4a39c04ec7ebe07718103071c1ad9471_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

4a39c04ec7ebe07718103071c1ad9471_JaffaCakes118
Size

1.2MB
MD5

4a39c04ec7ebe07718103071c1ad9471
SHA1

a397670d5775fdff16da7a82922415d1f3f00b65
SHA256

a5af34ad3faa146a182cc6890ebe6e66eac20f806a5c40ef2ca0cd5c20f11318
SHA512

c9b3bb6546e080ccc45abdaed88005769417a9bf0316449d097f162602fe978f5615581c780725444bd2974b90a4c1ca5e2a692148e20acb06267541cc146df9
SSDEEP

24576:GbnX2bV8tSyh7TYqpJ0444171z6tNA/DgVwZrfFWAwFqo:GbnX2ZISyh7NL5441hSNA/MVwZrdWAwh

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISGameExplorerPlugin.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

Files

4a39c04ec7ebe07718103071c1ad9471_JaffaCakes118
.exe windows:4 windows x86 arch:x86

d098976d9b4db56d8d4c6bcedd4ffea2

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

93:60:f4:2c:72:11:9b:1c:c6:d7:58:78:4a:ba:4e:c6:ec:48:bb:fc
Signer

Actual PE Digest

93:60:f4:2c:72:11:9b:1c:c6:d7:58:78:4a:ba:4e:c6:ec:48:bb:fc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
DeleteFileA
GetTempPathA
GetCommandLineA
SetErrorMode
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryA
CreateProcessA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
RemoveDirectoryA
SetFileTime
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
MulDiv
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
GetWindowsDirectoryA

user32

ScreenToClient
GetMessagePos
CallWindowProcA
IsWindowVisible
LoadBitmapA
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuA
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
CheckDlgButton
GetClassInfoA
CreateWindowExA
SystemParametersInfoA
RegisterClassA
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
LoadCursorA
SetCursor
GetWindowLongA
GetSysColor
CharNextA
DialogBoxParamA
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegEnumKeyA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegEnumValueA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 366KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISGameExplorerPlugin.dll
.dll windows:4 windows x86 arch:x86

fd81b40b88564689b83537b92e0b5099

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
lstrlenA
lstrcatA
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
WriteFile
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
ReadFile
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers

user32

wsprintfA

shell32

SHGetFolderPathEx

ole32

CoInitialize
CoUninitialize
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddGame
GetTasksFolder
NSIS_Init
NSIS_KeepLibraryLoaded
RemoveGame

Sections

.text
Size: 40KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

f3141363ba38e047f1a32f3ace0bb1fc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect
MultiByteToWideChar
FreeLibrary

user32

wsprintfA

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

91effcc0382d849dd5782319559e1ce5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
lstrlenA
lstrcmpiA
ExitProcess
CloseHandle
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
GetCommandLineA
Sleep
TerminateProcess
GlobalReAlloc
GlobalUnlock
GlobalSize
ReadFile
lstrcpynA
GetTickCount
GetStartupInfoA
CreatePipe
GetVersionExA
GlobalLock
DeleteFileA
lstrcatA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
CreateFileA
CopyFileA
GetTempFileNameA
GetModuleFileNameA
lstrcpyA
PeekNamedPipe
GlobalFree

user32

FindWindowExA
CharPrevA
OemToCharBuffA
SendMessageA
wsprintfA
CharNextA

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 368B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DRM0302.dll
.dll windows:4 windows x86 arch:x86

69801b2b4aaf4fe5a0036b4b055107d6

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

59:61:61:c8:91:38:b2:b5:a3:07:58:68:93:38:db:88:b1:8d:0f:95
Signer

Actual PE Digest

59:61:61:c8:91:38:b2:b5:a3:07:58:68:93:38:db:88:b1:8d:0f:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

crypt32

CertOpenStore
CertFindCertificateInStore
CertGetIssuerCertificateFromStore
CertCompareCertificateName
CertFreeCertificateContext
CryptVerifyMessageSignature
CertCloseStore

wininet

InternetConnectA
HttpOpenRequestA
InternetOpenA
HttpSendRequestA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
HttpAddRequestHeadersA

msvcrt

_adjust_fdiv
strcat
malloc
_initterm
free
memcpy
strtok
strstr
localtime
strcmp
memset
sscanf
mktime
atof
atoi
_stricmp
strncmp
_strnicmp
__CxxFrameHandler
strcpy
??2@YAPAXI@Z
??3@YAXPAX@Z
strncpy
sprintf
strlen
strrchr

