General

Malware Config

Signatures

Files

• 6a37efdff304091d8c708f2ae57be4ed_JaffaCakes118

  .exe windows:5 windows x86 arch:x86

  32f3282581436269b3a75b6675fe3e08

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  63:7f:fb:b8:d2:33:1a:b7:44:d2:a2:c8:da:a1:2f:2b:51:18:ce:f3

  Signer

  Actual PE Digest

  63:7f:fb:b8:d2:33:1a:b7:44:d2:a2:c8:da:a1:2f:2b:51:18:ce:f3

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  CloseHandle

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrcpynA

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 415KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 9.9MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 17KB - Virtual size: 17KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/$_354_/ProxyInstaller.exe

  .exe windows:5 windows x86 arch:x86

  32f3282581436269b3a75b6675fe3e08

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  be:2d:6a:aa:de:b7:f5:1a:39:5d:96:57:00:eb:5f:02:32:75:61:1f

  Signer

  Actual PE Digest

  be:2d:6a:aa:de:b7:f5:1a:39:5d:96:57:00:eb:5f:02:32:75:61:1f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  CloseHandle

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrcpynA

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 415KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 3.8MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/$_355_/BI.exe

  .exe windows:5 windows x86 arch:x86

  32f3282581436269b3a75b6675fe3e08

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  7e:76:92:27:b7:81:25:55:e5:75:62:90:c6:1b:ce:13:2a:c3:15:56

  Signer

  Actual PE Digest

  7e:76:92:27:b7:81:25:55:e5:75:62:90:c6:1b:ce:13:2a:c3:15:56

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  CloseHandle

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrcpynA

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 415KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 1.3MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/$_356_/DownloadAcc.exe

  .exe windows:5 windows x86 arch:x86

  32f3282581436269b3a75b6675fe3e08

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  82:10:7b:3d:35:7d:ff:fd:0d:53:0c:f4:5c:da:b3:5d:5b:51:89:e1

