2ee73eec87180b36919d773df5666628_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ee73eec87180b36919d773df5666628_JaffaCakes118
Size

3.2MB
MD5

2ee73eec87180b36919d773df5666628
SHA1

710eb24f2240dd0aa4552fbef437a3af52f641ff
SHA256

1253d6e28d6586c62c6885b0de417de84ae374ce91fca40dd817fed53fc3983c
SHA512

3e81ab94643feff0f9f81fbed9a9c366f8e7ddeb8e97d609709d9208adfdbf7fb4770ee99d858ab8107aef7fc96de2e19481331faa26b96e4c337a3da0de801f
SSDEEP

49152:zDORRY80Oi2wLgo5Ny5OnwUJ2owBD+A8+pnQ2hO1KV2/E94J9CtzcqlbpLA:zDwY80hNSOwUJDpAZpnv2KVyJbqllLA

Score

3^/10

Malware Config

Signatures

Unsigned PE 4 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON_2_0_1_1.dll
unpack002/$PLUGINSDIR/System.dll

Files

2ee73eec87180b36919d773df5666628_JaffaCakes118
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:ff:e5:e4:ad:3d:aa:25:07:b0:eb:56:9f:52:bb:40:3b:c9:2c:97
Signer

Actual PE Digest

2b:ff:e5:e4:ad:3d:aa:25:07:b0:eb:56:9f:52:bb:40:3b:c9:2c:97

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 4.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/PublisherLogoDefault.bmp
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/license.txt
$PLUGINSDIR/nsDialogs.dll
.dll windows:5 windows x86 arch:x86

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
MulDiv
lstrlenW
HeapFree
GetProcessHeap
lstrcmpiW
HeapReAlloc
lstrcpynW
GetFileAttributesW
lstrcpyW
GetCurrentDirectoryW
SetCurrentDirectoryW
HeapAlloc
GlobalFree

user32

LoadCursorW
RemovePropW
DrawFocusRect
GetPropW
DrawTextW
GetWindowTextW
GetDlgItem
SetWindowLongW
SetWindowPos
CreateDialogParamW
MapWindowPoints
GetWindowRect
SetCursor
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
GetClientRect
CharPrevW
CallWindowProcW
SetPropW
DestroyWindow
MapDialogRect
CharNextW
SendMessageW
GetWindowLongW

gdi32

SetTextColor

shell32

SHGetPathFromIDListW
SHBrowseForFolderW

comdlg32

GetSaveFileNameW
CommDlgExtendedError
GetOpenFileNameW

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 590B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsIEUtils.dll
.dll windows:5 windows x86 arch:x86

748dbc1e7371c1881c596856d8a01602

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:89:61:7f:8e:b9:8f:58:cf:fa:fc:ff:36:cb:a6:3b:df:3e:6e:13
Signer

Actual PE Digest

0b:89:61:7f:8e:b9:8f:58:cf:fa:fc:ff:36:cb:a6:3b:df:3e:6e:13

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\smartBar\IEToolbar\Dev\6.19\6.19.0\Setup\nsIEUtils\Release\nsIEUtils.pdb

Imports

shlwapi

PathFileExistsW

kernel32

DeleteCriticalSection
CloseHandle
GetLastError
SetLastError
GetVersionExW
LoadLibraryW
GetProcAddress
FreeLibrary
GlobalFree
lstrcpynW
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
EncodePointer
DecodePointer
GetCommandLineA
GetCurrentThreadId
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
HeapSize
Sleep
GetStdHandle
WriteFile
GetModuleFileNameW
HeapFree
HeapAlloc
InterlockedIncrement
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
CreateFileW
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
HeapReAlloc
OutputDebugStringW
LCMapStringW

user32

wsprintfW

shell32

SHCreateDirectoryExW
SHGetFolderPathW

ole32

CoTaskMemFree

Exports

Exports

CreateDir
GetAppDataLocal2
GetWindowsVersion

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsJSON_2_0_1_1.dll
.dll windows:5 windows x86 arch:x86

6a53511d70a353598fbaca220bfb6a3b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\SmartBar\DevelopmentTools\Builders\Plugins\nsJSON\Release Unicode\nsJSON.pdb

Imports

kernel32

MultiByteToWideChar
LocalFree
lstrcpyW
lstrlenW
LocalAlloc
lstrcmpW
CloseHandle
CreateFileW
lstrcatW
WideCharToMultiByte
WriteFile
lstrcmpiW
GlobalFree
lstrcpynW
GlobalAlloc
GetProcessHeap
RtlUnwind
RaiseException
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
IsProcessorFeaturePresent
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapAlloc
Sleep
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetModuleFileNameW
HeapReAlloc
LoadLibraryW
LCMapStringW
GetStringTypeW
WriteConsoleW
SetEndOfFile

user32

wsprintfW

shlwapi

PathFileExistsW

Exports

Exports

Delete
Get
Serialize
Set

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/Free_Lunch_Design_TB/$_127_
$TEMP/sp-downloader.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/01/2013, 00:00

Not After

03/04/2016, 23:59

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:9d:6e:ab:45:67:65:45:1b:6a:2c:40:72:1d:20:11:f4:7b:55:0c
Signer

Actual PE Digest

83:9d:6e:ab:45:67:65:45:1b:6a:2c:40:72:1d:20:11:f4:7b:55:0c

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
lstrlenW
lstrcmpiW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 963B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 588B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

917ae9b9adb269abd5543f5bf5676bac

Code Sign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

37:36:da:15:af:64:76:32:cc:e6:1c:d4:1b:65:77:dd
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

17/02/2010, 00:00

Not After

29/03/2013, 23:59

Subject

CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:a5:24:8b:f6:3f:d7:e8:f0:66:8a:50:51:b3:bc:7c:15:da:0f
Signer

Actual PE Digest

25:cc:a5:24:8b:f6:3f:d7:e8:f0:66:8a:50:51:b3:bc:7c:15:da:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
wcsrchr
wcstoul
memset
wcsstr
wcstol

kernel32

DeleteFileW
WideCharToMultiByte
CreateFileA
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleW
MulDiv
lstrcpyW
GlobalAlloc
LoadLibraryW
GetProcAddress
lstrcmpiW
lstrlenW
WriteFile
ReadFile
lstrcmpW
lstrcpynW
GetLastError
CreateFileW
GlobalFree
CloseHandle
SleepEx
SetFilePointer
GetTickCount
lstrcatW
GetFileSize

user32

MessageBoxW
GetParent
ShowWindow
SetWindowLongW
IsWindow
SetWindowTextW
SendDlgItemMessageW
GetDlgItem
PostMessageW
GetWindowTextW
SendMessageW
SetDlgItemTextW
SetWindowPos
SystemParametersInfoW
GetClientRect
GetWindowRect
SetTimer
LoadIconW
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
IsWindowVisible
EnableWindow
CreateDialogParamW
FindWindowExW
wsprintfA
wsprintfW
GetWindowLongW

wininet

HttpSendRequestW
HttpSendRequestExW
HttpQueryInfoW
FtpCreateDirectoryW
FtpOpenFileW
InternetGetLastResponseInfoW
InternetSetFilePointer
InternetSetOptionW
InternetQueryOptionW
HttpAddRequestHeadersA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestW
HttpAddRequestHeadersW
HttpEndRequestW
InternetConnectW
InternetCrackUrlW
InternetOpenW
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_113_/Tbccint/IE/$_13_/SetupIcon.ico
$_113_/Tbccint/IE/$_13_/UninstallerUI.exe
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ce:2d:ef:49:12:ad:bc:06:fe:96:b5:e8:65:3e:c9:d1:fa:19:5b:28
Signer

Actual PE Digest

ce:2d:ef:49:12:ad:bc:06:fe:96:b5:e8:65:3e:c9:d1:fa:19:5b:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data
.rdata
.reloc
.rsrc/0/version.txt
.rsrc/1033/DIALOG/105
.rsrc/1033/DIALOG/106
.rsrc/1033/DIALOG/111
.rsrc/1033/GROUP_ICON/103
.rsrc/1033/ICON/1.ico
.rsrc/1033/MANIFEST/1
.rsrc_1
.text
CERTIFICATE
[0]
$_113_/Tbccint/Multi/$_13_/SetupIcon.ico
$_113_/Tbccint/Multi/$_13_/UninstallerUI.exe
.exe windows:5 windows x86 arch:x86

be41bf7b8cc010b614bd36bbca606973

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ce:2d:ef:49:12:ad:bc:06:fe:96:b5:e8:65:3e:c9:d1:fa:19:5b:28
Signer

