e1f5c49c2d312873fde445d4584fe2e4

Sharing

Copy URL

Twitter E-mail

General

Target

e1f5c49c2d312873fde445d4584fe2e4
Size

7.9MB
MD5

e1f5c49c2d312873fde445d4584fe2e4
SHA1

38e7c681f9783ea22dcb8227dbf97d3b65ca4e83
SHA256

5cfaec15d48d36b15ac725930e3203e30e40bf17fc0d11de83d5e4f42a0f717c
SHA512

6159062fababbda3cd700863575dee6c294e8b788731e512b048942250a7ad4bd7af250793627e91d183f79e608fea0dec562fb8587b089a84217a21f8226880
SSDEEP

196608:yVAvvOkJH/c4zxtZajRYGYnFVGAK+JXV6w:/vvOUHlzxvEeGkcIXV6w

Score

3^/10

Malware Config

Signatures

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
e1f5c49c2d312873fde445d4584fe2e4
unpack001/$PLUGINSDIR/ExecCmd.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Uninstall.exe
unpack003/$PLUGINSDIR/CabDLL.dll
unpack003/$PLUGINSDIR/CustomLicense.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/UAC.dll
unpack003/$PLUGINSDIR/inetc.dll
unpack003/$PLUGINSDIR/nsDialogs.dll
unpack003/$PLUGINSDIR/nsUnzip.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_2
static1/unpack001/Uninstall.exe	nsis_installer_2
static1/unpack001/toolbar.exe	nsis_installer_1
static1/unpack001/toolbar.exe	nsis_installer_2

Files

e1f5c49c2d312873fde445d4584fe2e4
.exe windows:4 windows x86 arch:x86

28a099a911237a28521d8b7ea250f089

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/ExecCmd.dll
.dll windows:4 windows x86 arch:x86

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
OpenProcess
CloseHandle
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
TerminateProcess
GetExitCodeProcess
WaitForSingleObject
Sleep
CreateProcessA
GlobalAlloc
GetExitCodeThread
lstrcpyA
lstrcpynA
CreateThread
lstrcatA
GetEnvironmentVariableA
lstrcmpiA

user32

SendMessageA
EnumWindows
WaitForInputIdle
wsprintfA
GetWindowThreadProcessId

Exports

Exports

exec
wait

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 802B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 142B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptionCompiled1.ini
$PLUGINSDIR/InstallOptionCompiled2.ini
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

7458f96eb10904198d988c72ce690084

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

gdi32

CombineRgn
CreateCompatibleDC
CreateRectRgn
DeleteObject
GetDIBits
GetObjectA
SelectObject
SetTextColor

kernel32

GetCurrentDirectoryA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MultiByteToWideChar
SetCurrentDirectoryA
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA

ole32

CoTaskMemFree

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

user32

CallWindowProcA
CharNextA
CloseClipboard
CreateDialogParamA
CreateWindowExA
DestroyIcon
DestroyWindow
DispatchMessageA
DrawFocusRect
DrawTextA
EnableMenuItem
EnableWindow
GetClientRect
GetClipboardData
GetDlgCtrlID
GetDlgItem
GetMessageA
GetSystemMenu
GetWindowLongA
GetWindowRect
GetWindowTextA
IsDialogMessageA
LoadCursorA
LoadIconA
LoadImageA
MapDialogRect
MapWindowPoints
MessageBoxA
OpenClipboard
PostMessageA
PtInRect
SendMessageA
SetCursor
SetWindowLongA
SetWindowPos
SetWindowRgn
SetWindowTextA
ShowWindow
TranslateMessage
wsprintfA

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

38e5d87efd24fb4005f186879a64501c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

FreeLibrary
GetLastError
GetModuleHandleA
GetProcAddress
GlobalAlloc
GlobalFree
GlobalSize
LoadLibraryA
MultiByteToWideChar
VirtualAlloc
VirtualProtect
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrcpynA
lstrlenA

msvcrt

__dllonexit
_errno
fflush
free
malloc

ole32

CLSIDFromString
StringFromGUID2

user32

wsprintfA

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1024B - Virtual size: 540B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 284B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 624B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

4fb4d15e957b6564bf15c23e80f0202a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

gdi32

SetTextColor

kernel32

GetCurrentDirectoryA
GetFileAttributesA
GetProcessHeap
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
HeapReAlloc
MulDiv
SetCurrentDirectoryA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA

ole32

CoTaskMemFree

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

user32

CallWindowProcA
CharNextA
CharPrevA
CreateDialogParamA
CreateWindowExA
DestroyWindow
DispatchMessageA
DrawFocusRect
DrawTextA
GetClientRect
GetDlgItem
GetMessageA
GetPropA
GetWindowLongA
GetWindowRect
GetWindowTextA
IsDialogMessageA
IsWindow
KillTimer
LoadCursorA
MapDialogRect
MapWindowPoints
RemovePropA
SendMessageA
SetCursor
SetPropA
SetTimer
SetWindowLongA
SetWindowPos
ShowWindow
TranslateMessage
wsprintfA

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 363B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 140B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIRbarsample.bmp
$PLUGINSDIRlogo.bmp
Uninstall.exe
.exe windows:4 windows x86 arch:x86

28a099a911237a28521d8b7ea250f089

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetVersion
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 136B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3.6MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/modern-header.bmp
doranumeros.swf
favicon.ico
flashplayer.exe
.exe windows:5 windows x86 arch:x86

2173a6ec909b84dcc59cea886313963a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

15-12-2010 00:00

Not After

14-12-2012 23:59

Subject

CN=Adobe Systems Incorporated,OU=Information Systems+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Adobe Systems Incorporated,L=San Jose,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:9d:9e:9f:6c:25:33:df:fb:03:7b:57:23:0c:0a:9d:e4:e4:2f:81
Signer

Actual PE Digest

d6:9d:9e:9f:6c:25:33:df:fb:03:7b:57:23:0c:0a:9d:e4:e4:2f:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

FlashPlayer.pdb

Imports

crypt32

CertRDNValueToStrW
CertFindRDNAttr
CryptDecodeObjectEx
CertNameToStrW
CryptFindOIDInfo
CertFreeCertificateContext
CertFindCertificateInStore
CertVerifySubjectCertificateContext
CertCreateCertificateContext
CryptGetMessageCertificates
CryptVerifyMessageSignature
CertCompareCertificateName
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertCompareCertificate
CertVerifyTimeValidity
CertOpenStore
CertVerifyRevocation
CertCloseStore
CertAddStoreToCollection

urlmon

CopyStgMedium

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

winmm

waveInStop
waveOutClose
waveInClose
waveInUnprepareHeader
waveInReset
waveInPrepareHeader
timeSetEvent
waveOutGetPosition
timeGetTime
waveInAddBuffer
waveInStart
waveOutReset
mixerGetID
waveInGetDevCapsA
waveOutGetDevCapsA
waveOutMessage
waveInMessage
mixerClose
mixerGetLineControlsA
mixerGetLineInfoA
mixerGetDevCapsA
mixerOpen
mixerGetControlDetailsA
waveOutRestart
waveOutPause
waveInGetPosition
mixerSetControlDetails
waveOutOpen
waveInGetNumDevs
waveOutGetNumDevs
waveInGetDevCapsW
waveOutGetDevCapsW
waveOutUnprepareHeader
waveOutPrepareHeader
waveOutWrite
timeGetDevCaps
timeBeginPeriod
timeKillEvent
timeEndPeriod
waveInOpen