  Signer

  Actual PE Digest

  82:10:7b:3d:35:7d:ff:fd:0d:53:0c:f4:5c:da:b3:5d:5b:51:89:e1

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  SetFileTime

  CompareFileTime

  SearchPathW

  GetShortPathNameW

  GetFullPathNameW

  MoveFileW

  SetCurrentDirectoryW

  GetFileAttributesW

  GetLastError

  CreateDirectoryW

  SetFileAttributesW

  Sleep

  GetTickCount

  CreateFileW

  GetFileSize

  GetModuleFileNameW

  GetCurrentProcess

  CopyFileW

  ExitProcess

  GetWindowsDirectoryW

  GetTempPathW

  GetCommandLineW

  SetErrorMode

  CloseHandle

  lstrlenW

  lstrcpynW

  GetDiskFreeSpaceW

  GlobalUnlock

  GlobalLock

  CreateThread

  LoadLibraryW

  CreateProcessW

  lstrcmpiA

  GetTempFileNameW

  lstrcatW

  GetProcAddress

  LoadLibraryA

  GetModuleHandleA

  OpenProcess

  lstrcpyW

  GetVersionExW

  GetSystemDirectoryW

  GetVersion

  lstrcpyA

  RemoveDirectoryW

  lstrcmpA

  lstrcmpiW

  lstrcmpW

  ExpandEnvironmentStringsW

  GlobalAlloc

  WaitForSingleObject

  GetExitCodeProcess

  GlobalFree

  GetModuleHandleW

  LoadLibraryExW

  FreeLibrary

  WritePrivateProfileStringW

  GetPrivateProfileStringW

  WideCharToMultiByte

  lstrlenA

  MulDiv

  WriteFile

  ReadFile

  MultiByteToWideChar

  SetFilePointer

  FindClose

  FindNextFileW

  FindFirstFileW

  DeleteFileW

  lstrcpynA

  user32

  GetAsyncKeyState

  IsDlgButtonChecked

  ScreenToClient

  GetMessagePos

  CallWindowProcW

  IsWindowVisible

  LoadBitmapW

  CloseClipboard

  SetClipboardData

  EmptyClipboard

  OpenClipboard

  TrackPopupMenu

  GetWindowRect

  AppendMenuW

  CreatePopupMenu

  GetSystemMetrics

  EndDialog

  EnableMenuItem

  GetSystemMenu

  SetClassLongW

  IsWindowEnabled

  SetWindowPos

  DialogBoxParamW

  CheckDlgButton

  CreateWindowExW

  SystemParametersInfoW

  RegisterClassW

  SetDlgItemTextW

  GetDlgItemTextW

  MessageBoxIndirectW

  CharNextA

  CharUpperW

  CharPrevW

  wvsprintfW

  DispatchMessageW

  PeekMessageW

  wsprintfA

  DestroyWindow

  CreateDialogParamW

  SetTimer

  SetWindowTextW

  PostQuitMessage

  SetForegroundWindow

  ShowWindow

  wsprintfW

  SendMessageTimeoutW

  LoadCursorW

  SetCursor

  GetWindowLongW

  GetSysColor

  CharNextW

  GetClassInfoW

  ExitWindowsEx

  IsWindow

  GetDlgItem

  SetWindowLongW

  LoadImageW

  GetDC

  EnableWindow

  InvalidateRect

  SendMessageW

  DefWindowProcW

  BeginPaint

  GetClientRect

  FillRect

  DrawTextW

  EndPaint

  FindWindowExW

  gdi32

  SetBkColor

  GetDeviceCaps

  DeleteObject

  CreateBrushIndirect

  CreateFontIndirectW

  SetBkMode

  SetTextColor

  SelectObject

  shell32

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHGetFileInfoW

  ShellExecuteW

  SHFileOperationW

  SHGetSpecialFolderLocation

  advapi32

  RegEnumKeyW

  RegOpenKeyExW

  RegCloseKey

  RegDeleteKeyW

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegQueryValueExW

  RegEnumValueW

  comctl32

  ImageList_AddMasked

  ImageList_Destroy

  ord17

  ImageList_Create

  ole32

  CoTaskMemFree

  OleInitialize

  OleUninitialize

  CoCreateInstance

  version

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  VerQueryValueW

  Sections

  .text

  Size: 28KB - Virtual size: 27KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 415KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .ndata

  Size: - Virtual size: 1.0MB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 4KB - Virtual size: 3KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/BunndleOfferManager.dll

  .dll regsvr32 windows:5 windows x86 arch:x86

  f5aee842c9c87c94e859ca5f4892d62d

  
  

  Code Sign

  03:01

  Certificate

  Issuer

  OU=Go Daddy Class 2 Certification Authority,O=The Go Daddy Group\, Inc.,C=US

  Not Before

  16-11-2006 01:54

  Not After

  16-11-2026 01:54

  Subject

  SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  07:a1:7a:4a:60:67:3f

  Certificate

  Issuer

  SERIALNUMBER=07969287,CN=Go Daddy Secure Certification Authority,OU=http://certificates.godaddy.com/repository,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  26-01-2012 20:45

  Not After

  26-01-2013 20:45

  Subject

  CN=Bunndle\, Inc.,O=Bunndle\, Inc.,L=Palo Alto,ST=CA,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  20:08

  Certificate

  Issuer

  CN=Starfield Services Root Certificate Authority,OU=http://certificates.starfieldtech.com/repository/,O=Starfield Technologies\, Inc.,L=Scottsdale,ST=Arizona,C=US

  Not Before

  26-04-2012 07:00

  Not After

  26-04-2017 07:00

  Subject

  CN=Starfield Services Timestamp Authority,OU=http://certs.starfieldtech.com/repository/,O=Starfield Technologies\, LLC,L=Scottsdale,ST=Arizona,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageContentCommitment

  93:16:44:5e:47:91:7a:84:3f:5f:f5:77:24:12:df:a6:cd:8a:d2:14

  Signer

  Actual PE Digest

  93:16:44:5e:47:91:7a:84:3f:5f:f5:77:24:12:df:a6:cd:8a:d2:14

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  C:\Bunndle\client\Release\BunndleOfferManager.pdb

