuStringA
GetMenuItemID
InsertMenuA
GetMenuItemCount
GetSubMenu
RemoveMenu
EnumChildWindows
PeekMessageA
TranslateMessage
DispatchMessageA
IsWindowUnicode
EndDialog
MoveWindow
CreateIconIndirect
GetWindowRgn
IsMenu
GetAsyncKeyState
SetLayeredWindowAttributes
UpdateLayeredWindow
RegisterClassExA
UnregisterClassA
GetCaretPos
RegisterWindowMessageA
GetSysColor
GetMenuItemInfoA
WaitMessage
ReleaseCapture
SetCapture
GetCapture
DrawFocusRect
FillRect
InflateRect
CreatePopupMenu
GetDesktopWindow
LoadIconA
SetParent
IsIconic
LoadMenuA
SetWindowLongA
AllowSetForegroundWindow
EnumWindows
GetForegroundWindow
GetWindowThreadProcessId
CreateWindowExW
SendMessageW
DestroyWindow
CreateWindowExA
GetClassNameA
IsZoomed
InsertMenuItemA
LoadAcceleratorsA
DestroyMenu
ReuseDDElParam
UnpackDDElParam
DefFrameProcA
DefMDIChildProcA
DrawMenuBar
TranslateMDISysAccel
GetNextDlgTabItem
CreateDialogIndirectParamA
PostQuitMessage
GetMessageA
ShowOwnedPopups
MapDialogRect
SetWindowContextHelpId
GetSysColorBrush
RegisterClipboardFormatA
InvalidateRgn
CreateMenu
GetKeyNameTextA
MapVirtualKeyA
DrawFrameControl
ReleaseDC
GetDC
CharUpperA
BeginDeferWindowPos
DeleteMenu
DeferWindowPos
EndDeferWindowPos
ToAsciiEx
GetClassInfoA
DefWindowProcA
GetWindowLongA
GetWindowPlacement
GetSystemMetrics
IsChild
SetWindowRgn
GetSystemMenu
ShowWindow
SetActiveWindow
SetForegroundWindow
DrawIcon
SetFocus
GetActiveWindow
SetCursor
WindowFromPoint
DestroyCursor
LoadImageA
LoadCursorA
DestroyIcon
IsWindow
GetKeyState
IsWindowVisible
ClientToScreen
PostMessageA
OffsetRect
CopyRect
GetCursorPos
GrayStringA
DrawTextExA
OpenClipboard
GetClipboardData
TabbedTextOutA
SetWindowPos
EnableWindow
GetWindow
GetFocus
KillTimer
SetTimer
RedrawWindow
InvalidateRect
UpdateWindow
ScreenToClient
GetClientRect
GetWindowRect
LoadBitmapA
SendMessageA
GetParent
IntersectRect
SetRectEmpty
PtInRect
IsRectEmpty
FindWindowW
FindWindowA
MessageBoxW
MessageBoxA
DrawTextW
DrawTextA
GetWindowTextW
GetWindowTextA
SetWindowTextW
SetWindowTextA
GetLastInputInfo
UnionRect
CharNextA
CopyAcceleratorTableA
FrameRect
DrawStateA
GetNextDlgGroupItem
MessageBeep
GetDCEx
PostThreadMessageA
LockWindowUpdate
SetRect
AppendMenuA
CloseClipboard
EmptyClipboard
SetClipboardData
MapVirtualKeyExA
DestroyAcceleratorTable
EnableScrollBar
IsCharAlphaNumericA
DrawIconEx
GetCursor
GetIconInfo
CreateAcceleratorTableA
LoadMenuIndirectA
IsClipboardFormatAvailable
GetKeyboardState
GetKeyboardLayout

