WATCH.DOGS.DLCUNLOCKER.RELOADED.ZIP
- SHA256 90d3bcb48e548c76d7c98a35f3e38ce06b0bf597c75f8ba1d499488cb06b703c
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
WATCH.DOGS.DLCUNLOCKER.RELOADED.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
WATCH.DOGS.DLCUNLOCKER.RELOADED.zip
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target WATCH.DOGS.DLCUNLOCKER.RELOADED.ZIP
- Size 41.5MB
- Sample260804-g7rddsshrc
- SHA256 90d3bcb48e548c76d7c98a35f3e38ce06b0bf597c75f8ba1d499488cb06b703c
- MD5 5b052cf0a5da4d71c7985bda52695d13
- SHA1 e6a71afc47245c30d896716bd48a1a5dcde05e46
- SHA512 1126ca07873d062b184d7a33a9e9aad99e1a63376604b1ef5c7dae5235cba84a5d9accaac66b46c4c07ead540fcad54fa43102ee920852260de53ba047636a0c
- SSDEEP 786432:OBEb7KGqk5MK1a3qVHdl+8jbpzEX3qeIYqYFPICSRbp2af6VTFm3wFMNrqc:r7KGqNuaaV37pzN+h+bpXf0TF6bB
- TLSH T15597339EF4C78279C65F0B6695F4ED3E8E6DA68CD2EF0B94E5059014A3F298C13E401D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/uext64.dll unpack001/bin/uplay_r164.dll unpack001/bin/uplay_r1_loader64.dll - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/bin/Disrupt_b64.dll unpack001/bin/lol.dll unpack001/bin/watch_dogs.exe
File Explorer
-
WATCH.DOGS.DLCUNLOCKER.RELOADED.ZIP.zip 41.5MB
-
bin/Disrupt_b64.dll.dll 41.9MB
-
bin/lol.dll.dll 515KB
-
bin/orbit_api.ini908B
-
bin/uext64.dll.dll 218KB
-
bin/uplay_r164.dll.dll 806KB
-
bin/uplay_r1_loader64.dll.dll 72KB
-
bin/watch_dogs.exe.exe 134KB
-
reloaded.nfo7KB
bin/Disrupt_b64.dll
- IMPHASH 3f2c481fc7426ecaeaddd7d7bbe11e0a
- SHA256 e2f8d33aa7014c9fdd4d0ece92439bf5c144c22d42e798a9f558dce71753800c
- MD5 8f38bdb353db613d90a5e36f8f1e140c
- SHA1 a64b33334675c3150f7c449e7b4916315d2745ff
- SHA512 09bb348e01e3933f1d2c68d064f114696cd70c8ff9a9890cab4ada5309a5c33e62c517c95eb7bcaa30e89267bbc53203d54561736f62df6ba9fa2e63529c9d05
- SSDEEP 786432:ajXzNvR74So42eRZK2Vw0wtxbZTiHBqQNdv//JYV9rOCwVJykcp09q12NAp:yRJ74E2eRkpdxbZGHBjN/uV9twryk20o
- TLSH T190A73319C392CB7EC544E678D93885190C623CB6A13AEFFDE56B149DEB433522BE404E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
ff:a8:24:ec:74:12:81:57:e1:5f:cb:be:2a:8c:bc:fa
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Chains
Jan 1, 0001
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Serial Number
2c:b0:08:60:91:4e:c0:97:13:62:b8:fd:4c:74:fe:0d
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jul 16, 2013 - Jul 16, 2014
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
2
Major OS version
5
Entry point
109863572
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
F:\projects\pc-package\bin\Disrupt_b64.pdb
ws2_32
getsockopt
uplay_r1_loader64
UPLAY_Startup
kernel32
GetVersionExA
GetVersion
GetCurrentProcessId
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
MessageBoxA
gdi32
DeleteObject
advapi32
RegCreateKeyExA
ole32
CreateStreamOnHGlobal
oleaut32
VariantClear
gfsdk_ssao.win64
?GFSDK_SSAO_SetInputData@@YA?AW4GFSDK_SSAO_Status@@PEAUGFSDK_SSAO_Renderer@@PEBUGFSDK_SSAO_InputDepthData@@PEBUGFSDK_SSAO_InputNormalData@@@Z
gfsdk_txaa.win64
TxaaResolveDX
msvcp100
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
shlwapi
PathCanonicalizeW
gdiplus
GdiplusStartup
crypt32
CryptMsgClose
wintrust
WinVerifyTrust
msvcr100
_itoa
comctl32
ord411
dinput8
DirectInput8Create
dbghelp
ImageNtHeader
psapi
EnumProcessModules
xinput1_3
ord2
d3d11
D3D11CreateDevice
dxgi
CreateDXGIFactory1
d3dcompiler_43
D3DPreprocess
winmm
timeGetTime
bink2w64
BinkControlBackgroundIO
shell32
ShellExecuteW
iphlpapi
GetIpAddrTable
??0_Mutex@std@@QEAA@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QEAAAEAV01@AEBV01@@Z