  Imports

  secur32

  GetUserNameExW

  netapi32

  NetUserGetLocalGroups

  NetApiBufferFree

  rpcrt4

  NdrCStdStubBuffer_Release

  CStdStubBuffer_Connect

  NdrCStdStubBuffer2_Release

  NdrDllGetClassObject

  CStdStubBuffer_AddRef

  IUnknown_QueryInterface_Proxy

  NdrOleFree

  NdrStubForwardingFunction

  NdrOleAllocate

  CStdStubBuffer_CountRefs

  NdrStubCall2

  IUnknown_Release_Proxy

  CStdStubBuffer_DebugServerQueryInterface

  CStdStubBuffer_QueryInterface

  IUnknown_AddRef_Proxy

  CStdStubBuffer_DebugServerRelease

  CStdStubBuffer_Disconnect

  CStdStubBuffer_IsIIDSupported

  CStdStubBuffer_Invoke

  UuidCreate

  winhttp

  WinHttpCloseHandle

  WinHttpOpen

  WinHttpConnect

  WinHttpOpenRequest

  WinHttpSendRequest

  WinHttpReceiveResponse

  WinHttpQueryHeaders

  WinHttpQueryDataAvailable

  WinHttpReadData

  WinHttpCrackUrl

  kernel32

  SetStdHandle

  GetConsoleMode

  GetConsoleCP

  EnterCriticalSection

  LeaveCriticalSection

  FreeLibrary

  lstrlenW

  GetProcAddress

  GetModuleHandleW

  lstrcmpiW

  RaiseException

  GetLastError

  MultiByteToWideChar

  SizeofResource

  LoadResource

  FindResourceW

  LoadLibraryExW

  GetModuleFileNameW

  InterlockedDecrement

  InterlockedIncrement

  CloseHandle

  IsDebuggerPresent

  Sleep

  DebugBreak

  GetCurrentProcessId

  CreateFileW

  CreateDirectoryW

  MulDiv

  GetThreadLocale

  SetThreadLocale

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  GetCurrentThreadId

  SetLastError

  GetCurrentProcess

  FlushInstructionCache

  FindFirstFileW

  FindNextFileW

  FindClose

  GetDiskFreeSpaceExW

  GlobalMemoryStatusEx

  FileTimeToSystemTime

  ReadFile

  SetFilePointerEx

  GetFileInformationByHandle

  LockResource

  WriteConsoleW

  GlobalLock

  GlobalUnlock

  lstrlenA

  lstrcmpW

  GetSystemTimeAsFileTime

  WaitForSingleObject

  CreateProcessW

  CopyFileW

  MoveFileExW

  DeleteFileW

  LoadLibraryW

  CreateThread

  GlobalHandle

  GlobalFree

  InterlockedCompareExchange

  SetEvent

  InitializeCriticalSection

  CreateEventW

  OpenProcess

  GetExitCodeProcess

  SystemTimeToFileTime

  CreatePipe

  SetHandleInformation

  GetStdHandle

  WideCharToMultiByte

  FindResourceExW

  FormatMessageW

  GetVersionExW

  GetSystemInfo

  GetUserDefaultLCID

  GetLocaleInfoW

  GetSystemDirectoryW

  GetTempPathW

  GetEnvironmentVariableW

  ExpandEnvironmentStringsW

  GetShortPathNameW

  GetLocalTime

  WriteFile

  GetFileAttributesW

  QueryPerformanceCounter

  GetTickCount

  RtlUnwind

  SetFilePointer

  FlushFileBuffers

  GetProcessHeap

  InterlockedPushEntrySList

  VirtualFree

  VirtualAlloc

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetModuleFileNameA

  GetStartupInfoW

  GetFileType

  SetHandleCount

  LCMapStringW

  IsProcessorFeaturePresent

  GetStringTypeW

  TlsFree

  TlsSetValue

  TlsGetValue

  TlsAlloc

  GetCommandLineA

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  HeapSize

  ExitProcess

  HeapDestroy

  HeapCreate

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  HeapFree

  HeapAlloc

  EncodePointer

  DecodePointer

  HeapReAlloc

  InterlockedPopEntrySList

  GlobalAlloc

  TerminateProcess

  user32

  InvalidateRect

  GetKeyState

  ReleaseDC

  GetDC

  PtInRect

  IsWindow

  DestroyWindow

  UnionRect

  SetWindowPos

  SetWindowRgn

  OffsetRect

  EqualRect

  IntersectRect

  EndPaint

  GetClientRect

  BeginPaint

  GetFocus

  IsChild

  ShowWindow

  RegisterClassExW

  GetClassInfoExW

  LoadCursorW

  CreateWindowExW

  SetWindowLongW

  GetWindowLongW

  DefWindowProcW

  LoadStringW

  GetDlgItem

  EnableWindow

  GetDesktopWindow

  MapWindowPoints

  GetParent

  GetWindowRect

  GetMonitorInfoW

  MonitorFromWindow

  GetWindow

  SetActiveWindow

  SetForegroundWindow

  MoveWindow

  EndDialog