gdi32

CopyMetaFileA
GetClipBox
SetTextColor
SetBkColor
SaveDC
RestoreDC
SetMapMode
ExcludeClipRect
IntersectClipRect
LineTo
MoveToEx
SetTextAlign
SelectClipRgn
GetViewportExtEx
GetWindowExtEx
GetPixel
SetViewportOrgEx
OffsetViewportOrgEx
SelectObject
ScaleViewportExtEx
SetWindowOrgEx
OffsetWindowOrgEx
SetWindowExtEx
ScaleWindowExtEx
ExtSelectClipRgn
CreatePatternBrush
SelectPalette
GetTextAlign
CreatePen
ExtCreatePen
CreateHatchBrush
SetRectRgn
PatBlt
GetTextMetricsA
OffsetRgn
StretchDIBits
GetRgnBox
Rectangle
RoundRect
DeleteDC
GetTextColor
CombineRgn
CreateRectRgn
CreateFontA
GetStretchBltMode
SetStretchBltMode
CreateDIBitmap
GetDeviceCaps
SetBkMode
CreateSolidBrush
CreatePolygonRgn
CreateRectRgnIndirect
DeleteObject
GetViewportOrgEx
CreateFontIndirectA
CreateDIBSection
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
BitBlt
LPtoDP
DPtoLP
GetMapMode
GetBkColor
CreateCompatibleDC
GetObjectA
CreateCompatibleBitmap
CreateBitmap
GetStockObject
GetTextExtentPoint32A
GetTextExtentPoint32W
SetPixel
SetViewportExtEx
StretchBlt
GetWindowOrgEx
GetTextFaceA
SetBrushOrgEx
ExtFloodFill
SetPixelV
Polygon
CreateEllipticRgn
CreateEllipticRgnIndirect
PtInRegion
EnumFontFamiliesExA
FrameRgn
RealizePalette
GetDIBits
SetDIBits
GetTextCharset
EnumFontFamiliesA
ExtCreateRegion
Ellipse
FillRgn
GetNearestColor
CreateRoundRectRgn
CreatePalette

comdlg32

GetFileTitleA

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegQueryValueA
RegEnumKeyExW
RegQueryInfoKeyA
RegQueryValueExW
RegQueryValueExA
IsTextUnicode
RegOpenKeyExW
RegSetValueExW
RegEnumKeyW
RegEnumKeyA
RegEnumValueW
RegOpenKeyW
RegOpenKeyA
RegDeleteValueW
RegDeleteValueA
RegDeleteKeyW
RegDeleteKeyA
RegCreateKeyExW
OpenProcessToken
GetTokenInformation
RegCreateKeyExA
RegEnumValueA
RegSetValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
FreeSid

shell32

SHBrowseForFolderW
SHGetPathFromIDListA
SHGetPathFromIDListW
ShellExecuteA
ShellExecuteW
ShellExecuteExA
ShellExecuteExW
SHGetDesktopFolder
DragQueryFileA
DragFinish
SHBrowseForFolderA
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
SHFileOperationA
SHGetMalloc
ExtractIconW
ExtractIconA

oledlg

ord8

ole32

CoUninitialize
CoInitialize
OleRun
CoRegisterMessageFilter
CoRevokeClassObject
CoFreeUnusedLibraries
OleFlushClipboard
OleIsCurrentClipboard
StgOpenStorageOnILockBytes
CoGetClassObject
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
OleLoadFromStream
CLSIDFromString
CLSIDFromProgID
OleSaveToStream
OleDuplicateData
ReleaseStgMedium
CoTaskMemAlloc
CoTaskMemFree
OleUninitialize
OleInitialize
CoSetProxyBlanket
CreateStreamOnHGlobal
CoCreateInstance
WriteClassStm
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
DoDragDrop
OleGetClipboard
OleTranslateAccelerator
IsAccelerator

oleaut32

VarMul
VariantClear
SysAllocString
VariantInit
SysFreeString
SysStringLen
SystemTimeToVariantTime
SafeArrayDestroy
VariantChangeType
SysAllocStringLen
SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
VarDateFromStr
GetErrorInfo
VariantCopy
VarBstrFromDate
OleCreateFontIndirect