?RunGame@@YA_NPEAUHINSTANCE__@@PEBDI@Z
CloseDuniaEngine
EntryPoint
GetCRCFromString
GetExePath
GetInstructionPointer
InitDuniaEngine
PrintToConsole
RunDuniaEngine
ShutdownDuniaEngine
SwitchContext
TickDuniaEngine
����:��T����$�8��Z��E:�ʄT�2��B���d/iy�:uz�k<��!s/��dH��όǽ6jqۑ�'W��G"v9�Δ���C��>�3�3�9���Q9�����
���H����&��/�S y���|����v�h[�L�B�_?� Tk'+h 6��_`jk���z�҄ �e� �r[��E��N�V�p�}Q�����8 ��l]�0'�UEYE��ö֤����L`%I$K�c_���s��c���G ���Xh�۱���5M�U��P��᪑ �#�!�N���g�;�Kg�!C��2v����x������ ��Vi3��K��2_2/V�A�����D��X'+N;ρv��H��g��JVҨ� �B�
�J1��Y�0�0�xQ['c�F���S��F���d��R��$!�+ ǃ�:��
e���r;�R�khODwt|9�M ����˭���t� ��h��_D��Dzg��f�0�Z��=����t���J��B�eA��D���%A ܽ�"�aGٝo�M�S,Q ���u���${qm��=Nw{����2R5�T��3
�Wƫ_ v@��#�
O�:5E�($'+��
��e�x \h��F��� ��W(@e�?o��>m�˚��昰 D��%��S����S��=ԭ@L��>�����H�vCHw@�I?�D���=K���7H��l��(D�����^�~�
�" ���=gM��-�"���Y��
�
�ޅ��ֈ�������l�ڒU�j�9����%�|A:���DO���H�\��@��Tu{N����p5��rE�����E��f���A�1���F�k�7w��P�ǚ2��~Y��(C�0�ʵg��.8).ɡ(�Ps g��d��A+G��1� fI��du�I{�����&]�qd��+�����y6J_�$gn\i j����#Q��4m8Q3 �Q��X
3V���N:}�)��:�Y.i�(�F �����./k���P 5B����/K� �1�_=lt��h#�k'E��� k��rujU�1��j�2]�,�Rj:� l>����R ��ݤZ��C\^x��=(��I��x�I� ��� j����]K�Q���$��>h(ij�K����[Hu� X�$�g]Ͻ�.K��'v{u���I���k���֒�A(��P�⹐0
����⽇:ɐ��;�7w��gT�l�٫�f\K��x0q͔Ɛ>��L�a�/./W�;�%#B�'�^NG���:\���ڡ��(*:��͙��!f�$�|���`5gk�/w
#V�tw �
��. ���U��>��T��QpO��t��&%������C%2�k
��Yk�ήs��fl[!\�IolJ��/����_�ˌ���D�O ����Eşȗ꽖�H��z
���#�7�k����090�@Wل�d��V���3���TwLߔ.�$�����l.��7���6٫��$��B3�kڲ�h��m� � I}�f �J����'Us�*�]��""����*��3|�K��z��� F��!��T<4�������V^r��j��Kd �a(��$���$��ݢ3 � ��K{���[�!�*�婑r�l��ӧ%��^Q����c]��k��Iz}�X��̀co_J������!M���D� �����2&� *���(�' C�S�1��'��(�����䁞� ��{r�Q�,�
�WN� �c��M�mm.^�:�� R�g�@+�b��gP�vr\����S���-��cL� �2tjU�1���E�����k�$U|���O���\P��:��ະ��D�0!�k����\��5sA#�4��,B�>�������e<4V��៓�R?����TU��5����错4�вF\ �6m�p�e�Յܼ�Ѩ$��$ �t�/Ej���d)���� e`}�I����j���R)+*g���&�h�g��e}�W�Ͽ�qFCw����4,j�!�> ��!f�I�=�����������B(e��Ɨ��!솱4��]n���4���{c�j!;$���� ���������)5��|9����s���(��Tdk��{��Iv���F^,�t&j��!�R�c^�β���5�QR{��-tR���Ky�P� �����P H���`j ����4;Kw ۏHz��k��N���~f��
1v\<�fS��#(��~� ��)�T�E��}'=���&���e�oОx=��8��#�<Қ�|�������@m%4<��R��O� �kq~&.�E��� ���ƣ:H�lrz��F��I����:�2
'�<������� �.�8� W�a$N5E���W4�a_p��VD�
���7�� ����QFSs�[R�,��9]��<7�)����]d䳎1�Hbvdr��V$�L�n����(z( \���m�G�w!�H�� ���> �������HL��;�&�\7��ݰ�0f�t�T�z�fnaH��@?b��n�Ae��yi��f8� .i��d]�n�F@�h��O�Z�"J�t)]��} ��p��>w��H���Z���O�.A��s����!�}H��e����o@�p��Ziп:�T��� M$�h �'�orHʸ���> �-�.]�|U�cH��eg/3���� VD�O�G�f���QŦ���*- �6rU��<Y) cA�'l�,1q��K�N; JW��"�<#�����1�|����XW �ݿ��H��3�S�E�
��EЏ��6��l�e63Ԙ_�%��VMK���u��1���,b��\�yW'��-����8������ ����U�%I?'�$������J:m��}�mx�i�
�lM��ۮ �!%~��z5}��㢹�A�S�f��
�|\�_11H-N�_u^���+���P굅��"�f��5�,`�������4T2H�,�����Q?�ga��(��ő&ƽ�w�̋{Cb���Ӟ���x"����%�.e�� wx�XnS# +��րT �܂�i��B7�(� b d�0��Q�%$����$jȕ�3�����7�{ۅ�'YZ������֔PB>$;�42 �-u�\�A��But 7g8I���šVr��)fpS��[=!��'
Name
.text
Size
Virtual Size
42.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
8.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
7.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
3.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
393B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.UBX0
Size
Virtual Size
19.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.UBX1
Size
41.9MB
Virtual Size
41.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
512B
Virtual Size
20B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
369KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=9, id=152, version=20115,