kernel32

CreateFileA
DeleteFileA
GetLastError
SetFilePointer
WaitForSingleObject
lstrcmpiA
lstrlenA
GetFileAttributesA
lstrcmpA
lstrcpyA
SetFileAttributesA
WriteFile
GetFileSize
ReadFile
FindFirstFileA
FindNextFileA
FindClose
CloseHandle
GetLogicalDriveStringsA
GetDriveTypeA
GetVolumeInformationA

user32

wsprintfA

advapi32

CryptHashData
CryptReleaseContext
CryptEncrypt
CryptDestroyKey
CryptSetKeyParam
CryptDestroyHash
CryptDeriveKey
CryptAcquireContextA
RegCreateKeyExA
RegSetValueExA
GetUserNameA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
CryptDecrypt
CryptCreateHash

shell32

FindExecutableA

Exports

Exports

DRM3_Function1
DRM3_Function10
DRM3_Function11
DRM3_Function12
DRM3_Function2
DRM3_Function3
DRM3_Function4
DRM3_Function5
DRM3_Function6
DRM3_Function7
DRM3_Function8
DRM3_Function9

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GameConsole-wt.exe
.exe windows:4 windows x86 arch:x86

604a1d0deea0368a663a7243967237ee

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

71:51:ff:97:ae:91:cc:62:14:20:04:dc:5e:14:64:44:3f:0e:75:c2
Signer

Actual PE Digest

71:51:ff:97:ae:91:cc:62:14:20:04:dc:5e:14:64:44:3f:0e:75:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workspace\onlinetech\Build\Release\GameConsole-wt.pdb

Imports

ws2_32

gethostbyname
ntohl
WSACleanup
gethostname
WSAStartup

winmm

PlaySoundW
timeGetTime

comctl32

InitCommonControlsEx

dinput8

DirectInput8Create

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

WaitForSingleObject
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
MulDiv
lstrcmpW
FindResourceW
SetLastError
LockResource
LoadResource
GlobalHandle
SetThreadPriority
lstrcatW
SizeofResource
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
GetCurrentProcessId
GetVersionExA
SetEvent
CompareStringA
CompareStringW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetUserDefaultLCID
GetFileSize
CreateFileW
CreateWaitableTimerW
WriteFile
SetWaitableTimer
WaitForMultipleObjects
CreateThread
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleFileNameA
TerminateThread
ResumeThread
LoadLibraryA
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
ReleaseMutex
ReadFile
SetFilePointer
SetEndOfFile
CreateEventA
FileTimeToSystemTime
CreateMutexA
DebugBreak
GetWindowsDirectoryA
FindFirstFileA
CreateDirectoryA
FormatMessageA
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetCurrentDirectoryA
GetFileAttributesExA
FindNextFileA
DeleteFileA
SetFileAttributesA
LocalFileTimeToFileTime
CopyFileA
MoveFileA
LoadLibraryExA
FlushFileBuffers
TlsGetValue
TlsSetValue
TlsAlloc
ExitProcess
FindResourceA
OpenThread
GetProcessId
TerminateProcess
ResetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenMutexA
OpenEventA
SetFileTime
DosDateTimeToFileTime
GetFullPathNameA
CreateProcessA
VirtualFreeEx
ReadProcessMemory
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GlobalMemoryStatus
GetStartupInfoW
HeapReAlloc
CreateDirectoryW
VirtualQuery
ExitThread
GetDriveTypeA
GetFileType
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
IsBadWritePtr
TlsFree
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileW
FindNextFileW
FindClose
FormatMessageW
LocalFree
GetFullPathNameW
GetCommandLineA
SetHandleCount
GetStartupInfoA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetPrivateProfileStringA
GetFileAttributesA
WritePrivateProfileStringA
GetFileAttributesW
LoadLibraryExW
FreeLibrary
GetCurrentThreadId
GetProcessHeap
HeapAlloc
FlushInstructionCache
CopyFileW
lstrlenA
MultiByteToWideChar
DeleteFileW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
Sleep
GetPrivateProfileStringW
CreateMutexW
IsDebuggerPresent
lstrlenW
SetUnhandledExceptionFilter
GetModuleHandleW
GetOEMCP
SetStdHandle
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadCodePtr
SetEnvironmentVariableA
LoadLibraryW
GetTickCount
GetCurrentThread
GetThreadContext
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileA
GetLastError
WideCharToMultiByte
GetCommandLineW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
CreateProcessW
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualProtectEx
GetVolumeInformationA
DeviceIoControl
IsBadReadPtr
DuplicateHandle
RtlUnwind