gdiplus

GdipGetImageEncodersSize
GdiplusStartup
GdipDisposeImage
GdipSaveImageToFile
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipLoadImageFromStream
GdipDrawImageRectI
GdipDrawLineI
GdipSetSmoothingMode
GdipReleaseDC
GdipCreateFromHDC
GdipDeleteGraphics
GdipDeletePen
GdipCreatePen1
GdipDrawImageI
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdipGetImageEncoders
GdipSetImagePalette
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipSetPropertyItem
GdipGetAllPropertyItems
GdipGetPropertySize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdiplusShutdown

psapi

GetModuleFileNameExA

wininet

HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetSetOptionA
InternetQueryOptionA
InternetGetCookieA
InternetSetCookieA
PrivacyGetZonePreferenceW
HttpSendRequestA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA

pdh

PdhLookupPerfNameByIndexA
PdhMakeCounterPathA
PdhAddCounterA
PdhRemoveCounter
PdhOpenQueryA
PdhCloseQuery
PdhCollectQueryData
PdhGetFormattedCounterValue

version

GetFileVersionInfoSizeW
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueW
GetFileVersionInfoW
VerQueryValueA

comctl32

ImageList_Duplicate

imagehlp

SymGetLineFromAddr
SymGetSymFromAddr
StackWalk
SymFunctionTableAccess
SymGetModuleBase

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 625KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 84KB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Uninstall.exe
.exe windows:4 windows x86 arch:x86

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

f1:01:5f:76:0b:06:d5:80:13:b9:e8:56:24:f8:df:dd:9d:a8:48:07
Signer

Actual PE Digest

f1:01:5f:76:0b:06:d5:80:13:b9:e8:56:24:f8:df:dd:9d:a8:48:07

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetTickCount
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
SearchPathA
GetShortPathNameA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetEnvironmentVariableA
GetWindowsDirectoryA
GetTempPathA
Sleep
CloseHandle
LoadLibraryA
lstrlenA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
ReadFile
lstrcpyA
lstrcatA
GetSystemDirectoryA
GetVersion
GetProcAddress
GlobalAlloc
CompareFileTime
SetFileTime
ExpandEnvironmentStringsA
lstrcmpiA
lstrcmpA
WaitForSingleObject
GlobalFree
GetExitCodeProcess
GetModuleHandleA
SetErrorMode
GetCommandLineA
LoadLibraryExA
FindFirstFileA
FindNextFileA
DeleteFileA
SetFilePointer
WriteFile
FindClose
WritePrivateProfileStringA
MultiByteToWideChar
MulDiv
GetPrivateProfileStringA
FreeLibrary

user32

CreateWindowExA
EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
GetDC
SystemParametersInfoA
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
ReleaseDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
GetClassInfoA
DialogBoxParamA
CharNextA
ExitWindowsEx
DestroyWindow
CreateDialogParamA
SetTimer
GetDlgItem
wsprintfA
SetForegroundWindow
ShowWindow
IsWindow
LoadImageA
SetWindowLongA
SetClipboardData
EmptyClipboard
OpenClipboard
EndPaint
PostQuitMessage
FindWindowExA
SendMessageTimeoutA
SetWindowTextA

gdi32

SelectObject
SetBkMode
CreateFontIndirectA
SetTextColor
DeleteObject
GetDeviceCaps
CreateBrushIndirect
SetBkColor

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA

advapi32

RegCloseKey
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

comctl32

ImageList_Create
ImageList_AddMasked
ImageList_Destroy
ord17

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/GameuxInstallHelper.dll
.dll windows:6 windows x86 arch:x86

d46feae5913f2b33d6159af1367e8ee7

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

10/01/1997, 07:00

Not After

31/12/2020, 07:00

Subject

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:0f:78:4d:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2007, 00:23

Not After

23/02/2009, 00:33

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:47:52:ba:00:00:00:00:00:04
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:53

Not After

16/09/2011, 02:03

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:D8A9-CFCC-579C,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

61:49:7c:ed:00:00:00:00:00:05
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/09/2006, 01:55

Not After

16/09/2011, 02:05

Subject

CN=Microsoft Timestamping Service,OU=nCipher DSE ESN:10D8-5847-CBF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:ac
Signer