Actual PE Digest

ce:2d:ef:49:12:ad:bc:06:fe:96:b5:e8:65:3e:c9:d1:fa:19:5b:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
lstrcpynA
CloseHandle
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
CreateFileW
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpA
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
lstrlenA
MulDiv
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrlenW

user32

GetAsyncKeyState
IsDlgButtonChecked
ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
wvsprintfW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
FindWindowExW

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 458KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data
.rdata
.reloc
.rsrc/0/version.txt
.rsrc/1033/DIALOG/105
.rsrc/1033/DIALOG/106
.rsrc/1033/DIALOG/111
.rsrc/1033/GROUP_ICON/103
.rsrc/1033/ICON/1.ico
.rsrc/1033/MANIFEST/1
.rsrc_1
.text
CERTIFICATE
[0]
$_127_
$_245_/$_245_/$_250_
.dll regsvr32 windows:5 windows x86 arch:x86

c5170c87bb9e0f4a5d227d9c543b0676

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d9:23:69:5d:24:00:3e:89:51:bf:ab:ea:5b:8f:04:32:e7:a0:46:4a
Signer

Actual PE Digest

d9:23:69:5d:24:00:3e:89:51:bf:ab:ea:5b:8f:04:32:e7:a0:46:4a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\Alert\Alert\Release\Alert.pdb

Imports

winmm

timeGetTime

user32

GetSysColor
ReleaseDC
GetDC
SystemParametersInfoW
RegisterWindowMessageW
MonitorFromRect
EnumChildWindows
SetLayeredWindowAttributes
CreateDialogParamW
DialogBoxParamW
EndDialog
EnableWindow
SetWindowRgn
SetWindowTextW
CopyRect
CharLowerBuffA
GetMonitorInfoA
GetClassNameW
GetIconInfo
GetCapture
SetCapture
ReleaseCapture
GetAsyncKeyState
GetWindowTextW
DrawFocusRect
InflateRect
IsWindowUnicode
GetSystemMetrics
IsChild
DrawIconEx
TranslateMessage
PostMessageA
DispatchMessageW
GetLastInputInfo
SendMessageW
IsWindow
GetDlgItem
SetDlgItemTextW
SetTimer
KillTimer
GetMessageA
DispatchMessageA
SetForegroundWindow
InsertMenuItemW
TrackPopupMenu
GetMenuItemCount
DestroyMenu
CreatePopupMenu
SetFocus
LoadImageW
DestroyIcon
FindWindowExA
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExA
GetClassInfoW
RegisterClassW
GetWindowRgn
GetParent
SetWindowLongA
CallWindowProcA
EndPaint
BeginPaint
SetParent
IsWindowVisible
MoveWindow
LoadCursorA
GetWindowLongW
PtInRect
OffsetRect
FillRect
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
GetWindowRect
GetClientRect
InvalidateRect
DrawTextW
SetWindowPos
CreateWindowExW
CallWindowProcW
DefWindowProcW
FindWindowExW
PostMessageW
wsprintfW
ShowWindow
GetDesktopWindow
FindWindowW
SetWindowLongW
GetWindowLongA
MsgWaitForMultipleObjects
DestroyWindow
CreateWindowExA
DefWindowProcA
PostThreadMessageA
SendMessageA
PeekMessageA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

urlmon

ObtainUserAgentString
URLDownloadToFileW

kernel32

CreateMutexW
CreateThread
TerminateThread
GetExitCodeThread
GetModuleHandleW
GetTickCount
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentThreadId
GetLastError
CloseHandle
ReleaseMutex
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
GetProcessHeap
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStringTypeW
FlushFileBuffers
SetFilePointerEx
GetStartupInfoW
TlsFree
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedIncrement
SetLastError
GetStdHandle
SetStdHandle
GetModuleHandleExW
ExitProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetFileType
GetConsoleCP
ReadConsoleW
GetConsoleMode
HeapReAlloc
HeapAlloc
HeapFree
GetCommandLineA
WriteConsoleW
SetEndOfFile
InterlockedExchange
LoadLibraryExW
ResumeThread
ExitThread
RtlUnwind
RaiseException
DecodePointer
EncodePointer
GetLocalTime
SystemTimeToFileTime
WriteFile
SetFilePointer
CreateDirectoryW
DosDateTimeToFileTime
TlsSetValue
TlsGetValue
TlsAlloc
SetFileTime
LocalFileTimeToFileTime
LoadLibraryA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
Sleep
GetLongPathNameW
SetThreadPriority
GetCurrentThread
SizeofResource
OutputDebugStringW
GetComputerNameW
MoveFileExW
CopyFileW
GetSystemTimeAsFileTime
RemoveDirectoryW
ReadFile
GetFileSize
FindNextFileW
FindFirstFileW
FindClose
CreateFileW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
InterlockedDecrement
LCMapStringW
LoadLibraryExA
HeapSize
MultiByteToWideChar
WideCharToMultiByte
DeleteFileW
GetFileAttributesW
SetFileAttributesW
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
OpenProcess
GetVersionExA
LoadResource
LockResource
LocalAlloc
LocalFree
MulDiv
lstrcpyW
FindResourceW

gdi32

GetObjectA
CombineRgn
SetWindowOrgEx
MoveToEx
SetLayout
LineTo
GetWindowOrgEx
GetDeviceCaps
CreateFontIndirectW
GetBkMode
GetBkColor
SetPixel
SelectPalette
RealizePalette
PlgBlt
GetPixel
GdiFlush
CreateCompatibleBitmap
FrameRgn
CreateRectRgn
GetTextColor
GetLayout
SetTextColor
SetBkColor
Rectangle
ExcludeClipRect
DeleteDC
CreateCompatibleDC
OffsetRgn
BitBlt
SelectObject
RoundRect
DeleteObject
CreateSolidBrush
CreatePen
SetBkMode
GetStockObject

shell32

SHCreateDirectoryExW
ShellExecuteW
SHGetFolderPathW
Shell_NotifyIconW

ole32

IIDFromString
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CLSIDFromString
CoCreateGuid

oleaut32

SysAllocString
SysFreeString
SysStringByteLen
VariantInit
VariantClear
OleLoadPicture
VarBstrCmp
SysStringLen
SysAllocStringByteLen

psapi

GetProcessMemoryInfo

shlwapi

PathFileExistsW

comctl32

_TrackMouseEvent
ord17

wininet

InternetSetOptionW
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCanonicalizeUrlA
InternetCrackUrlW

crypt32

CryptMsgGetParam
CryptMsgClose
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CertGetNameStringW
CryptQueryObject
CertCloseStore

advapi32

InitializeSecurityDescriptor
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyW
RegEnumValueW
RegEnumKeyExW
RegEnumKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyW
RegCreateKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetTokenInformation
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllOnUpdateFinish
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 411KB - Virtual size: 411KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_47_
.dll regsvr32 windows:5 windows x86 arch:x86

52c9dddfb1d6497132c338a22ba3787e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:d0:cd:58:99:38:d6:c5:b0:6e:a7:1b:7c:6b:e1:d5:dd:4d:e8:74
Signer

Actual PE Digest

01:d0:cd:58:99:38:d6:c5:b0:6e:a7:1b:7c:6b:e1:d5:dd:4d:e8:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\Release\tbedrs.pdb

Imports

comctl32

ImageList_Create
ord413
ord410
CreateToolbarEx
InitCommonControlsEx
CreatePropertySheetPageW
PropertySheetW
_TrackMouseEvent
ImageList_ReplaceIcon
ord17

wininet

GetUrlCacheEntryInfoW
InternetOpenUrlW
FindCloseUrlCache
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetCookieW
InternetSetOptionA
InternetCloseHandle
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
InternetSetCookieW
InternetCanonicalizeUrlA
InternetConnectA
InternetGetLastResponseInfoA
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionExA
HttpOpenRequestA
InternetOpenA
InternetCrackUrlA
InternetReadFile
FindNextUrlCacheEntryA
InternetSetOptionW
InternetOpenW
InternetGetConnectedState
InternetQueryOptionA

wsock32

closesocket
WSACleanup
WSAStartup
select
recv
socket
setsockopt
WSAGetLastError
gethostbyname
WSASetLastError
ioctlsocket
htons
connect
send

urlmon

ObtainUserAgentString
URLDownloadToFileW

crypt32

CertFindCertificateInStore
CryptMsgClose
CertCloseStore
CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CryptMsgGetParam
CryptQueryObject
CryptProtectData
CryptUnprotectData