oleaut32

SysFreeString

dsound

ord8

kernel32

GlobalFree
ReadFile
GetFileSize
CreateThread
LockResource
LoadResource
FindResourceExA
FindResourceExW
SetUnhandledExceptionFilter
GetTempPathW
FindClose
FindNextFileW
FindFirstFileW
InterlockedIncrement
InterlockedDecrement
GetTimeZoneInformation
GetSystemTime
SystemTimeToFileTime
ReleaseSemaphore
WaitForMultipleObjects
SetEvent
CreateSemaphoreW
GetTempPathA
GetModuleFileNameA
GetModuleFileNameW
GetTempFileNameW
GetSystemDirectoryW
ExpandEnvironmentStringsA
WideCharToMultiByte
CreateProcessW
GetTempFileNameA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
CreateMutexA
SetFilePointerEx
CreateFileA
GetFileAttributesExW
GetFileInformationByHandle
GetVolumeInformationW
GetCurrentDirectoryW
SetCurrentDirectoryW
RemoveDirectoryW
GetFullPathNameW
ExpandEnvironmentStringsW
OutputDebugStringA
GetVersionExA
CreateDirectoryW
TlsSetValue
UnmapViewOfFile
ReleaseMutex
MapViewOfFile
CreateFileMappingA
SetThreadPriority
GetSystemDirectoryA
TerminateThread
lstrcpyA
lstrlenA
CompareFileTime
LocalFree
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserAPC
OpenThread
SleepEx
GetModuleHandleA
SetEndOfFile
SetFileAttributesA
CopyFileA
GetCommandLineW
GetStartupInfoW
GetCommandLineA
SwitchToThread
VerSetConditionMask
VerifyVersionInfoW
CreateFileW
SetFilePointer
WriteFile
GetUserDefaultUILanguage
GetUserDefaultLangID
VirtualQuery
GetFileAttributesW
DeleteFileW
MoveFileExW
GetModuleHandleW
GetSystemInfo
LoadLibraryA
GlobalAlloc
GlobalSize
GetCurrentProcessId
GlobalLock
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
InterlockedExchangeAdd
lstrlenW
GetVersion
DeviceIoControl
VirtualAlloc
VirtualFree
CreateSemaphoreA
TlsAlloc
TlsFree
GetNumberFormatW
GetCurrencyFormatW
CompareStringW
GetDateFormatW
GetTimeFormatW
GetUserDefaultLCID
EnumSystemLocalesW
HeapAlloc
GetProcessHeap
HeapFree
HeapSize
VirtualProtect
GetProcessAffinityMask
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlUnwind
ExitProcess
GetStartupInfoA
GetSystemTimeAsFileTime
GetStdHandle
TerminateProcess
IsDebuggerPresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetHandleCount
GetFileType
GlobalUnlock
GetProcessTimes
FreeLibrary
CreateProcessA
GetVersionExW
LCMapStringW
GetTickCount
GetLocaleInfoW
GetEnvironmentVariableW
GetLastError
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventW
LoadLibraryW
GetProcAddress
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
RaiseException
GetCurrentThread
SetThreadAffinityMask
IsDBCSLeadByte
GetACP
GetCPInfo
MultiByteToWideChar
ExitThread
InterlockedExchange
InterlockedCompareExchange
Sleep
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
HeapReAlloc
HeapCreate
GetOEMCP
IsValidCodePage
LCMapStringA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetStringTypeA
GetStringTypeW
CompareStringA
SetEnvironmentVariableA
GetFileSizeEx

user32

GetDlgItemTextW
GetWindowTextLengthA
GetDlgItemTextA
InsertMenuW
InsertMenuA
GetWindowTextA
UnregisterClassA
LoadMenuW
DeleteMenu
GetWindowTextLengthW
GetWindowTextW
UpdateWindow
BeginPaint
EndPaint
IsIconic
GetMenu
ShowWindowAsync
GetWindow
IsWindowVisible
SetWindowPlacement
IsZoomed
GetSystemMenu
SetMenu
EnumDisplaySettingsW
FlashWindowEx
GetActiveWindow
MapWindowPoints
MoveWindow
SetCaretPos
DestroyCaret
CreateCaret
ShowCaret
EnumDisplayDevicesW
EmptyClipboard
SetClipboardData
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
EnableWindow
IsWindow
GetWindowThreadProcessId
GetSubMenu
SetCapture
ReleaseCapture
TrackMouseEvent
GetCapture
EnumWindows
GetCursorPos
MessageBoxW
LoadStringA
GetWindowInfo
CopyRect
GetFocus
InvalidateRect
EnableMenuItem
CheckMenuItem
PeekMessageW
GetQueueStatus
SetTimer
KillTimer
RemoveMenu
SetMenuItemInfoW
GetMenuItemInfoW
InsertMenuItemW
CreatePopupMenu
TrackPopupMenu
DrawMenuBar
DestroyMenu
CreateMenu
SetMenuInfo
MapVirtualKeyW
GetKeyState
GetForegroundWindow
WaitForInputIdle
ShowWindow
DialogBoxParamW
ScreenToClient
SetDlgItemTextA
SetDlgItemTextW
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
GetMenuStringA
GetMenuStringW
RegisterClipboardFormatW
SetWindowTextA
GetClientRect
LoadStringW
RedrawWindow
DialogBoxIndirectParamW
EndDialog
GetDesktopWindow
SetWindowPos
LoadIconW
GetDlgItem
SetWindowTextW
GetParent
SendMessageTimeoutW
SendMessageW
CreateIconIndirect
SetFocus
FillRect
PostMessageW
SetRectEmpty
DestroyWindow
SetCursor
GetCursor
DestroyIcon
GetPropW
SetPropW
GetMonitorInfoW
SystemParametersInfoW
GetClipboardFormatNameA
RegisterClipboardFormatA
GetDC
ReleaseDC
DdeInitializeW
DdeCreateStringHandleA
DdeConnect
DdeClientTransaction
DdeDisconnect
DdeFreeStringHandle
DdeUninitialize
ClientToScreen
SendInput
GetKeyboardLayout
GetWindowRect
UpdateLayeredWindow
EnumDisplayDevicesA
GetSystemMetrics
SetRect
OffsetRect
MonitorFromWindow
CreateWindowExW
RegisterClassExW
GetWindowLongW
CallWindowProcW
DefWindowProcW
PostQuitMessage
LoadCursorW
GetClassInfoExW
SetWindowLongW
GetDoubleClickTime
PostMessageA
RegisterWindowMessageA
MessageBoxA
GetWindowPlacement

gdi32

GetBkMode
GetTextColor
SelectClipRgn
GetBkColor
SetTextAlign
CreatePen
GetTextExtentPoint32W
GetCurrentObject
CreateRectRgn
GetTextAlign
GetTextExtentPoint32A
GetTextCharacterExtra
SetWorldTransform
SetGraphicsMode
GetWorldTransform
CreatePalette
GetSystemPaletteEntries
SelectObject
ExtTextOutW
GetDeviceCaps
SetBkMode
RealizePalette
SelectPalette
LPtoDP
StartDocW
EndDoc
CreateSolidBrush
StrokePath
ExtCreatePen
FillPath
StretchDIBits
GetClipBox
GetClipRgn
IntersectClipRect
BitBlt
CreateDIBSection
GetFontData
GetObjectW
GdiFlush
DeleteDC
CreateCompatibleDC
RestoreDC
SelectClipPath
PolyBezierTo
EnumFontFamiliesExW
DPtoLP
LineTo
StartPage
EndPage
SetPolyFillMode
SaveDC
BeginPath
EndPath
SetTextColor
SetTextCharacterExtra
MoveToEx
ExtTextOutA
EnumFontFamiliesA
GetTextMetricsW
CreateFontIndirectW
CreateBitmap
SetPixel
GetStockObject
CreateDCA
GetICMProfileA
EnumFontFamiliesW
DeleteObject
GetStretchBltMode
SetStretchBltMode
StretchBlt
SetBkColor
CreateFontIndirectA