Actual PE Digest

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

GameuxInstallHelper.pdb

Imports

kernel32

GetFileAttributesW
GetWindowsDirectoryW
MultiByteToWideChar
DeleteFileW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryW
GetCommandLineA
GetVersionExA
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
GetCurrentThreadId
HeapFree
HeapAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
OutputDebugStringA
CreateFileW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSection
GetModuleHandleW
GetCPInfo
GetACP
GetOEMCP
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
SetFilePointer
GetConsoleCP
GetConsoleMode
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
LCMapStringA
LCMapStringW
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
VirtualProtect
GetSystemInfo
VirtualQuery
CreateFileA
FlushFileBuffers
ReadFile
CloseHandle
GetCurrentProcessId
GetFullPathNameW
GetVersionExW
TerminateProcess
WriteFile

ole32

CoSetProxyBlanket
StringFromGUID2
CoInitialize
CoCreateInstance
CoUninitialize
CoCreateGuid
CreateStreamOnHGlobal

msi

ord74
ord145
ord70

oleaut32

VariantClear
SysAllocString
SysFreeString

shell32

ShellExecuteW
SHGetFolderPathW
SHCreateDirectoryExW
SHFileOperationW

shlwapi

SHDeleteKeyW
PathAddBackslashW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegEnumKeyW
RegSetValueExW
RegCloseKey

Exports

Exports

AddToGameExplorerA
AddToGameExplorerUsingMSI
AddToGameExplorerW
CreateTaskA
CreateTaskW
GenerateGUID
RegisterWithMediaCenterA
RegisterWithMediaCenterW
RemoveFromGameExplorer
RemoveFromGameExplorerUsingMSI
RemoveRichSavedGamesA
RemoveRichSavedGamesW
RemoveTasks
RetrieveGUIDForApplicationA
RetrieveGUIDForApplicationW
SetMSIGameExplorerProperties
SetupRichSavedGamesA
SetupRichSavedGamesW
UnRegisterWithMediaCenterA
UnRegisterWithMediaCenterW

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 835B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 586B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
WebUpdater.bmp
WebUpdater.exe
.exe windows:5 windows x86 arch:x86

50a9ba41270abe5a890b6ec548326b5c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

83:b6:51:ea:e5:c0:75:a4:f0:ca:44:27:00:f1:55:39:fc:8c:f3:fc
Signer

Actual PE Digest

83:b6:51:ea:e5:c0:75:a4:f0:ca:44:27:00:f1:55:39:fc:8c:f3:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

socket
gethostbyname
send
htons
WSACleanup
WSAStartup
connect
ioctlsocket
recv
WSAGetLastError
closesocket

kernel32

SetEndOfFile
GetCurrentProcess
FindClose
FindFirstFileA
CreateFileA
GetCPInfo
GetOEMCP
SetErrorMode
GetModuleHandleW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
CreateDirectoryA
GetCommandLineA
GetStartupInfoA
ExitProcess
HeapSize
HeapReAlloc
VirtualAlloc
GetTimeZoneInformation
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetACP
IsValidCodePage
LCMapStringW
HeapCreate
VirtualFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
GetStringTypeA
GetStringTypeW
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
DeleteFileA
InterlockedIncrement
FormatMessageA
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalHandle
GlobalReAlloc
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalFree
LocalAlloc
GlobalFlags
WritePrivateProfileStringA
MulDiv
lstrlenA
GlobalGetAtomNameA
GlobalFindAtomA
MultiByteToWideChar
lstrcmpW
GetVersionExA
InterlockedDecrement
GetModuleFileNameW
GlobalUnlock
GlobalFree
FreeResource
GetCurrentProcessId
GetLastError
GlobalAddAtomA
GlobalDeleteAtom
GetCurrentThread
GetCurrentThreadId
ConvertDefaultLocale
EnumResourceLanguagesA
GetLocaleInfoA
LoadLibraryExA
CompareStringA
FindResourceA
LoadResource
LockResource
SizeofResource
InterlockedExchange
GlobalLock
lstrcmpA
GlobalAlloc
GetModuleHandleA
GetModuleFileNameA
SetCurrentDirectoryA
TerminateProcess
HeapAlloc
HeapFree
WideCharToMultiByte
SetLastError
OpenProcess
FreeLibrary
LoadLibraryA
GetProcAddress
GetTempPathA
ReleaseMutex
CreateMutexA
CreateThread
Sleep
GetTickCount
TerminateThread
WaitForSingleObject
CloseHandle
FindNextFileA