msimg32

GradientFill

winmm

PlaySoundW
sndPlaySoundW
PlaySoundA
timeGetTime

kernel32

HeapSize
ExitProcess
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
WriteConsoleW
GetModuleHandleExW
GetStdHandle
GetFileType
GetConsoleCP
ReadConsoleW
GetConsoleMode
RtlUnwind
RaiseException
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
ExitThread
HeapReAlloc
DecodePointer
EncodePointer
FindResourceW
GetStringTypeW
ResumeThread
SuspendThread
GetThreadPriority
OpenThread
VirtualProtectEx
VirtualAlloc
FlushInstructionCache
VirtualFree
VirtualQuery
IsValidCodePage
ProcessIdToSessionId
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsSetValue
TlsFree
TlsGetValue
TlsAlloc
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
FlushFileBuffers
GetOverlappedResult
WriteFile
SetNamedPipeHandleState
WaitNamedPipeW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Process32NextW
Process32FirstW
OpenProcess
SetThreadPriority
MoveFileExW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
GetFileTime
GetSystemTimeAsFileTime
ReadFile
GlobalLock
GlobalAlloc
GetFileSize
CreateFileW
GlobalFree
GlobalUnlock
GetCurrentThread
GetModuleHandleExA
GetSystemInfo
HeapFree
GetProcessHeap
GetACP
GetOEMCP
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
GetTimeZoneInformation
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
LoadResource
LockResource
FreeResource
GetTempPathW
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
GetLocalTime
GetDateFormatW
GetTimeFormatW
Beep
GetLocaleInfoW
ExpandEnvironmentStringsW
CreateProcessW
lstrlenA
GetVersionExW
LoadLibraryExW
GetCurrentProcess
GetShortPathNameW
GetUserDefaultLCID
GetLongPathNameW
CreateDirectoryW
WaitForMultipleObjects
GetThreadContext
CreateEventA
GetFileAttributesW
GetModuleHandleA
lstrlenW
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
SetLastError
GetSystemDirectoryW
CreateRemoteThread
GetProcAddress
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
CopyFileW
CreateEventW
LocalFree
lstrcpyA
lstrcpyW
InterlockedIncrement
SetEvent
OpenEventW
LoadLibraryW
GetModuleHandleW
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
HeapAlloc
MulDiv
SetFileAttributesW
DeleteFileW
LocalAlloc
CreateMutexW
OpenMutexW
LoadLibraryA
Thread32Next
Thread32First
LoadLibraryExA
SizeofResource
GetComputerNameW
IsWow64Process
GetNativeSystemInfo
GetVersionExA
VerifyVersionInfoW
VerSetConditionMask
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
CreateThread
GetModuleFileNameW
TerminateProcess
WaitForSingleObject
FreeLibrary
InterlockedDecrement
GetTickCount
ReleaseMutex
GetLastError
GetCurrentThreadId
CloseHandle
Sleep
InterlockedExchange

user32

RegisterClassExW
GetClassInfoExW
SetCursor
ReleaseDC
DrawTextW
GetDC
PostMessageA
CallWindowProcA
InvalidateRect
ClientToScreen
GetParent
GetWindowLongW
IsRectEmpty
GetWindowRect
GetClientRect
SetDlgItemTextW
wsprintfW
SetWindowTextA
SetWindowTextW
MoveWindow
ShowWindow
SendMessageA
SetWindowLongW
IsWindow
GetDlgItem
MessageBoxW
PeekMessageW
GetMessageW
LoadCursorW
LoadCursorA
GetDlgCtrlID
SetClassLongA
CopyRect
CloseClipboard
DefWindowProcW
SetPropW
DestroyIcon
InflateRect
SetLayeredWindowAttributes
LoadImageW
GetWindowRgn
MessageBeep
GetActiveWindow
IsDialogMessageW
IsDialogMessageA
SetDlgItemInt
GetKeyState
SetForegroundWindow
GetDlgItemTextA
SetClassLongW
RemovePropW
FrameRect
DrawFrameControl
AllowSetForegroundWindow
DeferWindowPos
DrawEdge
MsgWaitForMultipleObjects
PeekMessageA
PostThreadMessageA
SetParent
GetDlgItemTextW
GetScrollInfo
GetMenuState
SetMenuItemInfoW
EnableMenuItem
DeleteMenu
TrackPopupMenu
InsertMenuItemA
CreatePopupMenu
DestroyMenu
GetMenuItemID
SetMenuInfo
GetMenuInfo
IsMenu
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
CharLowerBuffA
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetUpdateRect
GetCapture
DispatchMessageA
DispatchMessageW
TranslateMessage
ReleaseCapture
GetMessageA
SetCapture
SetActiveWindow
EndPaint
BeginPaint
SetRect
OffsetRect
DrawIconEx
GetIconInfo
SetClipboardData
GetMenuItemRect
FillRect
UnregisterClassA
CheckMenuItem
GetMenuItemInfoW
GetMenuItemCount
PostMessageW
FindWindowExW
GetWindowThreadProcessId
GetForegroundWindow
GetWindowTextLengthW
SendMessageW
EndDialog
FindWindowW
GetWindowTextW
GetAsyncKeyState
GetMenuItemInfoA
GetSystemMetrics
SetWindowRgn
RegisterWindowMessageA
GetClassNameW
DestroyWindow
CreateWindowExW
SetWindowLongA
GetWindowLongA
GetDesktopWindow
IsChild
GetFocus
KillTimer
GetSysColor
IsWindowUnicode
SetWindowPos
RegisterClassW
GetClassInfoW
SetTimer
SetFocus
PtInRect
ScreenToClient
GetCursorPos
IsWindowVisible
SetRectEmpty
CallWindowProcW
GetPropW
SendInput
IsIconic
GetLastInputInfo
RegisterWindowMessageW
MonitorFromRect
GetMonitorInfoA
EnumChildWindows
SystemParametersInfoW
EnumWindows
GetClassNameA
DrawFocusRect
DialogBoxParamW
CreateDialogParamW
SendMessageTimeoutA
DefWindowProcA
CharUpperW
OpenClipboard
EmptyClipboard

gdi32

StretchBlt
SetStretchBltMode
GetStretchBltMode
GetObjectW
FrameRgn
OffsetRgn
SetRectRgn
ExcludeClipRect
TextOutW
SetTextAlign
GetPixel
CombineRgn
BitBlt
CreateCompatibleBitmap
Polygon
GdiFlush
SetPixel
GetObjectA
GetTextAlign
GetLayout
GetTextExtentPoint32W
Rectangle
DeleteDC
CreateCompatibleDC
SetBkColor
GetDIBits
CreateDCW
GetBkColor
GetBkMode
PlgBlt
RealizePalette
SelectPalette
GetTextColor
PtInRegion
GetDeviceCaps
SetLayout
CreateSolidBrush
CreateFontIndirectW
CreateRectRgn
DeleteObject
LineTo
MoveToEx
SelectObject
CreatePen
SetWindowOrgEx
GetWindowOrgEx
SetTextColor
SetBkMode
GetStockObject
RoundRect

comdlg32

GetOpenFileNameW

advapi32

OpenThreadToken
GetUserNameW
DuplicateTokenEx
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExA
RegDeleteKeyA
DeleteAce
LookupAccountSidW
GetAce
SetEntriesInAclA
CryptAcquireContextA
RegNotifyChangeKeyValue
RegOpenCurrentUser
SetNamedSecurityInfoW
GetNamedSecurityInfoW
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
ConvertSidToStringSidA
IsValidSid
ConvertSidToStringSidW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
RegCreateKeyExW
OpenSCManagerA
OpenServiceW
GetSidSubAuthority
GetTokenInformation
ImpersonateLoggedOnUser
CreateProcessAsUserW
GetLengthSid
CreateServiceW
SetTokenInformation
ConvertStringSidToSidW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
CryptDestroyHash
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
DeleteService
StartServiceW
QueryServiceStatus
ControlService
ChangeServiceConfig2W
ChangeServiceConfigW
CloseServiceHandle