comdlg32

CommDlgExtendedError
GetSaveFileNameW
PrintDlgW
GetOpenFileNameA
GetSaveFileNameA
GetOpenFileNameW

advapi32

CryptGenRandom
CryptReleaseContext
RegOpenKeyExA
RegQueryValueExW
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptAcquireContextW
RegOpenKeyA

shell32

DragQueryFileA
DragAcceptFiles
SHGetDiskFreeSpaceExW
SHGetFolderPathW
SHGetSpecialFolderLocation
SHAppBarMessage
SHGetFolderPathA
SHBrowseForFolderW
SHGetPathFromIDListW
DragQueryFileW

ole32

CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
CreateBindCtx
ReleaseStgMedium
OleUninitialize
OleFlushClipboard
OleIsCurrentClipboard
OleSetClipboard
OleGetClipboard
OleInitialize
CoInitialize
CoUninitialize
PropVariantClear

ws2_32

inet_addr
WSACloseEvent
htons
getsockname
ntohs
send
recv
setsockopt
WSAStartup
gethostbyname
socket
WSAIoctl
WSAGetLastError
WSAAsyncSelect
closesocket
WSACleanup
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
WSASetLastError
recvfrom
sendto
bind
WSAAddressToStringA
WSACreateEvent
WSAEventSelect
WSAEnumNetworkEvents
ioctlsocket
connect
gethostname
select
ntohl
htonl
WSASocketW

mscms

TranslateBitmapBits
CloseColorProfile
CreateColorTransformW
OpenColorProfileW
DeleteColorTransform

opengl32

wglGetProcAddress

Sections

.text
Size: 5.8MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 199KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 275KB - Virtual size: 274KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
toolbar.exe
.exe windows:4 windows x86 arch:x86

7fa974366048f9c551ef45714595665e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:1b:f8:55:bd:21:76:60:21:07:49:28:0a:fd:91:d3:f1:08:c0:eb
Signer

Actual PE Digest

20:1b:f8:55:bd:21:76:60:21:07:49:28:0a:fd:91:d3:f1:08:c0:eb

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
GetWindowsDirectoryA
SetFileTime
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetTempPathA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CabDLL.dll
.dll windows:5 windows x86 arch:x86

a92f68e8c1cab2d35417d48fbcffff27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
DeleteFileA
SetFileAttributesA
CloseHandle
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
CreateFileA
lstrcpyA
HeapAlloc
GetLastError
HeapFree
MultiByteToWideChar
ReadFile
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
SetFilePointer
GetCurrentThreadId
GetCommandLineA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualFree
VirtualAlloc
HeapReAlloc
HeapCreate
HeapDestroy
GetModuleHandleW
Sleep
GetProcAddress
ExitProcess
GetStdHandle
GetModuleFileNameA
GetFileType
SetHandleCount
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
RaiseException
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount
RtlUnwind
LoadLibraryA
SetEndOfFile
GetProcessHeap
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

user32

FindWindowExA
wsprintfA
SendMessageA
MessageBoxA

Exports

Exports

Author
CabExtractAll
CabInfo
CabView

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/CustomLicense.dll
.dll windows:4 windows x86 arch:x86

0d87660e15e4e2499d63742f6c9630fd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
lstrcpyA
lstrcpynA
GlobalAlloc
CloseHandle
ReadFile
GetFileSize
GetLastError
CreateFileA

user32

SendMessageA

Exports

Exports

LoadFile

Sections

.text
Size: 1024B - Virtual size: 598B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 413B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 110B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

40ffeaaff4dd6648ff7802eda4676ee6

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetVersionExA
lstrcmpiA
GetCurrentThreadId
GetProcAddress
GetCommandLineA
UnmapViewOfFile
WaitForSingleObject
GetCurrentProcessId
SetEvent
lstrlenA
SetCurrentDirectoryA
MapViewOfFile
Sleep
OpenProcess
GetExitCodeProcess
GetModuleHandleA
GetExitCodeThread
CreateThread
CreateFileMappingA
CreateEventA
GlobalAlloc
CreateProcessA
GetLastError
MultiByteToWideChar
FormatMessageA
LocalFree
GlobalFree
CloseHandle
GetModuleFileNameA
lstrcatA
GetPrivateProfileIntA
GetPrivateProfileStringA
DuplicateHandle
LoadLibraryA

user32

GetClassNameA
SetWindowsHookExA
DispatchMessageA
TranslateMessage
IsDialogMessageA
PeekMessageA
MsgWaitForMultipleObjects
DefWindowProcA
SetForegroundWindow
PostMessageA
CreateWindowExA
GetWindowThreadProcessId
CallWindowProcA
SetWindowPos
GetWindowRect
UnhookWindowsHookEx
GetClientRect
LoadIconA
CreateDialogParamA
IsWindowVisible
CallNextHookEx
CharNextA
DialogBoxParamA
SendMessageW
MessageBoxA
EndDialog
SetWindowLongA
DestroyWindow
GetWindowLongA
EnableWindow
ShowWindow
wsprintfA
GetDlgItem
SendMessageA
LoadStringA
LoadImageA

advapi32

GetUserNameA
OpenSCManagerA
GetTokenInformation
OpenProcessToken
CloseServiceHandle
FreeSid
EqualSid
AllocateAndInitializeSid
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueA
QueryServiceStatus
OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 946B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

9243ccd8e16ca1703d187afdd7eb3859

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

strtoul
_adjust_fdiv
malloc
_initterm
free
strrchr
memset
strstr
strchr
strtol
_chkesp

kernel32

DeleteFileA
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
WriteFile
ReadFile
lstrlenA
lstrcmpA
lstrcpynA
GetLastError
CreateFileA
GlobalFree
CloseHandle
SleepEx
SetFilePointer
GetTickCount
lstrcatA
GetFileSize

user32

MessageBoxA
GetParent
ShowWindow
PostMessageA
SetWindowTextA
IsWindow
SendMessageA
GetDlgItem
SetDlgItemTextA
SendDlgItemMessageA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
SetWindowLongA
GetWindowLongA
DestroyWindow
KillTimer
UpdateWindow
RedrawWindow
DispatchMessageA
TranslateMessage
IsDialogMessageA
GetMessageA
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowTextA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
InternetCloseHandle
InternetErrorDlg
InternetSetFilePointer
InternetQueryOptionA
HttpAddRequestHeadersA
InternetSetOptionA
HttpOpenRequestA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/license2_es.rtf
.rtf
$PLUGINSDIR/license_es.rtf
.rtf
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

1e2884056e655f2b7bc5a904e352fc80

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetFileAttributesA
lstrcmpiA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
HeapAlloc
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
GetProcessHeap
SetCurrentDirectoryA

user32

GetPropA
DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
RemovePropA
CharPrevA
GetWindowLongA
DrawTextA
GetWindowTextA
GetDlgItem
SetWindowLongA
SetWindowPos
CreateDialogParamA
MapWindowPoints
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
MapDialogRect
GetClientRect
CharNextA
SendMessageA
DrawFocusRect