user32

SendInput
OpenDesktopW
CloseDesktop
IsRectEmpty
SetLayeredWindowAttributes
SetActiveWindow
KillTimer
SetTimer
EnumDisplayDevicesW
GetCursor
SetCursor
SetCursorPos
CharLowerBuffW
MapDialogRect
SetWindowContextHelpId
CreateDialogIndirectParamW
CheckRadioButton
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageW
GetTopWindow
SetDlgItemTextW
ValidateRect
DrawTextExW
EqualRect
IntersectRect
OffsetRect
SetWindowsHookExW
GetWindowThreadProcessId
WaitForInputIdle
UnhookWindowsHookEx
FlashWindowEx
LoadStringW
ChangeDisplaySettingsW
GetDlgItemTextW
EnableWindow
IsWindowEnabled
IsWindowVisible
GetCursorPos
LoadIconW
MonitorFromPoint
SystemParametersInfoW
CreateAcceleratorTableW
GetParent
GetClassNameW
RedrawWindow
GetDlgItem
SetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
GetDesktopWindow
InvalidateRgn
FillRect
SetCapture
ReleaseCapture
GetSysColor
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
DefWindowProcW
UnregisterDeviceNotification
RegisterDeviceNotificationW
SendMessageTimeoutW
GetActiveWindow
GetFocus
GetMonitorInfoW
SetRect
CopyRect
SetWindowRgn
InvalidateRect
GetUpdateRect
SetWindowPlacement
GetWindowPlacement
LockSetForegroundWindow
EnumChildWindows
SetRectEmpty
MoveWindow
ScreenToClient
GetAsyncKeyState
UpdateWindow
GetMenu
AdjustWindowRectEx
PtInRect
PostMessageA
wsprintfA
GetSystemMetrics
IsZoomed
SetWindowTextW
PostMessageW
GetWindowLongW
MonitorFromWindow
GetWindowRect
SetWindowPos
TrackMouseEvent
MessageBoxW
CreateWindowExW
RegisterClassExW
DestroyWindow
LoadCursorW
wsprintfW
GetClassInfoExW
IsWindow
ShowWindow
SetWindowLongW
GetDC
ReleaseDC
FindWindowW
IsIconic
ShowWindowAsync
SetForegroundWindow
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowExA
GetForegroundWindow
EnumWindows
GetClassNameA
GetLastInputInfo
MessageBoxA
GetQueueStatus
PostQuitMessage
UnregisterClassW
CharUpperW
CharNextW
FindWindowA
IsChild
EnumDisplaySettingsW
GetClientRect

gdi32

SetTextColor
StretchBlt
SetBkMode
CreateSolidBrush
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
SetDIBColorTable
CreateDIBSection
DeleteObject
CreateFontW
CreateRoundRectRgn
EnumFontFamiliesExW

advapi32

FreeSid
RegCloseKey
RegOpenKeyExW
CheckTokenMembership
AllocateAndInitializeSid
CryptReleaseContext
RegQueryValueExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegSetValueExW
CryptDestroyHash
CryptDestroyKey
CryptSetKeyParam
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDecrypt
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
IsTextUnicode
GetUserNameA
RegSetKeySecurity
RegDeleteKeyA
RegDeleteValueA
RevertToSelf
ImpersonateSelf

shell32

SHFileOperationA
ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteExW
CommandLineToArgvW
ord190
SHBrowseForFolderW
SHGetPathFromIDListW
ord155
SHGetFolderPathW
ShellExecuteW

ole32

OleLockRunning
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemFree
OleUninitialize
StringFromGUID2
CoInitializeSecurity
CoGetClassObject
CoUninitialize
CoInitialize
OleInitialize
CoInitializeEx
StringFromCLSID
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoSetProxyBlanket
CoFreeUnusedLibraries

oleaut32

LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
SysStringByteLen
OleCreateFontIndirect
VariantClear
VariantInit
DispCallFunc
VarBstrCmp
SafeArrayGetVartype
SafeArrayCopy
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
VariantCopyInd
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim
SysFreeString

shlwapi

PathAppendA
PathStripPathA
PathFileExistsA
PathIsRelativeW
PathIsURLW
PathIsDirectoryW
PathAddBackslashW
PathRemoveFileSpecW
PathMatchSpecW
UrlCompareW
UrlCanonicalizeW
PathAppendW
PathCombineW
PathFileExistsW
PathFindFileNameW
PathUnquoteSpacesW