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

StringFromIID
CLSIDFromString
IIDFromString
CoCreateInstance
StringFromGUID2
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoCreateGuid
CoGetMalloc
CoUninitialize
OleInitialize
OleUninitialize
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SafeArrayGetLBound
SysStringByteLen
SafeArrayCreateVector
OleLoadPicture
SafeArrayPutElement
SafeArrayCreate
SysAllocStringLen
VarBstrCmp
SysStringLen
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetUBound
SysAllocString
SysFreeString
CreateDispTypeInfo
VariantCopy
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen

psapi

GetProcessImageFileNameW
EnumProcessModules
GetProcessMemoryInfo
EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSQueryUserToken

shlwapi

SHDeleteKeyA
StrCpyW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
UrlEscapeW

dnsapi

DnsQuery_A

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

DLLOnUninstallEraseAll
DLLRunProcessByCommandLine
DLLSetToolbarSearchScopeSuggestionState
DllAddInstalltionGlobalKey
DllBrowserSearchProtectorRevert
DllCallInstallerService
DllCanUnloadNow
DllCheckIfUninstallRevertSettingsNeeded
DllCleanEnableExtensionDoing
DllConnectToIE
DllDeleteOldName
DllEnableExtension
DllExpireSocialCookies
DllGetClassObject
DllGetInstallFileNameExt
DllGetInstallFileNameExtW
DllGetInstallationId
DllGetMachineID
DllGetToolbarHelperPathInLocal
DllHandleUserID
DllHomePageProtectorRevert
DllIsToolbarActuallyVisible
DllModifySearchEngine
DllModifySearchEngineNonSilent
DllModifySearchEngineSilent
DllOnUninstall
DllOnUninstallFromHtmlDialog
DllOnUpdateFinish
DllProxyRegisterServer
DllProxyUnregisterServer
DllRegisterServer
DllRevertIENewTabBehaviour
DllRunBackgroundContainerOnMediumIntegrity
DllRunIEMediumIntegrity
DllRunNonSilentInstall
DllRunServiceInstallation
DllRunServiceInstallationAsyncW
DllSendAutoUpdateRevertLog
DllSendHomepageSetUsage
DllSendInstallationUsage
DllSendToolbarServiceVerificationUsage
DllSetRequiredAppContainerPermissions
DllShowUninstallDialog
DllSingleComponentInstall
DllStopBackgroundContainer
DllUnblockToolbarIfNeeded
DllUninstallService
DllUpdate
DllVerifyEnableExtension
DllWriteSocialCookies
WaitForToolbarHelperTermination

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 845KB - Virtual size: 845KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 474KB - Virtual size: 473KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_59_
.dll regsvr32 windows:5 windows x86 arch:x86

148ef0fdc946707c59b33fca026fb54e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6b:87:cf:46:e3:4a:14:dc:4a:30:a7:91:17:f8:59:47:e9:70:ee:0f
Signer

Actual PE Digest

6b:87:cf:46:e3:4a:14:dc:4a:30:a7:91:17:f8:59:47:e9:70:ee:0f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\ConduitProxy\Release\prxtbedrs.pdb

Imports

kernel32

GetSystemTimeAsFileTime
GetFileSize
CreateFileW
ReadFile
OpenProcess
SetLastError
GetCurrentThreadId
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
SetFilePointer
WriteFile
WaitNamedPipeW
SetNamedPipeHandleState
InterlockedIncrement
FlushFileBuffers
GetComputerNameW
GetStringTypeW
InterlockedExchange
EncodePointer
DecodePointer
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetFileType
LoadLibraryExW
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
ExitProcess
GetModuleHandleExW
HeapSize
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetStdHandle
WriteConsoleW
SetEndOfFile
IsWow64Process
LoadLibraryExA
GetNativeSystemInfo
VerifyVersionInfoW
VerSetConditionMask
GetLongPathNameW
GetCurrentThread
GetModuleHandleExA
HeapFree
GetProcessHeap
HeapAlloc
Sleep
GetModuleHandleW
OutputDebugStringW
Process32Next
Process32First
LocalAlloc
GetVersionExA
CreateMutexW
OpenMutexW
LocalFree
GetTickCount
GetCurrentProcess
CreateToolhelp32Snapshot
FreeLibrary
LoadLibraryW
TerminateProcess
GetLastError
GetCurrentProcessId
CloseHandle
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
WaitForSingleObject
GetProcAddress
GetModuleFileNameW
GetLocalTime
InitializeCriticalSectionAndSpinCount

shlwapi

PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW

user32

IsWindowVisible
PostMessageW
SendMessageA
RegisterWindowMessageW
IsWindow

advapi32

GetSidSubAuthority
RegOpenCurrentUser
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
RegEnumKeyExW
OpenProcessToken
GetLengthSid
GetTokenInformation
GetSidSubAuthorityCount
OpenThreadToken
RegCreateKeyExW
GetUserNameW
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegOpenKeyExW

shell32

SHGetFolderPathW
ShellExecuteExW

ole32

CoTaskMemFree

Exports

Exports

DllCanUnloadNow
DllDeleteOldName
DllGetClassObject
DllGetInstallFileNameExt
DllIsDowngradeVersion
DllIsDowngradeVersionW
DllOnUninstall
DllOnUninstallEraseAll
DllOnUpdateFinish
DllRegisterServer
DllShowToolbarUninstallDialog
DllShowUninstallDialog
DllSingleComponentInstall
DllUnregisterServer

Sections

.text
Size: 276KB - Virtual size: 275KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_63_
.exe windows:5 windows x86 arch:x86

7b25d62fac6a93a74552bdc3dd699b98

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:5f:76:57:84:39:2f:f4:95:71:06:00:45:3a:fd:4c:4f:0f:c9:91
Signer

Actual PE Digest

6c:5f:76:57:84:39:2f:f4:95:71:06:00:45:3a:fd:4c:4f:0f:c9:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\smartBar\IEToolbar\Dev\6.19\6.19.0\ToolbarHelper\Release\ToolbarHelper.pdb

Imports

kernel32

GetCommandLineW
LocalFree
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
WriteConsoleW
SetStdHandle
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
HeapFree
HeapAlloc
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
RtlUnwind
GetStringTypeW
LCMapStringW
LoadLibraryExW
OutputDebugStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
SetFilePointerEx
HeapSize
CloseHandle
CreateFileW

shell32

CommandLineToArgvW

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_64_
.exe windows:5 windows x86 arch:x86

7b25d62fac6a93a74552bdc3dd699b98

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6c:5f:76:57:84:39:2f:f4:95:71:06:00:45:3a:fd:4c:4f:0f:c9:91
Signer

Actual PE Digest

6c:5f:76:57:84:39:2f:f4:95:71:06:00:45:3a:fd:4c:4f:0f:c9:91

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\smartBar\IEToolbar\Dev\6.19\6.19.0\ToolbarHelper\Release\ToolbarHelper.pdb

Imports

kernel32

GetCommandLineW
LocalFree
LoadLibraryW
GetProcAddress
FreeLibrary
WideCharToMultiByte
WriteConsoleW
SetStdHandle
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
SetLastError
GetCurrentThreadId
MultiByteToWideChar
HeapFree
HeapAlloc
RaiseException
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
RtlUnwind
GetStringTypeW
LCMapStringW
LoadLibraryExW
OutputDebugStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
SetFilePointerEx
HeapSize
CloseHandle
CreateFileW

shell32

CommandLineToArgvW

Sections

.text
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_68_
.dll windows:5 windows x86 arch:x86

65fe4d71be75e757f7c3fc7f51ceea9b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ba:2a:69:63:1d:2a:16:b3:bb:5c:ea:9d:b3:b1:4a:4d:37:f7:e3:92
Signer

Actual PE Digest

ba:2a:69:63:1d:2a:16:b3:bb:5c:ea:9d:b3:b1:4a:4d:37:f7:e3:92

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\ConduitLoader\Release\ldrtbedrs.pdb

Imports

kernel32

GetLastError
TerminateProcess
LocalFree
LoadLibraryA
WaitForSingleObject
CreateEventW
LocalAlloc
Sleep
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExA
GetCurrentThread
GetSystemTimeAsFileTime
CreateFileW
ReadFile
OpenProcess
SetLastError
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
SetFilePointer
WriteFile
WaitForMultipleObjects
TerminateThread
SetThreadPriority
SetEvent
WaitNamedPipeW
SetNamedPipeHandleState
InterlockedIncrement
GetLocalTime
FlushFileBuffers
GetStringTypeW
InterlockedExchange
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetConsoleMode
ReadConsoleW
GetConsoleCP
GetFileType
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
HeapSize
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
SetStdHandle
WriteConsoleW
SetEndOfFile
GetComputerNameW
GetCurrentProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
IsWow64Process
GetNativeSystemInfo
GetVersionExA
VerifyVersionInfoW
VerSetConditionMask
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
GetCurrentProcessId
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
GetLongPathNameW
LoadLibraryW
GetModuleHandleW
FreeLibrary
GetTickCount
lstrcpyW
GetCurrentThreadId
GetModuleFileNameW
GetProcAddress
CloseHandle
LoadLibraryExA

user32

SetWindowLongW
ScreenToClient
SendMessageA
GetSysColor
GetParent
RegisterWindowMessageW
ReleaseDC
DrawTextW
GetDC
IsWindowUnicode
PostMessageW
GetClassNameW
MoveWindow
KillTimer
DefWindowProcW
SendMessageW
GetClientRect
RegisterClassW
LoadCursorW
GetClassInfoW
InsertMenuW
ShowWindow
SetWindowPos
GetWindowRect
DestroyWindow
IsWindow
CreateWindowExW
IsChild
GetFocus
SetFocus
SetTimer
IsWindowVisible
PostMessageA
LoadCursorA
DefWindowProcA
GetAsyncKeyState
SetCursor
CallWindowProcA
CallWindowProcW