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 572B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsUnzip.dll
.dll windows:4 windows x86 arch:x86

f61b492d16b51856da71c9a124fee190

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentProcess
InitializeCriticalSection
ReleaseMutex
WaitForSingleObject
InterlockedExchange
CreateMutexA
GetDriveTypeA
GetVolumeInformationA
LeaveCriticalSection
EnterCriticalSection
lstrlenA
FindFirstFileA
FindNextFileA
FindClose
GetVersion
LocalFileTimeToFileTime
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
FileTimeToLocalFileTime
SetEndOfFile
SetFilePointer
CreateFileA
GetFullPathNameA
GetLocaleInfoA
DosDateTimeToFileTime
SetFileAttributesA
GetFileAttributesA
GetFileTime
SetVolumeLabelA
GetCurrentDirectoryA
DeleteFileA
CreateDirectoryA
SetEnvironmentVariableA
CompareStringW
CompareStringA
GetLocaleInfoW
HeapSize
LoadLibraryA
ReadFile
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetLastError
GetProcessHeap
HeapAlloc
HeapFree
CloseHandle
GlobalUnlock
GlobalLock
lstrcpyA
lstrcmpA
lstrcmpiA
GlobalFree
GlobalAlloc
lstrcpynA
SetFileTime
GetSystemTimeAsFileTime
SetStdHandle
GetFileType
HeapReAlloc
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineA
GetVersionExA
RtlUnwind
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection
ExitProcess
GetProcAddress
GetModuleHandleA
TerminateProcess
GetCPInfo
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
GetStringTypeA
GetStringTypeW
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
LCMapStringA
WideCharToMultiByte
LCMapStringW
GetTimeZoneInformation
GetACP
GetOEMCP
WriteFile
FlushFileBuffers
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
UnhandledExceptionFilter
VirtualProtect
GetSystemInfo
VirtualQuery
SetEnvironmentVariableW

user32

OemToCharA
CharToOemA
wsprintfA
DialogBoxParamA
GetDlgItem
SetWindowTextA
SetDlgItemTextA
SendMessageA
EnableWindow
GetWindowTextLengthA
GetWindowTextA
EndDialog
CharUpperA

advapi32

GetSecurityDescriptorControl
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
GetKernelObjectSecurity
SetKernelObjectSecurity
IsValidSecurityDescriptor
GetSecurityDescriptorDacl
IsValidAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
IsValidSid
GetSecurityDescriptorGroup