user32

UnregisterClassA
DestroyMenu
EndPaint
BeginPaint
ReleaseDC
GetDC
ClientToScreen
GrayStringA
DrawTextExA
DrawTextA
TabbedTextOutA
ShowWindow
IsDialogMessageA
RegisterWindowMessageA
SendDlgItemMessageA
WinHelpA
GetCapture
GetClassLongA
GetClassNameA
SetPropA
GetPropA
RemovePropA
SetFocus
GetWindowTextA
GetForegroundWindow
GetTopWindow
GetMessageTime
MapWindowPoints
SetMenu
SetForegroundWindow
UpdateWindow
GetSubMenu
GetMenuItemID
GetMenuItemCount
CreateWindowExA
GetClassInfoExA
GetClassInfoA
RegisterClassA
GetSysColor
AdjustWindowRectEx
CopyRect
PtInRect
GetDlgCtrlID
DefWindowProcA
CallWindowProcA
GetMenu
SetWindowLongA
SetWindowPos
SystemParametersInfoA
GetWindowPlacement
GetWindowRect
GetWindow
UnhookWindowsHookEx
GetDesktopWindow
SetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindow
GetDlgItem
GetNextDlgTabItem
EndDialog
GetWindowLongA
GetLastActivePopup
IsWindowEnabled
SetCursor
SetWindowsHookExA
CallNextHookEx
GetMessageA
TranslateMessage
DispatchMessageA
GetActiveWindow
IsWindowVisible
GetKeyState
PeekMessageA
GetCursorPos
ValidateRect
SetMenuItemBitmaps
GetSysColorBrush
LoadCursorA
GetMessagePos
GetMenuCheckMarkDimensions
LoadBitmapA
GetFocus
GetParent
ModifyMenuA
GetMenuState
EnableMenuItem
CheckMenuItem
PostQuitMessage
LoadImageA
EnableWindow
SetWindowTextA
EnumWindows
GetSystemMetrics
LoadIconA
KillTimer
SetTimer
GetClientRect
IsIconic
SendMessageA
DrawIcon
GetWindowThreadProcessId
PostMessageA
MessageBoxA

gdi32

SetViewportExtEx
ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
DeleteDC
GetStockObject
ExtTextOutA
OffsetViewportOrgEx
GetDeviceCaps
SelectObject
SetViewportOrgEx
TextOutA
RectVisible
PtVisible
RestoreDC
SaveDC
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
DeleteObject
SetMapMode
Escape

winspool.drv

DocumentPropertiesA
ClosePrinter
OpenPrinterA

advapi32

RegSetValueExA
RegCreateKeyExA
RegQueryValueA
RegOpenKeyA
RegEnumKeyA
RegDeleteKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey

shell32

ShellExecuteA

shlwapi

PathFindExtensionA
PathFindFileNameA

oleaut32

VariantClear
VariantChangeType
VariantInit

Sections

.text
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 5.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 377KB - Virtual size: 377KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
gamepage/buynow.html
.html .js polyglot
gamepage/common.js
.js
gamepage/css/offline.css
gamepage/disconnected-upsell.html
.html
gamepage/end.html
.html
gamepage/expired.html
.html
gamepage/images/alert32x32.gif
.gif
gamepage/images/bg_header.gif
.gif
gamepage/images/buttons/close-blue-28.gif
.gif
gamepage/images/buttons/continue-orange-132.gif
.gif
gamepage/images/buttons/yesiwantabackupcd-orange-197.gif
.gif
gamepage/images/common/header-bg.gif
.gif
gamepage/images/common/header-small-bg.gif
.gif
gamepage/images/common/loading.gif
.gif
gamepage/images/continuefreetrial-32.gif
.gif
gamepage/images/global/logo-invis.gif
.gif
gamepage/images/global/logo.gif
.gif
gamepage/images/global/page-bg-swirly.gif
.gif
gamepage/images/global/page-bg.gif
.gif
gamepage/images/global/page-header-small-bg.jpg
.jpg
gamepage/images/logo.jpg
.jpg
gamepage/images/misc/blue-bottom-triangle.gif
.gif
gamepage/images/misc/information.gif
.gif
gamepage/images/ous/divider.gif
.gif
gamepage/images/ous/eus.jpg
.jpg
gamepage/images/ous/hotel-bg.gif
.gif
gamepage/images/ous/hotel-iwin.gif
.gif
gamepage/images/ous/opal.gif
.gif
gamepage/images/ous/opalbox.jpg
.jpg
gamepage/images/ous/ous-promo-banner.jpg
.jpg
gamepage/images/plans/plan1.gif
.gif
gamepage/images/plans/plan2.gif
.gif
gamepage/images/plans/plan3.gif
.gif
gamepage/images/product/feature.jpg
.jpg
gamepage/open.html
.html
gamepage/operationfailed.html
.html .js polyglot
gamepage/scripts/disconnected-upsell.js
.js
gamepage/scripts/popups.js
.js
gamepage/scripts/prototype-1.6.js
.js
gamepage/styles/base.css
gamepage/styles/disconnected-upsell.css
gamepage/styles/shoppingcart.css
gamepage/success.html
.html
host.cfg
iWinGames.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
iWinTrusted.exe
.exe windows:5 windows x86 arch:x86

0ae83afb51c737df82df0d755a57f7dd

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

29/10/2014, 00:00

Not After

27/12/2016, 23:59

Subject

CN=IWIN\, INC,O=IWIN\, INC,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Key Usages

KeyUsageDigitalSignature

ca:e6:07:13:e2:8e:b5:dc:95:1e:ac:9f:3c:c0:09:17:e3:ee:6b:9d
Signer

Actual PE Digest

ca:e6:07:13:e2:8e:b5:dc:95:1e:ac:9f:3c:c0:09:17:e3:ee:6b:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

kernel32

GetCurrentProcess
GetCurrentThread
SetEvent
EnterCriticalSection
LeaveCriticalSection
DebugBreak
CreateThread
CreateEventW
GetCommandLineW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetTempPathW
GetDateFormatW
DeleteFileW
FindClose
FileTimeToSystemTime
GetModuleFileNameW
FindFirstFileW
SystemTimeToFileTime
GetSystemTime
CreateMutexW
ReleaseMutex
Sleep
CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus
CreateFileW
WriteConsoleW
GetConsoleOutputCP
lstrcmpiW
GetModuleHandleW
lstrlenW
LocalAlloc
LocalFree
FormatMessageW
MultiByteToWideChar
GetLastError
GetProcessHeap
InterlockedDecrement
OutputDebugStringW
WaitForSingleObject
GetExitCodeProcess
HeapAlloc
HeapFree
WideCharToMultiByte
SetLastError
OpenProcess
CloseHandle
FreeLibrary
LoadLibraryA
GetProcAddress
DeleteCriticalSection
InitializeCriticalSection
RaiseException
InterlockedIncrement
LCMapStringW
GetStringTypeA
GetStringTypeW
LCMapStringA
FindNextFileW
WriteConsoleA
SetStdHandle
GetLocaleInfoA
SetFilePointer
IsValidCodePage
SetEnvironmentVariableA
CompareStringW
CompareStringA
ReadFile
SetEndOfFile
CreateFileA
GetOEMCP
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
GetModuleHandleA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
HeapSize
HeapReAlloc
VirtualAlloc
GetCurrentProcessId
GetTickCount
lstrlenA
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
GetSystemTimeAsFileTime
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
HeapCreate
VirtualFree
QueryPerformanceCounter

user32

MessageBoxW
wsprintfW
PostThreadMessageW
DispatchMessageW
CharNextW
GetMessageW

advapi32

OpenServiceW
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
ControlService
DeleteService
CreateServiceW
ChangeServiceConfig2W
OpenSCManagerW
CloseServiceHandle
OpenThreadToken
RegEnumKeyExW
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
IsValidSid
GetLengthSid
CopySid
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
DuplicateTokenEx
CreateProcessAsUserW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
GetTokenInformation
LookupAccountSidW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ole32