gdi32

SetBkMode
SetTextColor
SetWindowOrgEx
GetWindowOrgEx
GetStockObject
DeleteDC
BitBlt
SetLayout
CreateCompatibleBitmap
CreateCompatibleDC
GetLayout
Rectangle
CreateSolidBrush
DeleteObject
SelectObject
CreatePen

ole32

CoTaskMemFree
CLSIDFromString
StringFromGUID2

shlwapi

PathFindFileNameW
PathFileExistsW
PathRemoveFileSpecW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
OpenThreadToken
GetSidSubAuthorityCount
GetSidSubAuthority
GetTokenInformation
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetLengthSid
RegCloseKey
CopySid
RegOpenCurrentUser
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
OpenProcessToken
GetUserNameW
RegCreateKeyExW

shell32

SHCreateDirectoryExW
SHGetFolderPathW

Exports

Exports

DllCanUnloadNow
DllDeleteOldName
DllGetClassObject
DllGetInstallFileNameExt
DllOnUninstall
DllOnUninstallEraseAll
DllOnUpdateFinish
DllProxyRegisterServer
DllProxyUnregisterServer
DllShowToolbarUninstallDialog
DllShowUninstallDialog
DllSingleComponentInstall

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_69_
.dll windows:5 windows x86 arch:x86

af29243a09af42773b04e6dff27fba02

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:76:e3:2a:6a:15:8c:c4:2e:c5:60:c2:d7:36:32:94:a2:0e:0d:aa
Signer

Actual PE Digest

27:76:e3:2a:6a:15:8c:c4:2e:c5:60:c2:d7:36:32:94:a2:0e:0d:aa

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\Release\hktbedrs.pdb

Imports

wininet

InternetCanonicalizeUrlA
InternetSetCookieW
InternetGetCookieW

kernel32

ReadConsoleW
GetConsoleCP
RaiseException
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
ExitProcess
HeapSize
LoadLibraryExW
SetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetShortPathNameW
GetLongPathNameW
GetLocaleInfoW
GetUserDefaultLCID
GetModuleFileNameW
ReleaseMutex
GetSystemDirectoryW
WaitForSingleObject
GetLastError
CreateRemoteThread
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
CloseHandle
CreateThread
GetProcAddress
FreeLibrary
LoadLibraryW
GetCurrentThreadId
IsValidCodePage
SetEnvironmentVariableA
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetThreadContext
VirtualQuery
GetCurrentProcess
GetCurrentThread
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
VirtualProtectEx
OpenThread
GetSystemInfo
GetThreadPriority
SuspendThread
ResumeThread
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
OutputDebugStringW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExA
GetNativeSystemInfo
IsWow64Process
CreateToolhelp32Snapshot
Process32First
Process32Next
GetComputerNameW
DeleteCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
TerminateProcess
Module32First
Module32Next
LocalFree
LoadLibraryA
OpenMutexW
CreateMutexW
CreateEventW
OpenEventW
LocalAlloc
DeleteFileW
SetFileAttributesW
MulDiv
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExA
WaitForMultipleObjects
TerminateThread
GetLocalTime
GetDateFormatW
GetTimeFormatW
InterlockedDecrement
GetSystemTimeAsFileTime
GetFileSize
CreateFileW
ReadFile
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
MoveFileExW
InterlockedIncrement
OpenProcess
GetConsoleMode
lstrcpyW
GlobalUnlock
GlobalFree
GlobalAlloc
GlobalLock
SetEvent
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
SetFilePointer
WriteFile
WaitNamedPipeW
SetNamedPipeHandleState
FlushFileBuffers
GetStringTypeW
EncodePointer
DecodePointer
ExitThread
GetCommandLineA
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetACP

user32

DrawTextW
ReleaseDC
RegisterWindowMessageW
FillRect
OffsetRect
GetParent
GetSysColor
ScreenToClient
GetWindowLongW
SetWindowLongW
PostMessageW
SystemParametersInfoW
GetWindowLongA
EnumWindows
IsWindowVisible
SetForegroundWindow
PostMessageA
IsWindowUnicode
DispatchMessageA
KillTimer
SetTimer
DestroyWindow
ShowWindow
MoveWindow
SetLayeredWindowAttributes
DialogBoxParamW
SetWindowLongA
GetDC
DrawFocusRect
InvalidateRect
GetAsyncKeyState
PtInRect
CallWindowProcW
CallWindowProcA
SetCursor
LoadCursorA
CharUpperW
DefWindowProcA
DestroyIcon
LoadImageW
GetIconInfo
DrawIconEx
SendMessageW
GetWindowTextW
GetClientRect
GetWindowRect
SetWindowPos
SetWindowTextW
GetMenuItemCount
GetMenuItemInfoW
CheckMenuItem
GetClassNameW
SendMessageA
EnableWindow
GetWindowTextLengthW
SetRect
EndDialog
GetDlgItem
GetClassInfoW
SetPropW
GetPropW
RegisterClassW
CreateWindowExW
DefWindowProcW
IsWindow
GetMessageA
TranslateMessage
DispatchMessageW
InflateRect
GetWindowThreadProcessId

gdi32

GetObjectA
DeleteObject
CreatePen
SetBkColor
GdiFlush
DeleteDC
SetTextColor
GetTextColor
SetBkMode
CreateFontIndirectW
GetDeviceCaps
SetWindowOrgEx
GetWindowOrgEx
SetLayout
GetStockObject
GetLayout
Rectangle
CreateSolidBrush
LineTo
MoveToEx
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
SetPixel
SelectPalette
RealizePalette
PlgBlt

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHCreateDirectoryExW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
CoCreateGuid
StringFromGUID2

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysStringLen
VariantCopy
OleLoadPicture

psapi

GetModuleFileNameExW
EnumProcesses
GetProcessImageFileNameW
GetProcessMemoryInfo
EnumProcessModules
GetModuleBaseNameW

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
StrCpyW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertFindCertificateInStore
CertGetNameStringA
CryptQueryObject
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptMsgGetParam

comctl32

ord17
_TrackMouseEvent

urlmon

ObtainUserAgentString

gdiplus

GdipFree
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImage
GdipDrawImageRectRect
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdiplusStartup
GdipCreateBitmapFromStream

advapi32

InitializeSecurityDescriptor
GetSidSubAuthorityCount
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
GetLengthSid
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetSecurityDescriptorDacl
SetEntriesInAclW
FreeSid
RegOpenCurrentUser
RegCreateKeyExW
GetUserNameW
OpenProcessToken
GetSidSubAuthority

Exports

Exports

DllConnectToIE

Sections

.text
Size: 696KB - Virtual size: 696KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 163KB - Virtual size: 173KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_70_
.dll windows:5 windows x64 arch:x64

3a44621760b04fca07d1739a443a199f

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2c:60:9e:50:d1:07:f9:34:b0:ac:5e:ae:02:2b:0d:58:04:a9:00:29
Signer

Actual PE Digest

2c:60:9e:50:d1:07:f9:34:b0:ac:5e:ae:02:2b:0d:58:04:a9:00:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\Release\hk64tbedrs.pdb