Exports

Exports

Extract
GetPassword

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/toolbar_es.bmp
$PLUGINSDIR/welcome_es.bmp
$TEMP/$_7_
.zip
META-INF/manifest.mf
META-INF/zigbert.rsa
META-INF/zigbert.sf
chrome.manifest
chrome/content/id_peque/1.png
.png
chrome/content/id_peque/10.png
.png
chrome/content/id_peque/100.png
.png
chrome/content/id_peque/101.png
.png
chrome/content/id_peque/102.png
.png
chrome/content/id_peque/103.png
.png
chrome/content/id_peque/104.png
.png
chrome/content/id_peque/105.png
.png
chrome/content/id_peque/106.png
.png
chrome/content/id_peque/107.png
.png
chrome/content/id_peque/108.png
.png
chrome/content/id_peque/109.png
.png
chrome/content/id_peque/11.png
.png
chrome/content/id_peque/110.png
.png
chrome/content/id_peque/111.png
.png
chrome/content/id_peque/112.png
.png
chrome/content/id_peque/113.png
.png
chrome/content/id_peque/114.png
.png
chrome/content/id_peque/115.png
.png
chrome/content/id_peque/116.png
.png
chrome/content/id_peque/117.png
.png
chrome/content/id_peque/118.png
.png
chrome/content/id_peque/119.png
.png
chrome/content/id_peque/12.png
.png
chrome/content/id_peque/120.png
.png
chrome/content/id_peque/121.png
.png
chrome/content/id_peque/122.png
.png
chrome/content/id_peque/123.png
.png
chrome/content/id_peque/124.png
.png
chrome/content/id_peque/125.png
.png
chrome/content/id_peque/126.png
.png
chrome/content/id_peque/127.png
.png
chrome/content/id_peque/128.png
.png
chrome/content/id_peque/129.png
.png
chrome/content/id_peque/13.png
.png
chrome/content/id_peque/130.png
.png
chrome/content/id_peque/131.png
.png
chrome/content/id_peque/132.png
.png
chrome/content/id_peque/133.png
.png
chrome/content/id_peque/134.png
.png
chrome/content/id_peque/135.png
.png
chrome/content/id_peque/136.png
.png
chrome/content/id_peque/137.png
.png
chrome/content/id_peque/138.png
.png
chrome/content/id_peque/139.png
.png
chrome/content/id_peque/14.png
.png
chrome/content/id_peque/140.png
.png
chrome/content/id_peque/141.png
.png
chrome/content/id_peque/142.png
.png
chrome/content/id_peque/143.png
.png
chrome/content/id_peque/144.png
.png
chrome/content/id_peque/145.png
.png
chrome/content/id_peque/146.png
.png
chrome/content/id_peque/147.png
.png
chrome/content/id_peque/148.png
.png
chrome/content/id_peque/149.png
.png
chrome/content/id_peque/15.png
.png
chrome/content/id_peque/150.png
.png
chrome/content/id_peque/151.png
.png
chrome/content/id_peque/152.png
.png
chrome/content/id_peque/153.png
.png
chrome/content/id_peque/154.png
.png
chrome/content/id_peque/155.png
.png
chrome/content/id_peque/156.png
.png
chrome/content/id_peque/157.png
.png
chrome/content/id_peque/158.png
.png
chrome/content/id_peque/159.png
.png
chrome/content/id_peque/16.png
.png
chrome/content/id_peque/160.png
.png
chrome/content/id_peque/161.png
.png
chrome/content/id_peque/162.png
.png
chrome/content/id_peque/163.png
.png
chrome/content/id_peque/164.png
.png
chrome/content/id_peque/17.png
.png
chrome/content/id_peque/18.png
.png
chrome/content/id_peque/19.png
.png
chrome/content/id_peque/2.png
.png
chrome/content/id_peque/20.png
.png
chrome/content/id_peque/21.png
.png
chrome/content/id_peque/22.png
.png
chrome/content/id_peque/23.png
.png
chrome/content/id_peque/24.png
.png
chrome/content/id_peque/25.png
.png
chrome/content/id_peque/26.png
.png
chrome/content/id_peque/27.png
.png
chrome/content/id_peque/28.png
.png
chrome/content/id_peque/29.png
.png
chrome/content/id_peque/3.png
.png
chrome/content/id_peque/30.png
.png
chrome/content/id_peque/31.png
.png
chrome/content/id_peque/32.png
.png
chrome/content/id_peque/33.png
.png
chrome/content/id_peque/34.png
.png
chrome/content/id_peque/35.png
.png
chrome/content/id_peque/36.png
.png
chrome/content/id_peque/37.png
.png
chrome/content/id_peque/38.png
.png
chrome/content/id_peque/39.png
.png
chrome/content/id_peque/4.png
.png
chrome/content/id_peque/40.png
.png
chrome/content/id_peque/41.png
.png
chrome/content/id_peque/42.png
.png
chrome/content/id_peque/43.png
.png
chrome/content/id_peque/44.png
.png
chrome/content/id_peque/45.png
.png
chrome/content/id_peque/46.png
.png
chrome/content/id_peque/47.png
.png
chrome/content/id_peque/48.png
.png
chrome/content/id_peque/49.png
.png
chrome/content/id_peque/5.png
.png
chrome/content/id_peque/50.png
.png
chrome/content/id_peque/51.png
.png
chrome/content/id_peque/52.png
.png
chrome/content/id_peque/53.png
.png
chrome/content/id_peque/54.png
.png
chrome/content/id_peque/55.png
.png
chrome/content/id_peque/56.png
.png
chrome/content/id_peque/57.png
.png
chrome/content/id_peque/58.png
.png
chrome/content/id_peque/59.png
.png
chrome/content/id_peque/6.png
.png
chrome/content/id_peque/60.png
.png
chrome/content/id_peque/61.png
.png
chrome/content/id_peque/62.png
.png
chrome/content/id_peque/63.png
.png
chrome/content/id_peque/64.png
.png
chrome/content/id_peque/65.png
.png
chrome/content/id_peque/66.png
.png
chrome/content/id_peque/67.png
.png
chrome/content/id_peque/68.png
.png
chrome/content/id_peque/69.png
.png
chrome/content/id_peque/7.png
.png
chrome/content/id_peque/70.png
.png
chrome/content/id_peque/71.png
.png
chrome/content/id_peque/72.png
.png
chrome/content/id_peque/73.png
.png
chrome/content/id_peque/74.png
.png
chrome/content/id_peque/75.png
.png
chrome/content/id_peque/76.png
.png
chrome/content/id_peque/77.png
.png
chrome/content/id_peque/78.png
.png
chrome/content/id_peque/79.png
.png
chrome/content/id_peque/8.png
.png
chrome/content/id_peque/80.png
.png
chrome/content/id_peque/81.png
.png
chrome/content/id_peque/82.png
.png
chrome/content/id_peque/83.png
.png
chrome/content/id_peque/84.png
.png
chrome/content/id_peque/85.png
.png
chrome/content/id_peque/86.png
.png
chrome/content/id_peque/87.png
.png
chrome/content/id_peque/88.png
.png
chrome/content/id_peque/89.png
.png
chrome/content/id_peque/9.png
.png
chrome/content/id_peque/90.png
.png
chrome/content/id_peque/91.png
.png
chrome/content/id_peque/92.png
.png
chrome/content/id_peque/93.png
.png
chrome/content/id_peque/94.png
.png
chrome/content/id_peque/95.png
.png
chrome/content/id_peque/96.png
.png
chrome/content/id_peque/97.png
.png
chrome/content/id_peque/98.png
.png
chrome/content/id_peque/99.png
.png
chrome/content/id_peque/accion.png
.png
chrome/content/id_peque/arrow_refresh.png
.png
chrome/content/id_peque/ask_settings.xul
.js
chrome/content/id_peque/ask_settings_bg.png
.png
chrome/content/id_peque/aventura.png
.png
chrome/content/id_peque/aventuras.png
.png
chrome/content/id_peque/basis.xml
.xml
chrome/content/id_peque/btn_canalesporpais.png
.png
chrome/content/id_peque/btn_canalesportema2.png
.png
chrome/content/id_peque/btn_radio.png
.png
chrome/content/id_peque/bubble.js
.js
chrome/content/id_peque/bubble.xul
.xml
chrome/content/id_peque/clasicos.png
.png
chrome/content/id_peque/closeIcon.png
.png
chrome/content/id_peque/cog.png
.png
chrome/content/id_peque/colorpicker.htm
.html .js polyglot
chrome/content/id_peque/computer_delete.png
.png
chrome/content/id_peque/contents.rdf
.xml
chrome/content/id_peque/custom_toolbar_items.xml
.xml .js polyglot
chrome/content/id_peque/deporte.png
.png
chrome/content/id_peque/deportes.png
.png
chrome/content/id_peque/des.js
.js
chrome/content/id_peque/emailchecker_options.xul
.xml
chrome/content/id_peque/estrategia.png
.png
chrome/content/id_peque/favicon.ico
chrome/content/id_peque/favicon.png
.png
chrome/content/id_peque/habilidad.png
.png
chrome/content/id_peque/icons.bmp
chrome/content/id_peque/icons.png
.png
chrome/content/id_peque/infantiles.png
.png
chrome/content/id_peque/info.txt
chrome/content/id_peque/jscontainer.htm
.html
chrome/content/id_peque/license2_es.rtf
.rtf
chrome/content/id_peque/license_es.rtf
.rtf
chrome/content/id_peque/logica.png
.png
chrome/content/id_peque/logo.png
.png
chrome/content/id_peque/logo_urtvbar.png
.png
chrome/content/id_peque/md5.js
.js
chrome/content/id_peque/minibrowser.js
.js
chrome/content/id_peque/minibrowser.xul
.xml
chrome/content/id_peque/modal.js
.js
chrome/content/id_peque/modal.xul
.xml
chrome/content/id_peque/mozilla.xul
.xml
chrome/content/id_peque/musica.png
.png
chrome/content/id_peque/ninias.png
.png
chrome/content/id_peque/noticias.png
.png
chrome/content/id_peque/options.js
.js
chrome/content/id_peque/options.xul
.xml .js polyglot
chrome/content/id_peque/plataforma.png
.png
chrome/content/id_peque/plataformas.png
.png
chrome/content/id_peque/separator.png
.png
chrome/content/id_peque/smses.png
.png
chrome/content/id_peque/tabs.htm
chrome/content/id_peque/tb.css
chrome/content/id_peque/tb.js
.js
chrome/content/id_peque/tb.xsl
chrome/content/id_peque/tb.xul
.xml
chrome/content/id_peque/tb_alerts.js
.js
chrome/content/id_peque/tb_allow_popups.js
.js
chrome/content/id_peque/tb_block_popups.js
.js
chrome/content/id_peque/tb_bubble.js
.js
chrome/content/id_peque/tb_clearautofill.js
.js
chrome/content/id_peque/tb_clearcache.js
.js
chrome/content/id_peque/tb_clearcookie.js
.js
chrome/content/id_peque/tb_clearhistory.js
.js
chrome/content/id_peque/tb_clearurlbarhistory.js
.js
chrome/content/id_peque/tb_commandchunk.js
.js
chrome/content/id_peque/tb_cookiesmanager.js
.js
chrome/content/id_peque/tb_external_search.js
.js
chrome/content/id_peque/tb_hidetoolbar.js
.js
chrome/content/id_peque/tb_launchscript.js
.js
chrome/content/id_peque/tb_options.js
.js
chrome/content/id_peque/tb_shellexecute.js
.js
chrome/content/id_peque/tb_switchcommand.js
.js
chrome/content/id_peque/tb_webjump.js
.js
chrome/content/id_peque/tb_widget.js
.js
chrome/content/id_peque/tbcore3.inf
chrome/content/id_peque/toolbar_es.bmp
chrome/content/id_peque/toolbar_es.png
.png
chrome/content/id_peque/toolbarconf_es.nsh
chrome/content/id_peque/version.txt
chrome/content/id_peque/videos.png
.png
chrome/content/id_peque/your_logo.png
.png
components/nsIFastTabs.js
.js
components/nsISuggestSearch.js
.js
install.rdf
$TEMP/parametrosFFtp.vbs
.vbs
$TEMP/parametrosHPtp.vbs
.vbs
$TEMP/peque.cab
.cab
TbCommonUtils.dll
.dll regsvr32 windows:5 windows x86 arch:x86

3ef5bf52453fba1ba2aebc6c25592732

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:24:2b:94:cd:3b:b2:54:38:da:11:84:68:22:ee:d3:c8:2c:b3:f0
Signer

Actual PE Digest

25:24:2b:94:cd:3b:b2:54:38:da:11:84:68:22:ee:d3:c8:2c:b3:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work\Toolbar\toolbar4\release_bin\TbCommonUtils.pdb

Imports

kernel32

InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
SetThreadLocale
GetThreadLocale
CloseHandle
GetModuleFileNameW
GetProcessHeap
GetCurrentProcess
HeapFree
CreateFileA
LeaveCriticalSection
EnterCriticalSection
lstrcmpiW
GetModuleHandleW
GetProcAddress
GetLastError
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
RaiseException
HeapAlloc
lstrlenW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetLocaleInfoA
LoadLibraryA
HeapDestroy
HeapReAlloc
HeapSize
RtlUnwind
GetCurrentThreadId
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
VirtualAlloc
HeapCreate
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetFileType
GetStartupInfoA
SetFilePointer
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeCriticalSectionAndSpinCount

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2

oleaut32

VariantInit
SysFreeString
VariantClear
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
VariantCopy

shlwapi

UrlEscapeW
PathRemoveFileSpecW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TbHelper2.exe
.exe windows:5 windows x86 arch:x86

2c1fdd33325b2ffeb03bf7d1ce3d71a5

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c3:41:01:c9:5d:d8:d0:f2:bd:f3:b4:c3:c8:84:1f:6c:1f:1c:a6:91
Signer

Actual PE Digest

c3:41:01:c9:5d:d8:d0:f2:bd:f3:b4:c3:c8:84:1f:6c:1f:1c:a6:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Toolbar\toolbar4\release_bin\TbHelper2.pdb

Imports

wininet

InternetConnectW
HttpOpenRequestW
HttpSendRequestW
InternetSetOptionW
InternetReadFile
HttpQueryInfoW
InternetCloseHandle
InternetOpenW

kernel32

GetTickCount
CloseHandle
WaitForSingleObject
lstrlenW
RaiseException
InitializeCriticalSection
DeleteCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
GetProcAddress
GetModuleHandleW
lstrcmpiW
GetModuleFileNameW
Sleep
CreateThread
CreateEventW
InterlockedIncrement
InterlockedDecrement
SetEvent
FreeLibrary
MultiByteToWideChar
GetCurrentThreadId
GetCommandLineW
EnterCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
WideCharToMultiByte
CreateIoCompletionPort
lstrlenA
InterlockedExchange
GetQueuedCompletionStatus
ResetEvent
GetSystemInfo
TerminateThread
GetExitCodeThread
GetPrivateProfileSectionNamesW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
GetCurrentProcessId
WriteConsoleW
CreateFileW
CreateFileA
SetEndOfFile
ReadFile
LoadLibraryExW
GetStringTypeW
GetStringTypeA
LCMapStringA
LoadLibraryA
InitializeCriticalSectionAndSpinCount
SetFilePointer
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoA
GetFileType
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleMode
GetConsoleCP
GetModuleHandleA
LCMapStringW
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
ExitThread
VirtualProtect
VirtualAlloc
VirtualQuery
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualFree
HeapCreate
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetCPInfo
SetHandleCount

user32

CharNextW
GetMessageW
PostThreadMessageW
CharUpperW
LoadStringW
TranslateMessage
DispatchMessageW

advapi32

RegQueryValueExW
RegEnumValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoMarshalInterThreadInterfaceInStream
CoUnmarshalInterface

oleaut32

VariantCopy
VariantClear
VariantInit
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
accion.png
.png
arrow_refresh.png
.png
aventura.png
.png
aventuras.png
.png
basis.xml
.xml
btn_canalesporpais.png
.png
btn_canalesportema2.png
.png
btn_radio.png
.png
clasicos.png
.png
cog.png
.png
computer_delete.png
.png
deporte.png
.png
deportes.png
.png
estrategia.png
.png
favicon.ico
favicon.png
.png
habilidad.png
.png
icons.bmp
infantiles.png
.png
info.txt
license2_es.rtf
.rtf
license_es.rtf
.rtf
logica.png
.png
logo.png
.png
logo_urtvbar.png
.png
musica.png
.png
ninias.png
.png
noticias.png
.png
peque.dll
.dll regsvr32 windows:5 windows x86 arch:x86

32af71368cbdf173ab04d242843ebffe

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2f:85:52:66:f4:3f:35:b0:64:5c:33:9a:c0:17:07:d4:52:ef:fd:19
Signer

Actual PE Digest

2f:85:52:66:f4:3f:35:b0:64:5c:33:9a:c0:17:07:d4:52:ef:fd:19

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Artem\Documents\Visual Studio 2008\Projects\update_crutch\Release\update_crutch.pdb

Imports

shell32

ShellExecuteW

kernel32

GetTickCount
GetCurrentThreadId
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetLastError
InterlockedDecrement
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
VirtualFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
WriteFile
LoadLibraryA
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
HeapSize

Exports

Exports

DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plataforma.png
.png
plataformas.png
.png
smses.png
.png
tbcore3.dll
.dll regsvr32 windows:5 windows x86 arch:x86

bc3efa990c5473edde8ff623810bfa00

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:9d:c0:64:35:37:43:6c:b0:5b:b5:fd:1a:97:88:4c:29:61:56:c2
Signer

Actual PE Digest

47:9d:c0:64:35:37:43:6c:b0:5b:b5:fd:1a:97:88:4c:29:61:56:c2

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work\Toolbar\toolbar4\Release_bin\tbcore3U.pdb

Imports

wininet

InternetCloseHandle
InternetWriteFile
FtpOpenFileW
InternetSetCookieExW
InternetOpenW
FindCloseUrlCache
DeleteUrlCacheEntryW
FindNextUrlCacheEntryW
FindFirstUrlCacheEntryW
InternetConnectW
FtpCreateDirectoryW
InternetGetCookieExW
FtpSetCurrentDirectoryW

shlwapi

UrlEscapeW
PathRemoveFileSpecW
PathFileExistsW
PathStripPathW

dbghelp

SymGetOptions
SymCleanup
SymLoadModule
SymInitialize
SymSetOptions
SymGetLineFromAddr
SymFunctionTableAccess
StackWalk
SymGetModuleBase
SymGetSymFromAddr
MiniDumpWriteDump

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

iphlpapi

GetAdaptersInfo

rpcrt4

UuidToStringW
UuidCreate
RpcStringFreeW

winmm

PlaySoundW

gdiplus

GdipSetSmoothingMode
GdipAddPathArcI
GdipAddPathLineI
GdipClosePathFigure
GdipDeletePath
GdipCreatePath
GdipDeletePen
GdipCreatePen1
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipDrawPath
GdipBitmapLockBits
GdipCloneBitmapAreaI
GdipSetImagePalette
GdipGetImagePalette
GdipGetImagePaletteSize
GdipDrawImageRectRect
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipCreateHBITMAPFromBitmap
GdipBitmapGetPixel
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipDrawImageRectI
GdipCreateFromHDC
GdipCreateBitmapFromResource
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipCloneImage
GdipDisposeImage
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipAlloc
GdipFree
GdipGraphicsClear
GdipFillPath
GdiplusStartup
GdiplusShutdown
GdipGetImagePixelFormat
GdipCreateBitmapFromHBITMAP
GdipBitmapUnlockBits