urlmon

URLDownloadToCacheFileA

d3d9

Direct3DCreate9

crypt32

CertFreeCertificateContext
CryptQueryObject
CryptMsgGetAndVerifySigner
CertNameToStrA
CryptMsgClose

wintrust

WinVerifyTrust

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetQueryOptionA
InternetGetLastResponseInfoA
HttpAddRequestHeadersA
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetCloseHandle
InternetGetConnectedStateExW
InternetAutodial

rpcrt4

UuidCreate

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pecode
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pccode
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gchr
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GameConsole.exe
.exe windows:4 windows x86 arch:x86

604a1d0deea0368a663a7243967237ee

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

71:51:ff:97:ae:91:cc:62:14:20:04:dc:5e:14:64:44:3f:0e:75:c2
Signer

Actual PE Digest

71:51:ff:97:ae:91:cc:62:14:20:04:dc:5e:14:64:44:3f:0e:75:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workspace\onlinetech\Build\Release\GameConsole-wt.pdb

Imports

ws2_32

gethostbyname
ntohl
WSACleanup
gethostname
WSAStartup

winmm

PlaySoundW
timeGetTime

comctl32

InitCommonControlsEx

dinput8

DirectInput8Create

version

VerQueryValueW
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

kernel32

WaitForSingleObject
FindCloseChangeNotification
FindNextChangeNotification
FindFirstChangeNotificationW
HeapFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpyW
MulDiv
lstrcmpW
FindResourceW
SetLastError
LockResource
LoadResource
GlobalHandle
SetThreadPriority
lstrcatW
SizeofResource
OpenProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetExitCodeProcess
GetCurrentProcessId
GetVersionExA
SetEvent
CompareStringA
CompareStringW
GetDateFormatW
GetNumberFormatW
GetLocaleInfoW
GetSystemDefaultLangID
GetUserDefaultUILanguage
GetUserGeoID
GetUserDefaultLCID
GetFileSize
CreateFileW
CreateWaitableTimerW
WriteFile
SetWaitableTimer
WaitForMultipleObjects
CreateThread
SetCurrentDirectoryW
GetCurrentDirectoryW
GetModuleFileNameA
TerminateThread
ResumeThread
LoadLibraryA
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
ReleaseMutex
ReadFile
SetFilePointer
SetEndOfFile
CreateEventA
FileTimeToSystemTime
CreateMutexA
DebugBreak
GetWindowsDirectoryA
FindFirstFileA
CreateDirectoryA
FormatMessageA
CreateEventW
QueryPerformanceFrequency
QueryPerformanceCounter
SetThreadAffinityMask
GetCurrentDirectoryA
GetFileAttributesExA
FindNextFileA
DeleteFileA
SetFileAttributesA
LocalFileTimeToFileTime
CopyFileA
MoveFileA
LoadLibraryExA
FlushFileBuffers
TlsGetValue
TlsSetValue
TlsAlloc
ExitProcess
FindResourceA
OpenThread
GetProcessId
TerminateProcess
ResetEvent
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
OpenMutexA
OpenEventA
SetFileTime
DosDateTimeToFileTime
GetFullPathNameA
CreateProcessA
VirtualFreeEx
ReadProcessMemory
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
GetDiskFreeSpaceExW
GetDriveTypeW
GetLogicalDriveStringsW
GlobalMemoryStatus
GetStartupInfoW
HeapReAlloc
CreateDirectoryW
VirtualQuery
ExitThread
GetDriveTypeA
GetFileType
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
IsBadWritePtr
TlsFree
HeapSize
GetStdHandle
UnhandledExceptionFilter
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileW
FindNextFileW
FindClose
FormatMessageW
LocalFree
GetFullPathNameW
GetCommandLineA
SetHandleCount
GetStartupInfoA
GetTimeZoneInformation
GetSystemTimeAsFileTime
GetPrivateProfileStringA
GetFileAttributesA
WritePrivateProfileStringA
GetFileAttributesW
LoadLibraryExW
FreeLibrary
GetCurrentThreadId
GetProcessHeap
HeapAlloc
FlushInstructionCache
CopyFileW
lstrlenA
MultiByteToWideChar
DeleteFileW
ExpandEnvironmentStringsW
LeaveCriticalSection
EnterCriticalSection
Sleep
GetPrivateProfileStringW
CreateMutexW
IsDebuggerPresent
lstrlenW
SetUnhandledExceptionFilter
GetModuleHandleW
GetOEMCP
SetStdHandle
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
IsBadCodePtr
SetEnvironmentVariableA
LoadLibraryW
GetTickCount
GetCurrentThread
GetThreadContext
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
GetModuleHandleA
GetProcAddress
GetCurrentProcess
CreateFileA
GetLastError
WideCharToMultiByte
GetCommandLineW
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
CreateProcessW
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualProtectEx
GetVolumeInformationA
DeviceIoControl
IsBadReadPtr
DuplicateHandle
RtlUnwind