Imports

wininet

InternetCanonicalizeUrlA
InternetSetCookieW
InternetGetCookieW

kernel32

RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CompareStringW
LCMapStringW
IsValidLocale
EnumSystemLocalesW
ExitProcess
HeapSize
SetLastError
InitializeCriticalSectionAndSpinCount
GetTickCount
GetShortPathNameW
GetLongPathNameW
GetLocaleInfoW
GetUserDefaultLCID
GetModuleFileNameW
ReleaseMutex
K32GetModuleFileNameExW
K32EnumProcessModules
GetSystemDirectoryW
WaitForSingleObject
GetLastError
CreateRemoteThread
GetModuleHandleW
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
GetCurrentProcessId
CloseHandle
CreateThread
GetProcAddress
FreeLibrary
LoadLibraryW
GetCurrentThreadId
IsValidCodePage
GlobalUnlock
SetEnvironmentVariableA
SetEndOfFile
SetStdHandle
GetTimeZoneInformation
SetFilePointerEx
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetThreadContext
VirtualQuery
GetCurrentProcess
GetCurrentThread
VirtualFree
InitializeCriticalSection
Sleep
LeaveCriticalSection
SetThreadPriority
FlushInstructionCache
VirtualAlloc
EnterCriticalSection
VirtualProtectEx
OpenThread
GetSystemInfo
GetThreadPriority
SuspendThread
ResumeThread
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleA
OutputDebugStringW
VerSetConditionMask
VerifyVersionInfoW
GetVersionExA
GetNativeSystemInfo
IsWow64Process
CreateToolhelp32Snapshot
Process32First
Process32Next
GetComputerNameW
DeleteCriticalSection
FindResourceW
LoadResource
LockResource
SizeofResource
TerminateProcess
Module32First
Module32Next
LocalFree
LoadLibraryA
OpenMutexW
CreateMutexW
CreateEventW
OpenEventW
LocalAlloc
DeleteFileW
SetFileAttributesW
MulDiv
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExA
WaitForMultipleObjects
TerminateThread
GetLocalTime
GetDateFormatW
GetTimeFormatW
GetSystemTimeAsFileTime
GetFileSize
CreateFileW
ReadFile
FindFirstFileW
RemoveDirectoryW
FindNextFileW
FindClose
MoveFileExW
OpenProcess
lstrcpyW
RaiseException
GlobalFree
GlobalAlloc
GlobalLock
SetEvent
TlsAlloc
TlsGetValue
TlsFree
TlsSetValue
SetFilePointer
WriteFile
WaitNamedPipeW
SetNamedPipeHandleState
FlushFileBuffers
GetStringTypeW
EncodePointer
DecodePointer
ExitThread
LoadLibraryExW
GetCommandLineA
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
IsDebuggerPresent
IsProcessorFeaturePresent
HeapReAlloc
GetConsoleMode
ReadConsoleW
GetConsoleCP
RtlPcToFileHeader
GetACP

user32

DrawTextW
ReleaseDC
RegisterWindowMessageW
FillRect
OffsetRect
GetParent
GetSysColor
ScreenToClient
GetWindowLongW
SetWindowLongW
PostMessageW
SystemParametersInfoW
GetWindowLongA
EnumWindows
IsWindowVisible
SetForegroundWindow
PostMessageA
IsWindowUnicode
DispatchMessageA
KillTimer
SetTimer
DestroyWindow
ShowWindow
MoveWindow
SetLayeredWindowAttributes
DialogBoxParamW
SetWindowLongA
SetWindowLongPtrW
GetDC
DrawFocusRect
InvalidateRect
GetAsyncKeyState
PtInRect
CallWindowProcW
CallWindowProcA
SetCursor
LoadCursorA
CharUpperW
DefWindowProcA
DestroyIcon
LoadImageW
GetIconInfo
DrawIconEx
SendMessageW
GetWindowTextW
GetClientRect
GetWindowRect
SetWindowPos
SetWindowTextW
GetMenuItemCount
GetMenuItemInfoW
CheckMenuItem
GetClassNameW
SendMessageA
EnableWindow
GetWindowTextLengthW
SetRect
EndDialog
GetDlgItem
GetClassInfoW
SetPropW
GetPropW
RegisterClassW
CreateWindowExW
DefWindowProcW
IsWindow
GetMessageA
TranslateMessage
DispatchMessageW
InflateRect
GetWindowThreadProcessId

gdi32

GetObjectA
DeleteObject
DeleteDC
CreatePen
SetBkColor
GdiFlush
BitBlt
SetTextColor
GetTextColor
SetBkMode
CreateFontIndirectW
GetDeviceCaps
SetWindowOrgEx
GetWindowOrgEx
SetLayout
GetStockObject
GetLayout
Rectangle
CreateSolidBrush
LineTo
MoveToEx
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
GetPixel
SetPixel
SelectPalette
RealizePalette
PlgBlt

shell32

ShellExecuteW
ShellExecuteExW
SHGetFolderPathW
SHCreateDirectoryExW

ole32

CoUninitialize
CoInitialize
CreateStreamOnHGlobal
CoCreateInstance
CoTaskMemFree
CoCreateGuid
StringFromGUID2

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
SysStringByteLen
SysAllocStringByteLen
VarBstrCmp
SysStringLen
VariantCopy
OleLoadPicture

psapi

EnumProcesses
EnumProcessModules
GetProcessImageFileNameW
GetProcessMemoryInfo
GetModuleBaseNameW

shlwapi

PathRemoveFileSpecW
PathFindFileNameW
PathFileExistsW
StrCpyW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertGetNameStringA
CryptQueryObject
CryptMsgClose
CertGetNameStringW
CertFreeCertificateContext
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore

comctl32

_TrackMouseEvent
ord17

urlmon

ObtainUserAgentString

gdiplus

GdipFree
GdipAlloc
GdipCreateFromHDC
GdipDeleteGraphics
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipDisposeImage
GdipDrawImageRectRect
GdipCloneImage
GdipGetImageWidth
GdipGetImageHeight
GdipCreateBitmapFromFile
GdiplusStartup
GdipCreateBitmapFromStream

advapi32

InitializeSecurityDescriptor
GetSidSubAuthorityCount
OpenThreadToken
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteKeyW
CopySid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSidSubAuthority
GetTokenInformation
GetLengthSid
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
AllocateAndInitializeSid
GetSecurityDescriptorDacl
SetEntriesInAclW
FreeSid
RegOpenCurrentUser
RegCreateKeyExW
GetUserNameW
OpenProcessToken

Exports

Exports

DllConnectToIE

Sections

.text
Size: 782KB - Virtual size: 781KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 190KB - Virtual size: 202KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

SHARED
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_71_
.dll windows:6 windows x86 arch:x86

69e48d0f88e508d867865306d28a465c

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1e:91:29:94:1b:6f:ff:2a:90:a8:b1:73:93:16:79:22:fd:f9:b3:2d
Signer

Actual PE Digest

1e:91:29:94:1b:6f:ff:2a:90:a8:b1:73:93:16:79:22:fd:f9:b3:2d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\ToolbarBroker\Release\sctbedrs.pdb

Imports

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

kernel32

GetSystemDirectoryW
GetSystemInfo
lstrlenW
LocalAlloc
LocalFree
WaitForMultipleObjects
GetOverlappedResult
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetProcessImageFileNameW
GetCurrentProcessId
GetNativeSystemInfo
GetModuleHandleW
GetVersionExW
GetLongPathNameW
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
WriteConsoleW
SetStdHandle
K32GetModuleFileNameExW
K32EnumProcessModules
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
FreeLibrary
GetProcAddress
LoadLibraryW
CreateThread
GetModuleFileNameW
TerminateThread
WaitForSingleObject
GetCommandLineW
GetFullPathNameW
ReleaseMutex
CreateMutexW
CreateNamedPipeW
GetLastError
CreateEventW
SetEvent
OpenEventW
CloseHandle
GetCurrentProcess
DuplicateHandle
OpenProcess
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
HeapSize
ExitProcess
GetStdHandle
GetStringTypeW
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
Sleep
GetCommandLineA
GetCurrentThreadId
ExitThread
LoadLibraryExW
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent

user32

PostMessageW

advapi32

OpenProcessToken
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
GetTokenInformation
GetLengthSid
GetSidSubAuthorityCount
CopySid
GetSidSubAuthority
OpenThreadToken
RegOpenCurrentUser
RegQueryValueExW
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW

shell32

CommandLineToArgvW
ShellExecuteExW

ole32

CoGetMalloc
StringFromIID
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString

shlwapi

PathStripPathW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW

Exports

Exports

DllInjectBroker
DllRegisterToolbar

Sections

.text
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_72_
.dll windows:6 windows x64 arch:x64

0128fd8c9dd22c678e9f61d4212b3634

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c6:13:7c:cf:f6:ae:83:4b:a6:0d:9f:14:2f:ac:96:28:22:b4:52:b7
Signer

Actual PE Digest

c6:13:7c:cf:f6:ae:83:4b:a6:0d:9f:14:2f:ac:96:28:22:b4:52:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\ToolbarBroker\x64\Release x64\sc64tbedrs.pdb