count=16, id=171, productName=VS2010 build 30319, version=30319,
count=3, id=135, version=30729,
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=508, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=10, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=28, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=173, version=30319,
count=6, id=156, version=21202,
count=2, id=156, productName=VS2010 build 30319, version=30319,
count=41, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=701, id=1, productName=Unmarked objects,
count=1396, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
bin/lol.dll
- IMPHASH 1b44e2a922ee0cb708dee89af9312f9d
- SHA256 4325ffde93c453f68e5b13cfd225d90359fcf73331c65f23894128cea6dcd116
- MD5 01734cba8fb0849fb285cb18ae90994c
- SHA1 75708c6215304376d497498a18ac467b58dfe168
- SHA512 d37e2407407ad976bcc8c96f1dd223dc396febdc5790fb30bfefee7191aff6bef5f50f8d4848e3c02797c88586a4a1bca85e6883f35b0922c65704d7f2e4ca6b
- SSDEEP 6144:4YfSzERVtJB6KXm0TWtpU8A0QNxcUPKhNa9OuiMp39aPXc2IF2wz65v8mJdVv9:vIE7jAKXmH8NxcXU/p3PF2uil9
- TLSH T1D7B45C5A77A847B5D037D17CC9D34B46E6B1344A4B2197CF02D483AE2F23BE5863A362
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b2:fd:66:1d:26:96:f6:3f:ef:a1:ea:ac:09:69:12:2b:16:76:df:11
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Ubisoft Entertainment Sweden AB,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ubisoft Entertainment Sweden AB,L=Malmo,ST=.,C=SE
Chains
Apr 17, 2014
CN=Ubisoft Entertainment Sweden AB,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ubisoft Entertainment Sweden AB,L=Malmo,ST=.,C=SE
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Subject
CN=Ubisoft Entertainment Sweden AB,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Ubisoft Entertainment Sweden AB,L=Malmo,ST=.,C=SE
Serial Number
77:17:2f:38:82:85:42:6f:99:60:0d:5d:d2:84:07
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 22, 2013 - Feb 22, 2016
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
2
Major OS version
5
Entry point
85200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Jenkins_BUILDS\builds\uplay-pc-client-release_baldur-installer-live\working_directory\RelWithDebInfo\uplay_r1_loader64.pdb
kernel32
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RtlLookupFunctionEntry
RtlUnwindEx
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetLastError
HeapFree
RaiseException
RtlPcToFileHeader
LCMapStringW
GetCPInfo
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
FlsGetValue
FlsFree
SetLastError
GetCurrentThread
FlsAlloc
GetModuleHandleW
ExitProcess
SetHandleCount
GetStdHandle
WideCharToMultiByte
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
FatalAppExitA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteFile
GetModuleFileNameW
SetConsoleCtrlHandler
SetFilePointer
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
CreateFileW
CloseHandle
FlushFileBuffers
LoadLibraryW
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetFileAttributesW
CreateDirectoryW
SetFileAttributesW
GetFileSizeEx
CopyFileW
DeleteFileW
GetFileTime
SetFileTime
MoveFileExW
SetEndOfFile
SetFilePointerEx
FindClose
FindNextFileW
FindFirstFileW
RemoveDirectoryW
CreateMutexW
TryEnterCriticalSection
GetFullPathNameW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetCurrentDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
GetDateFormatW
GetTimeFormatW
GetDriveTypeW
GetFullPathNameA
ReadFile
GetTimeZoneInformation
CreateFileA
GetProcessHeap
CompareStringW
SetEnvironmentVariableA
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
UPLAY_ACH_EarnAchievement
