home

foc_ram_mplobby_update.exe

LUCASFILM ENTERTAINMENT COMPANY LTD

This is a setup program which is used to install the application. This is installed with multiple programs including Star Wars Empire at War Forces of Corruption. The file has been seen being downloaded from www.stargate-eaw.de and multiple other hosts.
Publisher:
LUCASFILM ENTERTAINMENT COMPANY LTD  (signed and verified)

MD5:
10e7dcb94a837fadff1b3e2ae0d82592

SHA-1:
f6abe99cce246e70beb5b765e34b9b0434d90b7d

SHA-256:
0e13f6187677849fd9bba95f35ed3c6be6b6cf25971b09eb9f4453626ea8c675

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/5/2024 2:29:53 PM UTC  (today)

File size:
565.4 KB (578,928 bytes)

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\foc_ram_mplobby_update.exe

Digital Signature
Signed by:
LUCASFILM ENTERTAINMENT COMPANY LTD

Authority:
VeriSign, Inc.

Valid from:
5/6/2010 2:00:00 AM

Valid to:
5/6/2013 1:59:59 AM

Subject:
CN=LUCASFILM ENTERTAINMENT COMPANY LTD, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=LUCASFILM ENTERTAINMENT COMPANY LTD, L=San Francisco, S=California, C=US

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
17C1671D36982C4A4BE8522E75C38A03

File PE Metadata
Compilation timestamp:
7/18/2011 10:58:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
12288:Yrg7D2AIXKWhDD3aHp3ntzl7fPZKdFbg7D2AIXKWhDD3aHp3ntzlJfPZHyF5iW:Kg7D2AIXKWhDD3aHp3ntzl7fPZKdFbgC

Entry address:
0x19F0

Entry point:
E8, 41, 18, 00, 00, E9, 16, FE, FF, FF, CC, CC, CC, CC, CC, CC, 8D, 42, FF, 5B, C3, 8D, A4, 24, 00, 00, 00, 00, 8D, 64, 24, 00, 33, C0, 8A, 44, 24, 08, 53, 8B, D8, C1, E0, 08, 8B, 54, 24, 08, F7, C2, 03, 00, 00, 00, 74, 15, 8A, 0A, 83, C2, 01, 3A, CB, 74, CF, 84, C9, 74, 51, F7, C2, 03, 00, 00, 00, 75, EB, 0B, D8, 57, 8B, C3, C1, E3, 10, 56, 0B, D8, 8B, 0A, BF, FF, FE, FE, 7E, 8B, C1, 8B, F7, 33, CB, 03, F0, 03, F9, 83, F1, FF, 83, F0, FF, 33, CF, 33, C6, 83, C2, 04, 81, E1, 00, 01, 01, 81, 75, 1C, 25, 00...
 
[+]

Code size:
28 KB (28,672 bytes)

The file foc_ram_mplobby_update.exe has been discovered within the following programs.

Star Wars Empire at War Forces of Corruption  by Lucas Arts
Publisher's description - “In the best-selling Star Wars: Empire at War, you controlled an entire war for the Star Wars galaxy as the Rebel Alliance or the Galactic Empire. Now, face off against them in Star Wars® Empire at War™: Forces of Corruption™.”
www.lucasarts.com/games/swempireatwar_foc
6% remove it
Star Wars: Empire at War Gold  by Petroglyph
www.swempireatwar.com
About 2% of users remove it
 
Powered by Should I Remove It?

The file foc_ram_mplobby_update.exe has been seen being distributed by the following 4 URLs.

https://www.stargate-eaw.de/index.php/en/media/downloads/.../13-foc-ram-mp-lobby-update

http://stargate-eaw.de/index.php/de/2014-04-23-12-33-8/downloads/.../13-foc-ram-mp-lobby-update?tmpl=component

http://static.dolimg.com/mh_netstorage/lucasfilm/patches/.../FOC_RAM_MPLobby_update.exe

ftp://ftp.lucasarts.com/patches/.../FOC_RAM_MPLobby_update.exe

Scan foc_ram_mplobby_update.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.