Imports

crypt32

CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

kernel32

GetSystemDirectoryW
GetSystemInfo
lstrlenW
LocalAlloc
LocalFree
WaitForMultipleObjects
GetOverlappedResult
FlushFileBuffers
DisconnectNamedPipe
ConnectNamedPipe
ReadFile
WriteFile
MultiByteToWideChar
WideCharToMultiByte
HeapAlloc
GetProcessHeap
HeapFree
GetModuleHandleExW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetProcessImageFileNameW
GetCurrentProcessId
GetNativeSystemInfo
GetModuleHandleW
GetVersionExW
GetLongPathNameW
CreateFileW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThread
InitializeCriticalSectionAndSpinCount
WriteConsoleW
SetStdHandle
K32GetModuleFileNameExW
K32EnumProcessModules
CreateRemoteThread
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
FreeLibrary
GetProcAddress
LoadLibraryW
CreateThread
GetModuleFileNameW
TerminateThread
WaitForSingleObject
GetCommandLineW
GetFullPathNameW
ReleaseMutex
CreateMutexW
CreateNamedPipeW
GetLastError
CreateEventW
SetEvent
OpenEventW
CloseHandle
GetCurrentProcess
DuplicateHandle
OpenProcess
SetFilePointerEx
GetConsoleMode
GetConsoleCP
OutputDebugStringW
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
HeapSize
ExitProcess
GetStdHandle
GetStringTypeW
EncodePointer
DecodePointer
Sleep
GetCommandLineA
GetCurrentThreadId
ExitThread
LoadLibraryExW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
IsDebuggerPresent

user32

PostMessageW

advapi32

OpenProcessToken
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegSetValueExW
GetTokenInformation
GetLengthSid
GetSidSubAuthorityCount
CopySid
GetSidSubAuthority
OpenThreadToken
RegOpenCurrentUser
RegQueryValueExW
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW

shell32

ShellExecuteExW
CommandLineToArgvW

ole32

CoGetMalloc
StringFromIID
CoInitialize
CoCreateInstance
CoUninitialize
CLSIDFromString

shlwapi

PathStripPathW
PathRemoveFileSpecW
PathFileExistsW
PathFindFileNameW

Exports

Exports

DllInjectBroker
DllRegisterToolbar

Sections

.text
Size: 236KB - Virtual size: 235KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_84_
.dll regsvr32 windows:5 windows x86 arch:x86

52c9dddfb1d6497132c338a22ba3787e

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

03/02/2014, 00:00

Not After

04/02/2016, 23:59

Subject

CN=ClientConnect LTD,OU=Trovi TB+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ClientConnect LTD,L=Ness Ziona,ST=Israel,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

01:d0:cd:58:99:38:d6:c5:b0:6e:a7:1b:7c:6b:e1:d5:dd:4d:e8:74
Signer

Actual PE Digest

01:d0:cd:58:99:38:d6:c5:b0:6e:a7:1b:7c:6b:e1:d5:dd:4d:e8:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\Builds\94\SmartBar\IE Build 6.23.0\Sources\Release\tbedrs.pdb

Imports

comctl32

ImageList_Create
ord413
ord410
CreateToolbarEx
InitCommonControlsEx
CreatePropertySheetPageW
PropertySheetW
_TrackMouseEvent
ImageList_ReplaceIcon
ord17

wininet

GetUrlCacheEntryInfoW
InternetOpenUrlW
FindCloseUrlCache
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetGetCookieW
InternetSetOptionA
InternetCloseHandle
DeleteUrlCacheEntry
FindFirstUrlCacheEntryA
InternetSetCookieW
InternetCanonicalizeUrlA
InternetConnectA
InternetGetLastResponseInfoA
HttpQueryInfoA
HttpSendRequestA
InternetSetOptionExA
HttpOpenRequestA
InternetOpenA
InternetCrackUrlA
InternetReadFile
FindNextUrlCacheEntryA
InternetSetOptionW
InternetOpenW
InternetGetConnectedState
InternetQueryOptionA

wsock32

closesocket
WSACleanup
WSAStartup
select
recv
socket
setsockopt
WSAGetLastError
gethostbyname
WSASetLastError
ioctlsocket
htons
connect
send

urlmon

ObtainUserAgentString
URLDownloadToFileW

crypt32

CertFindCertificateInStore
CryptMsgClose
CertCloseStore
CertGetNameStringW
CertGetNameStringA
CertFreeCertificateContext
CryptMsgGetParam
CryptQueryObject
CryptProtectData
CryptUnprotectData

msimg32

GradientFill

winmm

PlaySoundW
sndPlaySoundW
PlaySoundA
timeGetTime

kernel32

HeapSize
ExitProcess
EnumSystemLocalesW
IsValidLocale
LCMapStringW
CompareStringW
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
WriteConsoleW
GetModuleHandleExW
GetStdHandle
GetFileType
GetConsoleCP
ReadConsoleW
GetConsoleMode
RtlUnwind
RaiseException
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
ExitThread
HeapReAlloc
DecodePointer
EncodePointer
FindResourceW
GetStringTypeW
ResumeThread
SuspendThread
GetThreadPriority
OpenThread
VirtualProtectEx
VirtualAlloc
FlushInstructionCache
VirtualFree
VirtualQuery
IsValidCodePage
ProcessIdToSessionId
SetFilePointer
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
TlsSetValue
TlsFree
TlsGetValue
TlsAlloc
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
FlushFileBuffers
GetOverlappedResult
WriteFile
SetNamedPipeHandleState
WaitNamedPipeW
UnmapViewOfFile
MapViewOfFile
OpenFileMappingW
CreateFileMappingW
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
Process32NextW
Process32FirstW
OpenProcess
SetThreadPriority
MoveFileExW
FindClose
FindNextFileW
RemoveDirectoryW
FindFirstFileW
GetFileTime
GetSystemTimeAsFileTime
ReadFile
GlobalLock
GlobalAlloc
GetFileSize
CreateFileW
GlobalFree
GlobalUnlock
GetCurrentThread
GetModuleHandleExA
GetSystemInfo
HeapFree
GetProcessHeap
GetACP
GetOEMCP
GetModuleFileNameA
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointerEx
GetTimeZoneInformation
SetStdHandle
SetEndOfFile
SetEnvironmentVariableA
LoadResource
LockResource
FreeResource
GetTempPathW
InitializeCriticalSectionAndSpinCount
SystemTimeToFileTime
GetLocalTime
GetDateFormatW
GetTimeFormatW
Beep
GetLocaleInfoW
ExpandEnvironmentStringsW
CreateProcessW
lstrlenA
GetVersionExW
LoadLibraryExW
GetCurrentProcess
GetShortPathNameW
GetUserDefaultLCID
GetLongPathNameW
CreateDirectoryW
WaitForMultipleObjects
GetThreadContext
CreateEventA
GetFileAttributesW
GetModuleHandleA
lstrlenW
TerminateThread
MultiByteToWideChar
WideCharToMultiByte
SetLastError
GetSystemDirectoryW
CreateRemoteThread
GetProcAddress
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
CopyFileW
CreateEventW
LocalFree
lstrcpyA
lstrcpyW
InterlockedIncrement
SetEvent
OpenEventW
LoadLibraryW
GetModuleHandleW
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcessId
HeapAlloc
MulDiv
SetFileAttributesW
DeleteFileW
LocalAlloc
CreateMutexW
OpenMutexW
LoadLibraryA
Thread32Next
Thread32First
LoadLibraryExA
SizeofResource
GetComputerNameW
IsWow64Process
GetNativeSystemInfo
GetVersionExA
VerifyVersionInfoW
VerSetConditionMask
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
OutputDebugStringW
CreateThread
GetModuleFileNameW
TerminateProcess
WaitForSingleObject
FreeLibrary
InterlockedDecrement
GetTickCount
ReleaseMutex
GetLastError
GetCurrentThreadId
CloseHandle
Sleep
InterlockedExchange