UPLAY_ACH_GetAchievementImage
UPLAY_ACH_GetAchievements
UPLAY_ACH_Write
UPLAY_AVATAR_Get
UPLAY_FRIENDS_AddToBlackList
UPLAY_FRIENDS_DisableFriendMenuItem
UPLAY_FRIENDS_EnableFriendMenuItem
UPLAY_FRIENDS_GetFriendList
UPLAY_FRIENDS_Init
UPLAY_FRIENDS_InviteToGame
UPLAY_FRIENDS_IsBlackListed
UPLAY_FRIENDS_IsFriend
UPLAY_FRIENDS_RequestFriendship
UPLAY_FRIENDS_ShowFriendSelectionUI
UPLAY_GetLastError
UPLAY_GetNextEvent
UPLAY_GetOverlappedOperationResult
UPLAY_HasOverlappedOperationCompleted
UPLAY_INSTALLER_AreChunksInstalled
UPLAY_INSTALLER_GetChunkIdsFromTag
UPLAY_INSTALLER_GetLanguageUtf8
UPLAY_INSTALLER_Init
UPLAY_INSTALLER_ReleaseChunkIdList
UPLAY_INSTALLER_UpdateInstallOrder
UPLAY_METADATA_ClearContinuousTag
UPLAY_METADATA_SetContinuousTag
UPLAY_METADATA_SetSingleEventTag
UPLAY_OVERLAY_SetShopUrl
UPLAY_OVERLAY_Show
UPLAY_PARTY_DisablePartyMemberMenuItem
UPLAY_PARTY_EnablePartyMemberMenuItem
UPLAY_PARTY_GetFullMemberList
UPLAY_PARTY_GetId
UPLAY_PARTY_GetInGameMemberList
UPLAY_PARTY_Init
UPLAY_PARTY_InvitePartyToGame
UPLAY_PARTY_InviteToParty
UPLAY_PARTY_IsInParty
UPLAY_PARTY_IsPartyLeader
UPLAY_PARTY_PromoteToLeader
UPLAY_PARTY_RespondToGameInvite
UPLAY_PARTY_SetGuest
UPLAY_PARTY_SetUserData
UPLAY_PARTY_ShowGameInviteOverlayUI
UPLAY_PeekNextEvent
UPLAY_Quit
UPLAY_Release
UPLAY_SAVE_Close
UPLAY_SAVE_GetSavegames
UPLAY_SAVE_Open
UPLAY_SAVE_Read
UPLAY_SAVE_Remove
UPLAY_SAVE_SetName
UPLAY_SAVE_Write
UPLAY_Startup
UPLAY_USER_ClearGameSession
UPLAY_USER_GetAccountIdUtf8
UPLAY_USER_GetCdKeyUtf8
UPLAY_USER_GetCdKeys
UPLAY_USER_GetEmailUtf8
UPLAY_USER_GetTicketUtf8
UPLAY_USER_GetUsernameUtf8
UPLAY_USER_IsConnected
UPLAY_USER_IsInOfflineMode
UPLAY_USER_IsOwned
UPLAY_USER_SetGameSession
UPLAY_Update
UPLAY_WIN_GetRewards
UPLAY_WIN_RefreshActions
Name
.text
Size
374KB
Virtual Size
374KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
90KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
11KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=152, version=20115,
count=10, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=156, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=115, id=1, productName=Unmarked objects,
count=81, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=155, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
bin/orbit_api.ini
- SHA256 64b1c3657574d949107e0a2f0f15ba1bf5efb28efaa4c9823c0d3d15bdaab2f3
- MD5 e7676d68adac6cc2bf4e502a8533182f
- SHA1 ff1eb60a9e42bd8652fbca6a662727b26f745600
- SHA512 f0e9bcb02c60676452322d75b93f13c05c3068e091194eff4039bedc3c35bdbeacaf191136207869ba98213673ea4ee73b140ec131a86a9317d15b4d2346569c
- TLSH T170116D7207C13D04331770F68206794113B6D16D3E37CC1A505F8995F4A3A16E9DE542
- MD5 SHA1 SHA512 TLSH
bin/uext64.dll
- IMPHASH 445ac1326719acc51b9834016bf18006
- SHA256 0e33556941c5af593d2d4b18314dba09c119f131462d24089302642ee30b0256
- MD5 3ce6001f8b7062a9f477a715f9d3cc6e
- SHA1 2d1e73bb3b2061d3c900e7e230a79c36e675106c
- SHA512 70085176856f4bb3d3aa0f588b3f4eab50795d8b353561752eca24b80503bd6ba9cc35e91cb0e1003b36db4e63f0ca4ee65896f5ef28875df0178e50db94f7e4
- SSDEEP 6144:1TdKKsiO3F7IeYNolvyMWIMCQqGMtqux83so:rhKIek4vhpVQCjaso
- TLSH T187249D8763C906A3D0125135D9FB8E84A7B7F907C525EB0ED248372EAF673C14E1BA64
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
VirtualProtect
GetModuleHandleA
GetModuleFileNameA
VirtualFree
CreateFileA
SetFilePointerEx
WriteFile
ReadFile
GetFileSizeEx
GetLastError
VirtualAlloc
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
LeaveCriticalSection
EnterCriticalSection
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetModuleFileNameW
LoadLibraryExW
HeapReAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
CreateFileW
advapi32
CryptImportKey
CryptHashData
CryptDestroyHash
CryptVerifySignatureA
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
Name
.text
Size
33KB
Virtual Size
32KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.RLD0
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.RLD1
Size
146KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=207, version=50929,
count=84, id=206, version=50929,
count=7, id=205, version=50929,
count=102, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=9, id=210, version=60610,
count=1, id=202, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
bin/uplay_r164.dll
- IMPHASH 3c05817d7d2a7284fb26c12c7f24b3c7
- SHA256 8975171eb5ec798eacbedf9cbf6fd99c5d61f31be7c6bfd36cbac9c97093432a
- MD5 dc8ba75683bcbc295089a4b1da782c97
- SHA1 895cd676a5e051e07c527bf2cb109d1c2a3048ec
- SHA512 8fee11eb07bb56e92ae57f1f20e0f2ff7522623a335e893568613047ca807f538a98e9de7fd1e1b9b2f299d868880cd45b56a151de9c748b20bece908080aa19
- SSDEEP 12288:N1RotJEGcx/EEEvccsAAGT6kEaOyeGKwywy3S03WZjYasVhLltvNY:poDhcGUcsAAGGaOpGr63SXzMhRtFY
- TLSH T16C0539B7E1830C56CE460DB698B36D31426F2C367E7D578A22403A157FB33D35B26A92
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
42972
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
HeapAlloc
HeapFree
GetProcessHeap
HeapDestroy
HeapCreate
RaiseException
QueryPerformanceCounter
ReadFile
FindFirstFileA
FindClose
FindNextFileA
DeleteFileA
GetLastError
GetProcAddress
LoadLibraryA
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
VirtualFree
GetFileAttributesA
CreateDirectoryA
GetLocalTime
FindResourceA
LoadResource
SetEvent
SizeofResource
CreateEventA
LockResource
WaitForMultipleObjects
CloseHandle
CreateThread
VirtualAlloc
RtlLookupFunctionEntry
RtlUnwindEx
GetCommandLineA
EncodePointer
DecodePointer
RtlPcToFileHeader
SetLastError
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FileTimeToSystemTime
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
LoadLibraryExW
HeapReAlloc
OutputDebugStringW
LoadLibraryW
GetStringTypeW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CreateFileW
WideCharToMultiByte
SystemTimeToFileTime
MultiByteToWideChar
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
GetStartupInfoW
InitializeCriticalSection
GetFileSizeEx
CreateFileA
WritePrivateProfileStringA
GetPrivateProfileStringA
advapi32
CryptDestroyHash
CryptVerifySignatureA
CryptDestroyKey
CryptCreateHash
CryptImportKey
CryptAcquireContextA
CryptReleaseContext
CryptHashData
shell32
SHGetSpecialFolderPathA
winmm
waveOutWrite
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutReset
waveOutClose
??0OrbitClient@orbitclient@mg@@QEAA@XZ
??0SavegameInfo@orbitclient@mg@@AEAA@XZ
??0SavegameReader@orbitclient@mg@@AEAA@XZ
??0SavegameWriter@orbitclient@mg@@AEAA@XZ
??1OrbitClient@orbitclient@mg@@QEAA@XZ
??1SavegameInfo@orbitclient@mg@@AEAA@XZ
??1SavegameReader@orbitclient@mg@@AEAA@XZ
??1SavegameWriter@orbitclient@mg@@AEAA@XZ
?CheckUpdate@OrbitClient@orbitclient@mg@@QEAAHXZ
?Close@SavegameReader@orbitclient@mg@@QEAAXXZ
?Close@SavegameWriter@orbitclient@mg@@QEAAX_N@Z
?GetInstallationErrorNum@OrbitClient@orbitclient@mg@@QEAAIXZ
?GetInstallationErrorString@OrbitClient@orbitclient@mg@@QEAAPEAGPEBD@Z
?GetLocText@OrbitClient@orbitclient@mg@@QEAAPEBGPEBGPEBD@Z
?GetLoginDetails@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetLoginDetailsListener@23@@Z
?GetName@SavegameInfo@orbitclient@mg@@QEAAPEBGXZ
?GetNetworkTraffic@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetNetworkTrafficListener@23@@Z