user32

SendInput
OpenDesktopW
CloseDesktop
IsRectEmpty
SetLayeredWindowAttributes
SetActiveWindow
KillTimer
SetTimer
EnumDisplayDevicesW
GetCursor
SetCursor
SetCursorPos
CharLowerBuffW
MapDialogRect
SetWindowContextHelpId
CreateDialogIndirectParamW
CheckRadioButton
CheckDlgButton
IsDlgButtonChecked
SendDlgItemMessageW
GetTopWindow
SetDlgItemTextW
ValidateRect
DrawTextExW
EqualRect
IntersectRect
OffsetRect
SetWindowsHookExW
GetWindowThreadProcessId
WaitForInputIdle
UnhookWindowsHookEx
FlashWindowEx
LoadStringW
ChangeDisplaySettingsW
GetDlgItemTextW
EnableWindow
IsWindowEnabled
IsWindowVisible
GetCursorPos
LoadIconW
MonitorFromPoint
SystemParametersInfoW
CreateAcceleratorTableW
GetParent
GetClassNameW
RedrawWindow
GetDlgItem
SetFocus
GetWindow
DestroyAcceleratorTable
BeginPaint
EndPaint
CallWindowProcW
GetDesktopWindow
InvalidateRgn
FillRect
SetCapture
ReleaseCapture
GetSysColor
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
DefWindowProcW
UnregisterDeviceNotification
RegisterDeviceNotificationW
SendMessageTimeoutW
GetActiveWindow
GetFocus
GetMonitorInfoW
SetRect
CopyRect
SetWindowRgn
InvalidateRect
GetUpdateRect
SetWindowPlacement
GetWindowPlacement
LockSetForegroundWindow
EnumChildWindows
SetRectEmpty
MoveWindow
ScreenToClient
GetAsyncKeyState
UpdateWindow
GetMenu
AdjustWindowRectEx
PtInRect
PostMessageA
wsprintfA
GetSystemMetrics
IsZoomed
SetWindowTextW
PostMessageW
GetWindowLongW
MonitorFromWindow
GetWindowRect
SetWindowPos
TrackMouseEvent
MessageBoxW
CreateWindowExW
RegisterClassExW
DestroyWindow
LoadCursorW
wsprintfW
GetClassInfoExW
IsWindow
ShowWindow
SetWindowLongW
GetDC
ReleaseDC
FindWindowW
IsIconic
ShowWindowAsync
SetForegroundWindow
SendMessageW
GetMessageW
TranslateMessage
DispatchMessageW
FindWindowExA
GetForegroundWindow
EnumWindows
GetClassNameA
GetLastInputInfo
MessageBoxA
GetQueueStatus
PostQuitMessage
UnregisterClassW
CharUpperW
CharNextW
FindWindowA
IsChild
EnumDisplaySettingsW
GetClientRect

gdi32

SetTextColor
StretchBlt
SetBkMode
CreateSolidBrush
GetStockObject
GetObjectW
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
SetDIBColorTable
CreateDIBSection
DeleteObject
CreateFontW
CreateRoundRectRgn
EnumFontFamiliesExW

advapi32

FreeSid
RegCloseKey
RegOpenKeyExW
CheckTokenMembership
AllocateAndInitializeSid
CryptReleaseContext
RegQueryValueExW
RegEnumKeyExW
RegNotifyChangeKeyValue
RegSetValueExW
CryptDestroyHash
CryptDestroyKey
CryptSetKeyParam
CryptDeriveKey
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptDecrypt
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegQueryInfoKeyA
RegCreateKeyExA
RegSetValueExA
IsTextUnicode
GetUserNameA
RegSetKeySecurity
RegDeleteKeyA
RegDeleteValueA
RevertToSelf
ImpersonateSelf

shell32

SHFileOperationA
ShellExecuteExA
SHGetSpecialFolderPathA
ShellExecuteExW
CommandLineToArgvW
ord190
SHBrowseForFolderW
SHGetPathFromIDListW
ord155
SHGetFolderPathW
ShellExecuteW