CoInitialize
CoInitializeSecurity
CoUninitialize
StringFromGUID2
CoCreateInstance
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
StringFromCLSID

shell32

CommandLineToArgvW
SHCreateDirectoryExW
ShellExecuteExW

oleaut32

LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
VariantClear

netapi32

NetUserGetInfo
NetApiBufferFree

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
pages/alert32x32.gif
.gif
pages/arcadeCheck.js
.js
pages/blank.html
.html
pages/blank2.html
.html
pages/error.html
.html .js polyglot
pages/error404.css
pages/iwgm.loading.jpg
.jpg
pages/iwin_logo.gif
.gif
pages/login.html
.html
pages/maintenance.html
.html
pages/offline.css
pages/offline.html
.html
pages/offline.jpg
.jpg
pages/offlineBg.gif
.gif
pages/offline_tag.gif
.gif
pages/orange-im-connected-60.gif
.gif
pages/terrie404.gif
.gif
pages/test.html
.html .js polyglot
sounds/animation.wav
sounds/animationBack.wav
sounds/button_click.wav
sounds/coins.wav
sounds/download_completed.wav
sounds/slidebackin.wav
sounds/slideout.wav
sounds/start.wav

Sharing

General

Malware Config

Signatures

Files

e160ef8e55bb9d162da4e266afd9eef3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5eCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46Certificate

Extended Key Usages

Key Usages

c3:9d:f1:d1:d5:d7:bb:d9:44:42:20:53:4f:17:86:f2:96:2f:5a:0dSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 105KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 22KB - Virtual size: 22KB

d46feae5913f2b33d6159af1367e8ee7

Code Sign

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0Certificate

Extended Key Usages

Key Usages

61:0f:78:4d:00:00:00:00:00:03Certificate

Extended Key Usages

Key Usages

61:47:52:ba:00:00:00:00:00:04Certificate

Extended Key Usages

Key Usages

61:49:7c:ed:00:00:00:00:00:05Certificate

Extended Key Usages

Key Usages

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2Certificate

Extended Key Usages

Key Usages

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:acSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

msi

oleaut32

shell32

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 74KB - Virtual size: 73KB

.data Size: 4KB - Virtual size: 11KB

.rsrc Size: 1024B - Virtual size: 1024B

.reloc Size: 4KB - Virtual size: 4KB

2f05f2531b6da725824fc913b1b92aff

Headers

DLL Characteristics

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

c3:9d:f1:d1:d5:d7:bb:d9:44:42:20:53:4f:17:86:f2:96:2f:5a:0d
Signer

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 105KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 22KB - Virtual size: 22KB

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

c1:00:8b:3c:3c:88:11:d1:3e:f6:63:ec:df:40
Certificate

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

61:0f:78:4d:00:00:00:00:00:03
Certificate

61:47:52:ba:00:00:00:00:00:04
Certificate

61:49:7c:ed:00:00:00:00:00:05
Certificate

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

3f:eb:1a:31:ab:86:59:9c:42:ce:aa:0d:c1:4b:fd:e6:6f:ea:4e:ac
Signer

.text
Size: 74KB - Virtual size: 73KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 1024B

.reloc
Size: 4KB - Virtual size: 4KB

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 4KB - Virtual size: 75KB

.rsrc
Size: 363KB - Virtual size: 363KB

.reloc
Size: 7KB - Virtual size: 7KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 835B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 1024B - Virtual size: 586B

.text
Size: 3KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 458B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

24:62:dc:6d:8d:8c:e9:b9:d0:03:56:6b:7a:71:bb:46
Certificate

76:3c:61:4a:b9:dc:f3:58:1a:0d:12:ad:6f:f9:67:a9:2c:3d:4b:06
Signer

.text
Size: 199KB - Virtual size: 199KB

.rdata
Size: 31KB - Virtual size: 31KB