?GetOrbitServer@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetOrbitServerListener@23@II@Z
?GetProductId@SavegameInfo@orbitclient@mg@@QEAAIXZ
?GetRequestUniqueId@OrbitClient@orbitclient@mg@@QEAAIXZ
?GetSavegameId@SavegameInfo@orbitclient@mg@@QEAAIXZ
?GetSavegameList@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetSavegameListListener@23@I@Z
?GetSavegameReader@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetSavegameReaderListener@23@II@Z
?GetSavegameWriter@OrbitClient@orbitclient@mg@@QEAAXIPEAVIGetSavegameWriterListener@23@II_N@Z
?GetSize@SavegameInfo@orbitclient@mg@@QEAAIXZ
?Read@SavegameReader@orbitclient@mg@@QEAAXIPEAVISavegameReadListener@23@IPEAXI@Z
?RemoveSavegame@OrbitClient@orbitclient@mg@@QEAAXIPEAVIRemoveSavegameListener@23@II@Z
?SetName@SavegameWriter@orbitclient@mg@@QEAA_NPEAG@Z
?StartLauncher@OrbitClient@orbitclient@mg@@QEAA_NIIPEBD0@Z
?StartProcess@OrbitClient@orbitclient@mg@@QEAAXPEAG00@Z
?UPLAY_WIN_ActionTaken@@YAHPEAUUPLAY_WIN_Action_t@@PEAUUPLAY_Overlapped_t@@@Z
?Update@OrbitClient@orbitclient@mg@@QEAAXXZ
?Write@SavegameWriter@orbitclient@mg@@QEAAXIPEAVISavegameWriteListener@23@PEAXI@Z
SuperSecretAPIWithTagDontCopyThisOne
UPLAY_ACH_EarnAchievement
UPLAY_ACH_GetAchievementImage
UPLAY_ACH_GetAchievements
UPLAY_ACH_Write
UPLAY_AVATAR_Get
UPLAY_AVATAR_GetAvatarIdForCurrentUser
UPLAY_AVATAR_GetBitmap
UPLAY_ClearGameSession
UPLAY_FRIENDS_AddToBlackList
UPLAY_FRIENDS_DisableFriendMenuItem
UPLAY_FRIENDS_EnableFriendMenuItem
UPLAY_FRIENDS_GetFriendList
UPLAY_FRIENDS_Init
UPLAY_FRIENDS_InviteToGame
UPLAY_FRIENDS_IsBlackListed
UPLAY_FRIENDS_IsFriend
UPLAY_FRIENDS_RequestFriendship
UPLAY_FRIENDS_ShowFriendSelectionUI
UPLAY_GetInstallationError
UPLAY_GetLastError
UPLAY_GetNextEvent
UPLAY_GetOverlappedOperationResult
UPLAY_HasOverlappedOperationCompleted
UPLAY_INSTALLER_AreChunksInstalled
UPLAY_INSTALLER_GetChunkIdsFromTag
UPLAY_INSTALLER_GetLanguageUtf8
UPLAY_INSTALLER_Init
UPLAY_INSTALLER_ReleaseChunkIdList
UPLAY_INSTALLER_UpdateInstallOrder
UPLAY_Init
UPLAY_METADATA_ClearContinuousTag
UPLAY_METADATA_SetContinuousTag
UPLAY_METADATA_SetSingleEventTag
UPLAY_OVERLAY_SetShopUrl
UPLAY_OVERLAY_Show
UPLAY_OVERLAY_ShowFacebookAuthentication
UPLAY_PARTY_DisablePartyMemberMenuItem
UPLAY_PARTY_EnablePartyMemberMenuItem
UPLAY_PARTY_GetFullMemberList
UPLAY_PARTY_GetId
UPLAY_PARTY_GetInGameMemberList
UPLAY_PARTY_Init
UPLAY_PARTY_InvitePartyToGame
UPLAY_PARTY_InviteToParty
UPLAY_PARTY_IsInParty
UPLAY_PARTY_IsPartyLeader
UPLAY_PARTY_PromoteToLeader
UPLAY_PARTY_RespondToGameInvite
UPLAY_PARTY_SetGuest
UPLAY_PARTY_SetUserData
UPLAY_PARTY_ShowGameInviteOverlayUI
UPLAY_PRESENCE_SetRichPresenceLine
UPLAY_PRESENCE_SetRichPresencePropertyInt32
UPLAY_PRESENCE_SetRichPresencePropertyString
UPLAY_PeekNextEvent
UPLAY_Quit
UPLAY_Release
UPLAY_SAVE_Close
UPLAY_SAVE_GetSavegames
UPLAY_SAVE_Open
UPLAY_SAVE_Read
UPLAY_SAVE_Remove
UPLAY_SAVE_SetName
UPLAY_SAVE_Write
UPLAY_SetGameSession
UPLAY_SetLocale
UPLAY_StartPlatform
UPLAY_Startup
UPLAY_USER_ClearGameSession
UPLAY_USER_GetAccountId
UPLAY_USER_GetAccountIdUtf8
UPLAY_USER_GetCdKeyUtf8
UPLAY_USER_GetCdKeys
UPLAY_USER_GetCredentials
UPLAY_USER_GetEmail
UPLAY_USER_GetEmailUtf8
UPLAY_USER_GetPassword
UPLAY_USER_GetPasswordUtf8
UPLAY_USER_GetTicketUtf8
UPLAY_USER_GetUsername
UPLAY_USER_GetUsernameUtf8
UPLAY_USER_IsConnected
UPLAY_USER_IsInOfflineMode
UPLAY_USER_IsOwned
UPLAY_USER_SetGameSession
UPLAY_Update
UPLAY_WIN_GetActions
UPLAY_WIN_GetRewards
UPLAY_WIN_RefreshActions
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
42KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
311KB
Virtual Size
311KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.RLD0
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.RLD1
Size
362KB
Virtual Size
361KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=32, id=207, version=50929,
count=86, id=206, version=50929,
count=9, id=205, version=50929,
count=20, id=210, version=60610,
count=129, id=1, productName=Unmarked objects,
count=9, id=185, version=30716,
count=20, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=202, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
bin/uplay_r1_loader64.dll
- IMPHASH 9c0057044059368de27895c57e9ef776
- SHA256 599f4df0a96b93eb655ca85a824030377407518d9fb9c7278e59097425f7b61c
- MD5 ce82860fbaa0f60b0f10a0198a989bfe
- SHA1 135152e802c44134a87561899e39556c16b8b142
- SHA512 acb3ffcde44db74931f8dc63f226727e4f1286d0ed535556be0cc24d021a56ca3bfbc4e791de033824a818f456e85ff70a0edb27e4b5439ad32568958197f51c
- SSDEEP 1536:+TYfbsHP88CZgwOz9k5KV8tisWAUdZtyj:+TWsHP85ZgwOzQFOZt6
- TLSH T15A73184473E40079E1738639D8F74D52D637F80A1A729F0D1BA8025E5E637C29AB8F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4544
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
LoadLibraryA
GetCommandLineA
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
GetLastError
SetLastError
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
RtlUnwindEx
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
CreateFileW
UPLAY_ACH_EarnAchievement
UPLAY_ACH_GetAchievementImage
UPLAY_ACH_GetAchievements
UPLAY_ACH_Write
UPLAY_AVATAR_Get
UPLAY_AVATAR_GetAvatarIdForCurrentUser
UPLAY_AVATAR_GetBitmap
UPLAY_ClearGameSession
UPLAY_FRIENDS_AddToBlackList
UPLAY_FRIENDS_DisableFriendMenuItem
UPLAY_FRIENDS_EnableFriendMenuItem
UPLAY_FRIENDS_GetFriendList
UPLAY_FRIENDS_Init
UPLAY_FRIENDS_InviteToGame
UPLAY_FRIENDS_IsBlackListed
UPLAY_FRIENDS_IsFriend
UPLAY_FRIENDS_RequestFriendship
UPLAY_FRIENDS_ShowFriendSelectionUI
UPLAY_GetInstallationError
UPLAY_GetLastError
UPLAY_GetNextEvent
UPLAY_GetOverlappedOperationResult
UPLAY_HasOverlappedOperationCompleted
UPLAY_INSTALLER_AreChunksInstalled
UPLAY_INSTALLER_GetChunkIdsFromTag
UPLAY_INSTALLER_GetLanguageUtf8
UPLAY_INSTALLER_Init
UPLAY_INSTALLER_ReleaseChunkIdList
UPLAY_INSTALLER_UpdateInstallOrder
UPLAY_Init
UPLAY_METADATA_ClearContinuousTag
UPLAY_METADATA_SetContinuousTag
UPLAY_METADATA_SetSingleEventTag
UPLAY_OVERLAY_SetShopUrl
UPLAY_OVERLAY_Show
UPLAY_OVERLAY_ShowFacebookAuthentication
UPLAY_PARTY_DisablePartyMemberMenuItem
UPLAY_PARTY_EnablePartyMemberMenuItem
UPLAY_PARTY_GetFullMemberList
UPLAY_PARTY_GetId
UPLAY_PARTY_GetInGameMemberList
UPLAY_PARTY_Init
UPLAY_PARTY_InvitePartyToGame
UPLAY_PARTY_InviteToParty
UPLAY_PARTY_IsInParty
UPLAY_PARTY_IsPartyLeader
UPLAY_PARTY_PromoteToLeader
UPLAY_PARTY_RespondToGameInvite
UPLAY_PARTY_SetGuest
UPLAY_PARTY_SetUserData
UPLAY_PARTY_ShowGameInviteOverlayUI
UPLAY_PRESENCE_SetRichPresenceLine
UPLAY_PRESENCE_SetRichPresencePropertyInt32
UPLAY_PRESENCE_SetRichPresencePropertyString
UPLAY_PeekNextEvent
UPLAY_Quit
UPLAY_Release
UPLAY_SAVE_Close
UPLAY_SAVE_GetSavegames
UPLAY_SAVE_Open
UPLAY_SAVE_Read
UPLAY_SAVE_Remove
UPLAY_SAVE_SetName
UPLAY_SAVE_Write
UPLAY_SetGameSession
UPLAY_SetLocale
UPLAY_StartPlatform
UPLAY_Startup
UPLAY_USER_ClearGameSession
UPLAY_USER_GetAccountId
UPLAY_USER_GetAccountIdUtf8
UPLAY_USER_GetCdKeyUtf8
UPLAY_USER_GetCdKeys
UPLAY_USER_GetCredentials
UPLAY_USER_GetEmail
UPLAY_USER_GetEmailUtf8
UPLAY_USER_GetPassword
UPLAY_USER_GetPasswordUtf8
UPLAY_USER_GetTicketUtf8
UPLAY_USER_GetUsername