urlmon

URLDownloadToFileW

kernel32

HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
RtlUnwind
ExitThread
GetSystemTimeAsFileTime
GetCommandLineA
UnhandledExceptionFilter
IsDebuggerPresent
TlsGetValue
TlsAlloc
TlsSetValue
HeapReAlloc
GetStdHandle
GetModuleFileNameA
HeapCreate
FatalAppExitA
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
GetTimeZoneInformation
GetConsoleCP
TlsFree
SetLastError
GetLastError
OutputDebugStringA
LoadLibraryW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
GetCurrentThreadId
RaiseException
FlushInstructionCache
GetCurrentProcess
LoadLibraryA
lstrlenW
FindResourceW
SizeofResource
LockResource
LoadResource
HeapSize
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
FreeLibrary
LoadLibraryExW
lstrcmpiW
IsBadCodePtr
HeapFree
GetProcessHeap
SetUnhandledExceptionFilter
HeapAlloc
IsBadWritePtr
GetCurrentProcessId
lstrcpynW
lstrlenA
FormatMessageW
IsBadReadPtr
ReadProcessMemory
GetCurrentThread
GetVersionExW
CreateFileW
CloseHandle
OpenProcess
WideCharToMultiByte
OpenMutexW
GlobalUnlock
GlobalLock
TerminateThread
WaitForSingleObject
CreateThread
CopyFileW
VerLanguageNameW
ReadFile
GetFileSize
RemoveDirectoryW
DeleteFileW
MoveFileExW
WriteFile
GetTempPathW
GetLongPathNameW
MoveFileW
CreateDirectoryW
TerminateProcess
Process32NextW
Module32NextW
Module32FirstW
Process32FirstW
CreateToolhelp32Snapshot
GetStringTypeExW
GetFullPathNameW
FindFirstFileW
FindNextFileW
FindClose
GlobalFree
GlobalReAlloc
GlobalAlloc
lstrcmpW
MulDiv
CreateEventW
SetEvent
GetTempFileNameW
FreeResource
WriteProcessMemory
DisableThreadLibraryCalls
CreateMutexW
GetShortPathNameW
CreateProcessW
GetTickCount
QueueUserAPC
SleepEx
Sleep
ResumeThread
LocalFree
LocalAlloc
FileTimeToSystemTime
SetFilePointer
GetFileInformationByHandle
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
SystemTimeToFileTime
GetConsoleMode
SetCurrentDirectoryW
ExpandEnvironmentStringsW
GetTimeFormatA
GetDateFormatA
LCMapStringA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetConsoleCtrlHandler
GetLocaleInfoW
GetLocaleInfoA
InitializeCriticalSectionAndSpinCount
InterlockedExchange
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
SetStdHandle
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
CreateFileA
CompareStringA
CompareStringW
SetEnvironmentVariableA
FindResourceExW
GetLocalTime

user32

GetWindow
EnumChildWindows
DestroyCursor
SetCursor
CallNextHookEx
IsWindowVisible
SetWindowsHookExW
GetWindowThreadProcessId
UnhookWindowsHookEx
GetDC
DialogBoxParamW
OffsetRect
GetSysColorBrush
GetKeyState
GetWindowTextLengthW
GetUpdateRect
DrawTextW
EndMenu
GetNextDlgTabItem
SetWindowRgn
LoadImageW
RegisterWindowMessageW
DestroyAcceleratorTable
GetDesktopWindow
CreateAcceleratorTableW
InvalidateRgn
LoadCursorFromFileW
MessageBeep
GetDlgItemInt
SetDlgItemTextW
FindWindowExW
GetMenuItemRect
WindowFromDC
GetAsyncKeyState
PeekMessageW
TrackPopupMenu
CreateDialogParamW
MonitorFromPoint
GetMessageW
CheckMenuItem
InsertMenuItemW
CloseClipboard
EmptyClipboard
OpenClipboard
CharLowerBuffW
DialogBoxIndirectParamW
GetSystemMetrics
InflateRect
EndPaint
BeginPaint
SetFocus
MonitorFromWindow
GetWindowTextW
UnregisterClassA
DispatchMessageW
CharUpperBuffW
MessageBoxW
SetLastErrorEx
wsprintfW
CharNextW
IsChild
GetDlgItem
MapWindowPoints
MoveWindow
UpdateLayeredWindow
GetSysColor
PostMessageW
GetMessagePos
GetCursorPos
ScreenToClient
GetWindowLongW
DefWindowProcW
CallWindowProcW
RedrawWindow
GetClientRect
GetWindowRect
GetClassNameW
CopyRect
InvalidateRect
SetTimer
KillTimer
SetWindowLongW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetParent
ReleaseDC
GetWindowDC
ShowWindow
SetWindowPos
SetWindowTextW
CreateWindowExW
GetFocus
IsWindow
DestroyWindow
DestroyMenu
CreatePopupMenu
AppendMenuW
GetMenuInfo
SetMenuInfo
GetMenuItemInfoW
SetMenuItemInfoW
WindowFromPoint
ClientToScreen
SendMessageW
GetMonitorInfoW
EndDialog
GetActiveWindow
EnableWindow
DrawEdge
DrawFocusRect
FillRect
GetMenu
AdjustWindowRectEx
GetDlgCtrlID
SetCapture
IsWindowEnabled
UpdateWindow
PtInRect
ReleaseCapture
GetCapture
SetActiveWindow
SystemParametersInfoW
TranslateMessage

gdi32

EnumFontsW
CreateRectRgn
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
CreateCompatibleBitmap
BitBlt
GetObjectW
CombineRgn
SelectClipRgn
GetClipBox
RestoreDC
SaveDC
SetBkColor
SetBkMode
GetTextMetricsW
GetTextExtentPointW
CreateBrushIndirect
CreateDIBSection
GetStockObject
CreateCompatibleDC
CreateRectRgnIndirect
CreateSolidBrush
FrameRgn
CreateFontW
GetTextColor
SetTextColor
ExtTextOutW
GetTextExtentPoint32W

advapi32

GetSidLengthRequired
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW
RegSetValueExW
RegQueryInfoKeyW
GetUserNameW
RegQueryValueExW
RegEnumValueW
SetNamedSecurityInfoW
GetSidSubAuthority
RegSetKeySecurity
SetSecurityDescriptorDacl
RegEnumKeyW
RegGetKeySecurity
InitializeSid
OpenThreadToken
CopySid
GetLengthSid
IsValidSid
AddAce
InitializeAcl
GetTokenInformation
OpenProcessToken
GetSidSubAuthorityCount
GetSidIdentifierAuthority
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
EqualSid
InitializeSecurityDescriptor

shell32

DragQueryFileW
SHLoadInProc
SHAddToRecentDocs
SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
SHEmptyRecycleBinW
DoEnvironmentSubstW

ole32

CLSIDFromString
RegisterDragDrop
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
CoGetInterfaceAndReleaseStream
StringFromCLSID
OleLockRunning
StringFromGUID2
CoCreateInstance
CLSIDFromProgID
CoGetClassObject
OleInitialize
CreateStreamOnHGlobal
OleUninitialize
CoInitializeEx
CoInitialize
CoUninitialize
ReleaseStgMedium

oleaut32

LoadTypeLi
SysStringLen
DispCallFunc
VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
VariantCopy
VarUI4FromStr
VarBstrCmp
SysAllocStringLen
SafeArrayDestroy
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
OleCreateFontIndirect
RegisterTypeLi
UnRegisterTypeLi
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
VarBstrCat
GetErrorInfo
SetErrorInfo
CreateErrorInfo
LoadRegTypeLi
SysFreeString
SysAllocString

Exports

Exports

CanReload
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetUpdaterAPI
GetUrlData
MyUnregisterServer
TBStudioReg

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 431KB - Virtual size: 431KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 254KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
tbhelper.dll
.dll regsvr32 windows:5 windows x86 arch:x86

e82d574d2d41f35c3d992fc491f68703

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c1:77:94:f6:73:7f:04:3a:3c:12:b9:c1:01:89:d7:76:72:0e:da:63
Signer

Actual PE Digest

c1:77:94:f6:73:7f:04:3a:3c:12:b9:c1:01:89:d7:76:72:0e:da:63

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Work\Toolbar\toolbar4\Release_bin\tbhelperU.pdb