ole32

OleLockRunning
CoTaskMemAlloc
CreateStreamOnHGlobal
CoTaskMemFree
OleUninitialize
StringFromGUID2
CoInitializeSecurity
CoGetClassObject
CoUninitialize
CoInitialize
OleInitialize
CoInitializeEx
StringFromCLSID
CoCreateGuid
CLSIDFromString
CLSIDFromProgID
CoCreateInstance
CoSetProxyBlanket
CoFreeUnusedLibraries

oleaut32

LoadRegTypeLi
LoadTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
SysStringByteLen
OleCreateFontIndirect
VariantClear
VariantInit
DispCallFunc
VarBstrCmp
SafeArrayGetVartype
SafeArrayCopy
VariantChangeType
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayLock
VariantCopyInd
SafeArrayCreate
SafeArrayDestroy
SafeArrayRedim
SysFreeString

shlwapi

PathAppendA
PathStripPathA
PathFileExistsA
PathIsRelativeW
PathIsURLW
PathIsDirectoryW
PathAddBackslashW
PathRemoveFileSpecW
PathMatchSpecW
UrlCompareW
UrlCanonicalizeW
PathAppendW
PathCombineW
PathFileExistsW
PathFindFileNameW
PathUnquoteSpacesW

urlmon

URLDownloadToCacheFileA

d3d9

Direct3DCreate9

crypt32

CertFreeCertificateContext
CryptQueryObject
CryptMsgGetAndVerifySigner
CertNameToStrA
CryptMsgClose

wintrust

WinVerifyTrust

wininet

InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpQueryInfoA
HttpSendRequestA
InternetQueryOptionA
InternetGetLastResponseInfoA
HttpAddRequestHeadersA
InternetOpenW
InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetReadFile
InternetCloseHandle
InternetGetConnectedStateExW
InternetAutodial

rpcrt4

UuidCreate

iphlpapi

GetAdaptersInfo

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pecode
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pccode
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 212KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gchr
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 100KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
GameConsoleService.exe
.exe windows:4 windows x86 arch:x86

eb6f498d06847f3979451ef721670a61

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

5c:7d:1f:65:18:45:77:7e:70:cd:f2:f3:48:74:1a:f4:5d:c7:74:2d
Signer

Actual PE Digest

5c:7d:1f:65:18:45:77:7e:70:cd:f2:f3:48:74:1a:f4:5d:c7:74:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\workspace\onlinetech\Build\Release\GameConsoleService.pdb

Imports

kernel32

WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
Process32NextW
OpenProcess
SetErrorMode
GetCommandLineW
Sleep
lstrcatW
LocalFree
LoadLibraryA
lstrlenA
GetCurrentProcessId
GetCurrentDirectoryW
DuplicateHandle
GetFullPathNameW
SetEndOfFile
GetLocaleInfoW
CreateFileW
FlushFileBuffers
SetStdHandle
GetOEMCP
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateProcessW
GetSystemTimeAsFileTime
QueryPerformanceCounter
TerminateProcess
SetLastError
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
RaiseException
GetModuleHandleW
lstrcpyW
LoadLibraryExW
MultiByteToWideChar
lstrcpynW
lstrcmpiW
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetModuleFileNameA
VirtualFreeEx
FreeLibrary
ResumeThread
CreateRemoteThread
CreateEventA
GetTickCount
GetProcAddress
FlushInstructionCache
WriteProcessMemory
VirtualProtectEx
VirtualAllocEx
LoadLibraryW
GetCurrentProcess
lstrlenW
WideCharToMultiByte
OutputDebugStringW
InterlockedExchange
CreateThread
SetEvent
LeaveCriticalSection
EnterCriticalSection
CreateEventW
DeleteCriticalSection
InitializeCriticalSection
GetVersionExW
GetExitCodeProcess
WaitForSingleObject
SetFilePointer
ReadFile
SetUnhandledExceptionFilter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
IsBadWritePtr
VirtualFree
HeapCreate
GetStringTypeW
GetStringTypeA
GetCPInfo
LCMapStringW
LCMapStringA
ExitProcess
RtlUnwind
GetCommandLineA
GetStartupInfoA
GetModuleHandleA
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
CloseHandle
GetLastError
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA

user32

CharNextW
MessageBoxW
GetProcessWindowStation
GetThreadDesktop
DispatchMessageW
EnumWindowStationsW
OpenWindowStationW
SetProcessWindowStation
EnumDesktopsW
CloseWindowStation
OpenDesktopW
SetThreadDesktop
EnumDesktopWindows
GetWindowThreadProcessId
CharUpperW
wsprintfW
LoadStringW
PostThreadMessageW
GetMessageW
TranslateMessage

advapi32

ReportEventW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
LookupPrivilegeValueW
ConvertSidToStringSidW
DeleteService
ControlService
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
DeregisterEventSource
RegisterEventSourceW
CloseServiceHandle
ChangeServiceConfig2W
OpenServiceW
CreateServiceW
OpenSCManagerW
CreateProcessAsUserW
GetTokenInformation
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
AdjustTokenPrivileges
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorControl
LookupAccountSidW
CopySid
InitializeSid
GetSidLengthRequired
GetSidSubAuthority
IsValidSid
GetLengthSid
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey

shell32

SHGetFolderPathW

ole32

CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeSecurity
CoResumeClassObjects
StringFromCLSID
StringFromGUID2
CoSuspendClassObjects
CoCreateInstance
CoTaskMemFree
CoUninitialize
CoRevokeClassObject
CoInitializeEx
CoRegisterClassObject

oleaut32

LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
LoadTypeLi
SysAllocStringLen
VariantInit
VariantClear
RegisterTypeLi
UnRegisterTypeLi
SysAllocString

shlwapi

PathUnquoteSpacesW
PathFindExtensionW
PathAppendW
PathFileExistsW
PathFileExistsA

crypt32

CertNameToStrA
CryptMsgGetAndVerifySigner
CryptQueryObject
CertFreeCertificateContext
CryptMsgClose

wintrust

WinVerifyTrust

wtsapi32

WTSQueryUserToken

userenv

LoadUserProfileW
CreateEnvironmentBlock
UnloadUserProfile
DestroyEnvironmentBlock

psapi

GetModuleFileNameExW

Sections

.text
Size: 164KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
LocaleMapping.ini
Uninstall.exe.nsis
ValidOrgs.xml
.xml
WTHk.dll
.dll windows:4 windows x86 arch:x86

c68e2e6a7ec0158e36e58207fd0e2908

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

ae:e8:40:91:2f:ed:27:63:39:d0:aa:ee:f0:bd:65:fb:0e:8f:3a:f6
Signer

Actual PE Digest

ae:e8:40:91:2f:ed:27:63:39:d0:aa:ee:f0:bd:65:fb:0e:8f:3a:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\workspace\onlinetech\Build\Release\WTHk.pdb

Imports

shell32

CommandLineToArgvW

kernel32

GetModuleHandleA
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
CreateToolhelp32Snapshot
Module32First
Module32Next
CloseHandle
EnterCriticalSection
LeaveCriticalSection
VirtualQuery
VirtualProtect
lstrlenW
GlobalFree
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
lstrlenA
MultiByteToWideChar
GetLastError
RaiseException
GetSystemInfo
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
HeapFree
HeapAlloc
GetCurrentThreadId
GetCommandLineA
ExitProcess
HeapReAlloc
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapSize
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
UnhandledExceptionFilter
WriteFile
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
SetUnhandledExceptionFilter
GetOEMCP
GetCPInfo
LoadLibraryA
IsBadReadPtr
IsBadCodePtr

ole32

CoCreateInstance

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString
SysAllocString

Exports

Exports

_ExitApp@0
_InitApp@0

Sections

.text
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
de/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

3d:e4:ef:16:05:39:22:06:49:00:e0:b5:48:88:2b:05:77:d6:3a:da
Signer

Actual PE Digest

3d:e4:ef:16:05:39:22:06:49:00:e0:b5:48:88:2b:05:77:d6:3a:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
en-us/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

c9:8e:c0:b0:1e:d1:ae:18:7b:03:81:e7:78:f4:f6:38:d2:6a:63:16
Signer

Actual PE Digest

c9:8e:c0:b0:1e:d1:ae:18:7b:03:81:e7:78:f4:f6:38:d2:6a:63:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 376KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
en/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

5b:6e:cf:d5:16:7f:b5:7b:c0:f4:01:82:05:0c:7d:40:21:c7:74:e9
Signer

Actual PE Digest

5b:6e:cf:d5:16:7f:b5:7b:c0:f4:01:82:05:0c:7d:40:21:c7:74:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 372KB - Virtual size: 370KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
es-es/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

b0:db:ec:f2:68:aa:b6:29:ef:69:28:da:39:47:94:4c:f4:96:89:f6
Signer

Actual PE Digest

b0:db:ec:f2:68:aa:b6:29:ef:69:28:da:39:47:94:4c:f4:96:89:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 376KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
es/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