UPLAY_USER_GetUsernameUtf8
UPLAY_USER_IsConnected
UPLAY_USER_IsInOfflineMode
UPLAY_USER_IsOwned
UPLAY_USER_SetGameSession
UPLAY_Update
UPLAY_WIN_GetActions
UPLAY_WIN_GetRewards
UPLAY_WIN_RefreshActions
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
744B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=207, version=50929,
count=84, id=206, version=50929,
count=7, id=205, version=50929,
count=78, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=1, id=211, version=60610,
count=1, id=202, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
bin/watch_dogs.exe
- IMPHASH b684923fa0ac54bb35e128d006f98177
- SHA256 310411adfaf417dcc70dd16382924a3bc17b575938b8f85e370dc6164ec77fcb
- MD5 b0e8d785ea386cce804a2e9e878f4829
- SHA1 6733567a6e64169d95b617a35b474206f6492b5e
- SHA512 4c666764c747b943b623b2647a306c04516664c91b0e36ae750da98a7fb1e65612635bc30615f86b1ca99122011dd4ea08863397cd6ddcca88e0e6feb4b02c3a
- SSDEEP 768:aLAynskz+09lQk4GzjV0XEc2JP1iK2SwX7R81yqsJ+FhX6P:aLh/SclQBY50XvUP1R1fs42P
- TLSH T1A3D3B4517A02E426DC5D4234DFBAD23559307CDA2A69A2C2BAD37FEF38B07015E49F12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2b:ba:dd:9b:ed:01:9c:52:fd:75:61:a2:c9:fe:23:dd
Digest Algorithm
md5
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Chains
Jan 1, 0001
Subject
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Serial Number
7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 21, 2012 - Dec 30, 2020
Subject
CN=UBISOFT ENTERTAINMENT INC.,O=UBISOFT ENTERTAINMENT INC.,L=Montreal,ST=Quebec,C=CA
Serial Number
2c:b0:08:60:91:4e:c0:97:13:62:b8:fd:4c:74:fe:0d
Issuer
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageMicrosoftCommercialCodeSigning
Timespan
Jul 16, 2013 - Jul 16, 2014
Subject
CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US
Serial Number
47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Issuer
CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Subject
CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US
Serial Number
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Issuer
CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 18, 2012 - Dec 29, 2020
Minor OS version
2
Major OS version
5
Entry point
4948
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
F:\projects\pc-package\bin\DuniaDemoLaunch_PC_b64.pdb
disrupt_b64
?RunGame@@YA_NPEAUHINSTANCE__@@PEBDI@Z
msvcr100
_configthreadlocale
__setusermatherr
_commode
_fmode
_initterm_e
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
_amsg_exit
__set_app_type
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DecodePointer
SetUnhandledExceptionFilter
EncodePointer
GetStartupInfoW
Sleep
Name
.text
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
192B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
36B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=14, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=5, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=32, id=1, productName=Unmarked objects,
count=4, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,
reloaded.nfo
- SHA256 1a2c2968857481f0060bd3302d96410275d4a927aaeb2ab926006fa9d699156e
- MD5 2ec669a09ca1e6b4c97ed763855d051e
- SHA1 f21103ac1d98bc1131953cf3eefb8b1067e63fff
- SHA512 73c539c7ad95094ba0ef2e049b4c844b1ca257a5634784b23f00dfc026daa6e9c48d763a9783a4c0866a35c85125005a3bee548e2c32a5d081462b03c5f67086
- SSDEEP 96:jKfVRt82SWQX3ixjzkxIANzOcsF+WP+VSET4AwrYE9FQuUSeS+VxqkPEPqQgSfO:ufVRvQXSxMxLLV5wR9FQnVzrP0gt
- TLSH T102F1820B933473FE1B31D611298A46C9F362A05B372509E135BF402CBB77576427EAB5
- MD5 SHA1 SHA512 SSDEEP TLSH