Imports

wininet

InternetSetOptionW
InternetQueryOptionW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
FtpOpenFileW
InternetReadFile
FtpGetFileSize
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetOpenW
InternetConnectW
HttpOpenRequestW

rpcrt4

UuidFromStringA

kernel32

IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW
lstrlenW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
MultiByteToWideChar
LoadLibraryExW
lstrcmpiW
GetProcAddress
SetStdHandle
InterlockedIncrement
InterlockedDecrement
TerminateThread
CloseHandle
WaitForSingleObject
OpenThread
GlobalUnlock
GlobalLock
WideCharToMultiByte
WriteFile
CreateFileW
GetCurrentThreadId
lstrlenA
GetStringTypeA
LCMapStringW
LCMapStringA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
SetConsoleCtrlHandler
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
GetTimeZoneInformation
SetEnvironmentVariableA
CreateFileA
FlushFileBuffers
CompareStringA
CompareStringW
RaiseException
GetConsoleCP
SetFilePointer
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
SetHandleCount
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
Sleep
VirtualAlloc
FatalAppExitA
VirtualFree
HeapCreate
GetModuleFileNameA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
ExitThread
CreateThread
GetSystemTimeAsFileTime
GetCommandLineA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetFileType

user32

CharNextW
SendMessageW
CharLowerBuffW
CloseClipboard
GetClipboardData
OpenClipboard
PostMessageW
PeekMessageW
PostThreadMessageW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW

ole32

CoCreateGuid
CoTaskMemFree
CoTaskMemAlloc
CoTaskMemRealloc
StringFromGUID2
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoUninitialize
CoInitialize

oleaut32

VariantClear
VariantInit
VarBstrCmp
UnRegisterTypeLi
SysAllocString
RegisterTypeLi
SysStringLen
LoadTypeLi
LoadRegTypeLi
VarUI4FromStr
SysFreeString

Exports

Exports

CreateHelperObject
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IsUnicode

Sections

.text
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.SHARED
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
toolbar_es.bmp
toolbarconf_es.nsh
uninstall.exe
.exe windows:5 windows x86 arch:x86

9e0fe6f614a50f094b2db57caf915b2f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:9d:ca:e0:f7:03:6b:05:c9:3c:4c:be:ef:25:fd:9a:dc:65:75:91
Signer

Actual PE Digest

10:9d:ca:e0:f7:03:6b:05:c9:3c:4c:be:ef:25:fd:9a:dc:65:75:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Toolbar\toolbar4\Release_bin\uninstall.pdb

Imports

shlwapi

PathFileExistsW

kernel32

InterlockedDecrement
CreateMutexW
GetLastError
GetCommandLineW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
LocalFree
LCMapStringW
LCMapStringA
GetStringTypeW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
Sleep
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryA
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
GetLocaleInfoA
WideCharToMultiByte
GetStringTypeA
MultiByteToWideChar

shell32

CommandLineToArgvW

ole32

CoInitialize
CoUninitialize

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
update.exe
.exe windows:5 windows x86 arch:x86

3044e9862235f798f4a62aaf310c7aea

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15-06-2007 00:00

Not After

14-06-2012 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04-12-2003 00:00

Not After

03-12-2013 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

62:da:e2:5e:76:cc:13:6f:71:4f:3a:e1:67:e2:cb:2b
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

08-09-2011 00:00

Not After

07-09-2012 23:59

Subject

CN=Abingerdale\, Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Abingerdale\, Ltd.,L=London,ST=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08-02-2010 00:00

Not After

07-02-2020 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:a2:74:3b:74:06:69:b0:b0:0a:8c:49:43:39:72:52:18:bd:12:0f
Signer

Actual PE Digest

46:a2:74:3b:74:06:69:b0:b0:0a:8c:49:43:39:72:52:18:bd:12:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Work\Toolbar\toolbar4\release_bin\update.pdb

Imports

setupapi

SetupIterateCabinetW

shell32

CommandLineToArgvW
ShellExecuteW

kernel32

lstrlenW
GetLastError
InterlockedIncrement
InterlockedDecrement
GetProcAddress
FreeLibrary
LoadLibraryW
lstrcpyW
GetFileAttributesW
CreateToolhelp32Snapshot
Process32FirstW
LocalFree
Sleep
CreateMutexW
GetCommandLineW
CreateDirectoryW
CopyFileW
MoveFileW
SetCurrentDirectoryW
DeleteFileW
CloseHandle
CreateFileA
FlushFileBuffers
Process32NextW
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapSize
GetStartupInfoW
HeapFree
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InitializeCriticalSection
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
DeleteCriticalSection
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
RaiseException
LCMapStringA
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSectionAndSpinCount

user32

MessageBoxW
LoadStringW

advapi32

RegQueryValueExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegSetValueExW

ole32

CoInitialize

shlwapi

PathStripPathW

Sections

.text
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
version.txt
videos.png
.png
your_logo.png
.png
uninstaller.exe.nsis

Sharing

General

Malware Config

Signatures

Files

28a099a911237a28521d8b7ea250f089

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

version

Sections

.text Size: 33KB - Virtual size: 32KB

.data Size: 512B - Virtual size: 136B

.rdata Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 3.6MB

.idata Size: 5KB - Virtual size: 4KB

.ndata Size: 1024B - Virtual size: 64KB

.rsrc Size: 17KB - Virtual size: 16KB

bf44c9fb48bb8c36b3e2527e7252350d

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 802B

.data Size: 512B - Virtual size: 142B

.reloc Size: 512B - Virtual size: 200B

7458f96eb10904198d988c72ce690084

Headers

File Characteristics

Imports

comdlg32

gdi32

kernel32

ole32

shell32

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 364B

.rdata Size: 1KB - Virtual size: 1KB

.bss Size: - Virtual size: 8KB

.edata Size: 512B - Virtual size: 112B

.idata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 144B

.reloc Size: 1024B - Virtual size: 892B

38e5d87efd24fb4005f186879a64501c

Headers

File Characteristics

Imports

kernel32

msvcrt

ole32

user32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.data Size: 512B - Virtual size: 16B

.rdata Size: 1024B - Virtual size: 540B

.bss Size: - Virtual size: 284B

.edata Size: 512B - Virtual size: 160B

.idata Size: 1024B - Virtual size: 856B

.reloc Size: 1024B - Virtual size: 624B

4fb4d15e957b6564bf15c23e80f0202a

Headers

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 136B

.rdata
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3.6MB

.idata
Size: 5KB - Virtual size: 4KB

.ndata
Size: 1024B - Virtual size: 64KB

.rsrc
Size: 17KB - Virtual size: 16KB

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 802B

.data
Size: 512B - Virtual size: 142B

.reloc
Size: 512B - Virtual size: 200B

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 364B

.rdata
Size: 1KB - Virtual size: 1KB

.bss
Size: - Virtual size: 8KB

.edata
Size: 512B - Virtual size: 112B

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 144B

.reloc
Size: 1024B - Virtual size: 892B

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 16B

.rdata
Size: 1024B - Virtual size: 540B

.bss
Size: - Virtual size: 284B

.edata
Size: 512B - Virtual size: 160B

.idata
Size: 1024B - Virtual size: 856B

.reloc
Size: 1024B - Virtual size: 624B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 512B - Virtual size: 176B

.bss
Size: - Virtual size: 4KB

.edata
Size: 512B - Virtual size: 363B

.idata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 140B

.reloc
Size: 512B - Virtual size: 416B

.text
Size: 33KB - Virtual size: 32KB

.data
Size: 512B - Virtual size: 136B

.rdata
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3.6MB

.idata
Size: 5KB - Virtual size: 4KB

.ndata
Size: 1024B - Virtual size: 64KB

.rsrc
Size: 17KB - Virtual size: 16KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

15:e5:ac:0a:48:70:63:71:8e:39:da:52:30:1a:04:88
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

d6:9d:9e:9f:6c:25:33:df:fb:03:7b:57:23:0c:0a:9d:e4:e4:2f:81
Signer