6d:e3:aa:eb:21:8a:a7:9f:df:f3:26:65:e9:ae:a7:21:4b:0d:32:58
Signer

Actual PE Digest

6d:e3:aa:eb:21:8a:a7:9f:df:f3:26:65:e9:ae:a7:21:4b:0d:32:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 376KB - Virtual size: 372KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
fr/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

61:46:3a:5c:3d:4f:82:10:e2:86:fa:be:fd:45:61:68:2d:33:60:e9
Signer

Actual PE Digest

61:46:3a:5c:3d:4f:82:10:e2:86:fa:be:fd:45:61:68:2d:33:60:e9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
it/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

eb:cd:09:db:b1:fd:35:80:cc:40:49:50:ff:56:99:cc:05:24:34:e8
Signer

Actual PE Digest

eb:cd:09:db:b1:fd:35:80:cc:40:49:50:ff:56:99:cc:05:24:34:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ko-kr/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

d7:e7:6f:36:93:10:94:87:11:1f:53:4e:16:41:b0:bd:0c:00:a3:16
Signer

Actual PE Digest

d7:e7:6f:36:93:10:94:87:11:1f:53:4e:16:41:b0:bd:0c:00:a3:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 372KB - Virtual size: 368KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zh-cn/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

55:60:3f:09:ca:47:b6:7f:df:1d:a8:c1:fb:76:2c:68:d8:07:5f:73
Signer

Actual PE Digest

55:60:3f:09:ca:47:b6:7f:df:1d:a8:c1:fb:76:2c:68:d8:07:5f:73

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
zh/GameConsole-wt.dll
.dll windows:4 windows x86 arch:x86

Code Sign

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

11/03/2009, 16:36

Not After

13/03/2011, 00:21

Subject

CN=WildTangent Inc,OU=Product Development,O=WildTangent Inc,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

fb:fa:7f:cb:e4:c3:f6:e5:54:7b:a0:f2:f1:51:31:0f:98:b4:f8:7b
Signer

Actual PE Digest

fb:fa:7f:cb:e4:c3:f6:e5:54:7b:a0:f2:f1:51:31:0f:98:b4:f8:7b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rsrc
Size: 368KB - Virtual size: 366KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d098976d9b4db56d8d4c6bcedd4ffea2

Code Sign

0aCertificate

Extended Key Usages

Key Usages

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77Certificate

Extended Key Usages

93:60:f4:2c:72:11:9b:1c:c6:d7:58:78:4a:ba:4e:c6:ec:48:bb:fcSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 107KB

.ndata Size: - Virtual size: 56KB

.rsrc Size: 366KB - Virtual size: 366KB

fd81b40b88564689b83537b92e0b5099

Headers

File Characteristics

Imports

kernel32

user32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 40KB - Virtual size: 37KB

.rdata Size: 12KB - Virtual size: 8KB

.data Size: 8KB - Virtual size: 11KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 3KB

f3141363ba38e047f1a32f3ace0bb1fc

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 816B

.data Size: - Virtual size: 56B

.reloc Size: 512B - Virtual size: 496B

91effcc0382d849dd5782319559e1ce5

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

Exports

Exports

Sections

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

93:60:f4:2c:72:11:9b:1c:c6:d7:58:78:4a:ba:4e:c6:ec:48:bb:fc
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 107KB

.ndata
Size: - Virtual size: 56KB

.rsrc
Size: 366KB - Virtual size: 366KB

.text
Size: 40KB - Virtual size: 37KB

.rdata
Size: 12KB - Virtual size: 8KB

.data
Size: 8KB - Virtual size: 11KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 816B

.data
Size: - Virtual size: 56B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 368B

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

59:61:61:c8:91:38:b2:b5:a3:07:58:68:93:38:db:88:b1:8d:0f:95
Signer

.text
Size: 13KB - Virtual size: 12KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 296B

.rsrc
Size: 1024B - Virtual size: 816B

.reloc
Size: 1KB - Virtual size: 1KB

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5c:d1:6d:5c:35:5c:ee:c9:23:c6:d1:04:fe:9a:dd:77
Certificate

71:51:ff:97:ae:91:cc:62:14:20:04:dc:5e:14:64:44:3f:0e:75:c2
Signer