user32

RegisterClassExW
GetClassInfoExW
SetCursor
ReleaseDC
DrawTextW
GetDC
PostMessageA
CallWindowProcA
InvalidateRect
ClientToScreen
GetParent
GetWindowLongW
IsRectEmpty
GetWindowRect
GetClientRect
SetDlgItemTextW
wsprintfW
SetWindowTextA
SetWindowTextW
MoveWindow
ShowWindow
SendMessageA
SetWindowLongW
IsWindow
GetDlgItem
MessageBoxW
PeekMessageW
GetMessageW
LoadCursorW
LoadCursorA
GetDlgCtrlID
SetClassLongA
CopyRect
CloseClipboard
DefWindowProcW
SetPropW
DestroyIcon
InflateRect
SetLayeredWindowAttributes
LoadImageW
GetWindowRgn
MessageBeep
GetActiveWindow
IsDialogMessageW
IsDialogMessageA
SetDlgItemInt
GetKeyState
SetForegroundWindow
GetDlgItemTextA
SetClassLongW
RemovePropW
FrameRect
DrawFrameControl
AllowSetForegroundWindow
DeferWindowPos
DrawEdge
MsgWaitForMultipleObjects
PeekMessageA
PostThreadMessageA
SetParent
GetDlgItemTextW
GetScrollInfo
GetMenuState
SetMenuItemInfoW
EnableMenuItem
DeleteMenu
TrackPopupMenu
InsertMenuItemA
CreatePopupMenu
DestroyMenu
GetMenuItemID
SetMenuInfo
GetMenuInfo
IsMenu
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
CharLowerBuffA
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetUpdateRect
GetCapture
DispatchMessageA
DispatchMessageW
TranslateMessage
ReleaseCapture
GetMessageA
SetCapture
SetActiveWindow
EndPaint
BeginPaint
SetRect
OffsetRect
DrawIconEx
GetIconInfo
SetClipboardData
GetMenuItemRect
FillRect
UnregisterClassA
CheckMenuItem
GetMenuItemInfoW
GetMenuItemCount
PostMessageW
FindWindowExW
GetWindowThreadProcessId
GetForegroundWindow
GetWindowTextLengthW
SendMessageW
EndDialog
FindWindowW
GetWindowTextW
GetAsyncKeyState
GetMenuItemInfoA
GetSystemMetrics
SetWindowRgn
RegisterWindowMessageA
GetClassNameW
DestroyWindow
CreateWindowExW
SetWindowLongA
GetWindowLongA
GetDesktopWindow
IsChild
GetFocus
KillTimer
GetSysColor
IsWindowUnicode
SetWindowPos
RegisterClassW
GetClassInfoW
SetTimer
SetFocus
PtInRect
ScreenToClient
GetCursorPos
IsWindowVisible
SetRectEmpty
CallWindowProcW
GetPropW
SendInput
IsIconic
GetLastInputInfo
RegisterWindowMessageW
MonitorFromRect
GetMonitorInfoA
EnumChildWindows
SystemParametersInfoW
EnumWindows
GetClassNameA
DrawFocusRect
DialogBoxParamW
CreateDialogParamW
SendMessageTimeoutA
DefWindowProcA
CharUpperW
OpenClipboard
EmptyClipboard

gdi32

StretchBlt
SetStretchBltMode
GetStretchBltMode
GetObjectW
FrameRgn
OffsetRgn
SetRectRgn
ExcludeClipRect
TextOutW
SetTextAlign
GetPixel
CombineRgn
BitBlt
CreateCompatibleBitmap
Polygon
GdiFlush
SetPixel
GetObjectA
GetTextAlign
GetLayout
GetTextExtentPoint32W
Rectangle
DeleteDC
CreateCompatibleDC
SetBkColor
GetDIBits
CreateDCW
GetBkColor
GetBkMode
PlgBlt
RealizePalette
SelectPalette
GetTextColor
PtInRegion
GetDeviceCaps
SetLayout
CreateSolidBrush
CreateFontIndirectW
CreateRectRgn
DeleteObject
LineTo
MoveToEx
SelectObject
CreatePen
SetWindowOrgEx
GetWindowOrgEx
SetTextColor
SetBkMode
GetStockObject
RoundRect

comdlg32

GetOpenFileNameW

advapi32

OpenThreadToken
GetUserNameW
DuplicateTokenEx
RegSetValueExW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExA
RegDeleteKeyA
DeleteAce
LookupAccountSidW
GetAce
SetEntriesInAclA
CryptAcquireContextA
RegNotifyChangeKeyValue
RegOpenCurrentUser
SetNamedSecurityInfoW
GetNamedSecurityInfoW
FreeSid
SetEntriesInAclW
GetSecurityDescriptorDacl
AllocateAndInitializeSid
SetSecurityDescriptorSacl
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
ConvertSidToStringSidA
IsValidSid
ConvertSidToStringSidW
RegEnumValueW
RegEnumKeyExW
RegDeleteValueW
RegEnumKeyW
RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthorityCount
RegCreateKeyExW
OpenSCManagerA
OpenServiceW
GetSidSubAuthority
GetTokenInformation
ImpersonateLoggedOnUser
CreateProcessAsUserW
GetLengthSid
CreateServiceW
SetTokenInformation
ConvertStringSidToSidW
CryptGetHashParam
CryptHashData
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
CryptDestroyHash
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
DeleteService
StartServiceW
QueryServiceStatus
ControlService
ChangeServiceConfig2W
ChangeServiceConfigW
CloseServiceHandle

shell32

SHCreateDirectoryExW
SHGetFolderPathW
ShellExecuteW
ShellExecuteExW

ole32

StringFromIID
CLSIDFromString
IIDFromString
CoCreateInstance
StringFromGUID2
CoInitialize
CoTaskMemFree
CreateStreamOnHGlobal
CoInitializeEx
CoCreateGuid
CoGetMalloc
CoUninitialize
OleInitialize
OleUninitialize
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SafeArrayGetLBound
SysStringByteLen
SafeArrayCreateVector
OleLoadPicture
SafeArrayPutElement
SafeArrayCreate
SysAllocStringLen
VarBstrCmp
SysStringLen
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayGetUBound
SysAllocString
SysFreeString
CreateDispTypeInfo
VariantCopy
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen

psapi

GetProcessImageFileNameW
EnumProcessModules
GetProcessMemoryInfo
EnumProcesses
GetModuleBaseNameW
GetModuleFileNameExW

wtsapi32

WTSEnumerateSessionsA
WTSQuerySessionInformationW
WTSQueryUserToken

shlwapi

SHDeleteKeyA
StrCpyW
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
UrlEscapeW

dnsapi

DnsQuery_A

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

DLLOnUninstallEraseAll
DLLRunProcessByCommandLine
DLLSetToolbarSearchScopeSuggestionState
DllAddInstalltionGlobalKey
DllBrowserSearchProtectorRevert
DllCallInstallerService
DllCanUnloadNow
DllCheckIfUninstallRevertSettingsNeeded
DllCleanEnableExtensionDoing
DllConnectToIE
DllDeleteOldName
DllEnableExtension
DllExpireSocialCookies
DllGetClassObject
DllGetInstallFileNameExt
DllGetInstallFileNameExtW
DllGetInstallationId
DllGetMachineID
DllGetToolbarHelperPathInLocal
DllHandleUserID
DllHomePageProtectorRevert
DllIsToolbarActuallyVisible
DllModifySearchEngine
DllModifySearchEngineNonSilent
DllModifySearchEngineSilent
DllOnUninstall
DllOnUninstallFromHtmlDialog
DllOnUpdateFinish
DllProxyRegisterServer
DllProxyUnregisterServer
DllRegisterServer
DllRevertIENewTabBehaviour
DllRunBackgroundContainerOnMediumIntegrity
DllRunIEMediumIntegrity
DllRunNonSilentInstall
DllRunServiceInstallation
DllRunServiceInstallationAsyncW
DllSendAutoUpdateRevertLog
DllSendHomepageSetUsage
DllSendInstallationUsage
DllSendToolbarServiceVerificationUsage
DllSetRequiredAppContainerPermissions
DllShowUninstallDialog
DllSingleComponentInstall
DllStopBackgroundContainer
DllUnblockToolbarIfNeeded
DllUninstallService
DllUpdate
DllVerifyEnableExtension
DllWriteSocialCookies
WaitForToolbarHelperTermination

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 845KB - Virtual size: 845KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 187KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

SHARED
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 474KB - Virtual size: 473KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 315KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9fCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

2b:ff:e5:e4:ad:3d:aa:25:07:b0:eb:56:9f:52:bb:40:3b:c9:2c:97Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 25KB - Virtual size: 24KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 409KB

.ndata Size: - Virtual size: 4.5MB

.rsrc Size: 4KB - Virtual size: 3KB

039bcbc605477e8e87ec550c2e60e748

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 963B

.data Size: 512B - Virtual size: 64B

.reloc Size: 1024B - Virtual size: 588B

9ea5bdc8c90dfcffe309465c26c89758

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: - Virtual size: 48B

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 590B

748dbc1e7371c1881c596856d8a01602

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9fCertificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

2b:ff:e5:e4:ad:3d:aa:25:07:b0:eb:56:9f:52:bb:40:3b:c9:2c:97
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 4.5MB

.rsrc
Size: 4KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 963B

.data
Size: 512B - Virtual size: 64B

.reloc
Size: 1024B - Virtual size: 588B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: - Virtual size: 48B

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 590B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

43:e7:73:8e:28:2f:77:36:9a:5a:4c:0e:d3:1a:3c:9f
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

0b:89:61:7f:8e:b9:8f:58:cf:fa:fc:ff:36:cb:a6:3b:df:3e:6e:13
Signer

.text
Size: 37KB - Virtual size: 36KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 15KB - Virtual size: 14KB

.text
Size: 54KB - Virtual size: 54KB

.rdata
Size: 14KB - Virtual size: 14KB

.data
Size: 4KB - Virtual size: 11KB

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 6KB - Virtual size: 5KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

83:9d:6e:ab:45:67:65:45:1b:6a:2c:40:72:1d:20:11:f4:7b:55:0c
Signer

.text
Size: 25KB - Virtual size: 24KB