  SetWindowContextHelpId

  MapDialogRect

  SendDlgItemMessageW

  DestroyAcceleratorTable

  DialogBoxIndirectParamW

  GetActiveWindow

  RegisterWindowMessageW

  GetWindowTextLengthW

  GetWindowTextW

  SetFocus

  SendMessageW

  GetClassNameW

  GetSysColor

  RedrawWindow

  CreateAcceleratorTableW

  ClientToScreen

  UnregisterClassA

  SetCapture

  ReleaseCapture

  FillRect

  InvalidateRgn

  SetWindowTextW

  CharNextW

  CallWindowProcW

  ScreenToClient

  gdi32

  CreateSolidBrush

  CreateCompatibleDC

  TextOutW

  CreateCompatibleBitmap

  SelectObject

  DeleteObject

  BitBlt

  GetStockObject

  GetObjectW

  CreateRectRgnIndirect

  CreateDCW

  LPtoDP

  SaveDC

  SetMapMode

  SetWindowOrgEx

  SetViewportOrgEx

  GetDeviceCaps

  SetTextAlign

  RestoreDC

  DeleteDC

  advapi32

  RegEnumKeyW

  RegEnumValueW

  RegQueryValueExW

  FreeSid

  CheckTokenMembership

  AllocateAndInitializeSid

  RegDeleteValueW

  RegCreateKeyExW

  RegSetValueExW

  RegOpenKeyExW

  RegEnumKeyExW

  RegQueryInfoKeyW

  RegCloseKey

  RegDeleteKeyW

  shell32

  SHGetFolderPathW

  ole32

  StringFromGUID2

  OleSaveToStream

  WriteClassStm

  ReadClassStm

  CoCreateInstance

  CoCreateGuid

  ProgIDFromCLSID

  OleRegGetUserType

  OleRegEnumVerbs

  CoUninitialize

  CoInitializeEx

  CoTaskMemRealloc

  CoTaskMemFree

  CoTaskMemAlloc

  CreateStreamOnHGlobal

  OleUninitialize

  OleLockRunning

  CoGetClassObject

  CLSIDFromProgID

  CLSIDFromString

  OleInitialize

  CoRegisterClassObject

  CoRegisterPSClsid

  CoRevokeClassObject

  CreateOleAdviseHolder

  CoDisconnectObject

  OleRegGetMiscStatus

  oleaut32

  UnRegisterTypeLi

  BSTR_UserSize

  VARIANT_UserSize

  VARIANT_UserUnmarshal

  BSTR_UserMarshal

  RevokeActiveObject

  RegisterActiveObject

  GetActiveObject

  OleCreateFontIndirect

  GetErrorInfo

  SafeArrayLock

  SafeArrayRedim

  SafeArrayUnlock

  SafeArrayDestroy

  SafeArrayCreate

  CreateErrorInfo

  SafeArrayGetLBound

  SafeArrayGetUBound

  SetErrorInfo

  VARIANT_UserMarshal

  RegisterTypeLi

  SysAllocStringByteLen

  DispCallFunc

  OleCreatePropertyFrame

  SysStringByteLen

  LoadTypeLi

  LoadRegTypeLi

  SysStringLen

  SysAllocStringLen

  VariantChangeType

  VariantClear

  VariantInit

  SysAllocString

  VarUI4FromStr

  SysFreeString

  BSTR_UserFree

  VARIANT_UserFree

  BSTR_UserUnmarshal

  version

  VerQueryValueW

  GetFileVersionInfoSizeW

  GetFileVersionInfoW

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  DllRegisterServer

  DllUnregisterServer

  RunOfferManagerAgentW

  RunScriptW

  ShowOffersW

  Sections

  .text

  Size: 193KB - Virtual size: 193KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .orpc

  Size: 512B - Virtual size: 249B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 82KB - Virtual size: 82KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 14KB - Virtual size: 21KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 14KB - Virtual size: 13KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 28KB - Virtual size: 28KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/DM_loader.gif

  .gif
• $PLUGINSDIR/Failed.htm

  .js
• $PLUGINSDIR/FirefoxHandler.dll

  .dll windows:5 windows x86 arch:x86

  0b0bd9a74b81c20dd1ca10dffb1e2ff5

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  D:\SmartBar\DevelopmentTools\FF\FirefoxHandler\Release\FirefoxHandler.pdb

  Imports

  psapi

  EnumProcessModules

  GetModuleBaseNameW

  GetModuleFileNameExW

  EnumProcesses

  kernel32

  CopyFileW

  CreateFileW

  GetFileSize

  CloseHandle

  GetDiskFreeSpaceExW

  ReadFile

  MultiByteToWideChar

  WideCharToMultiByte

  OpenProcess

  DeleteFileW

  TerminateProcess

  Sleep

  CreateProcessW

  LoadLibraryA

  GetProcAddress

  GetVersionExW

  GetTempPathW

  lstrcpynW

  GlobalAlloc

  GetCurrentProcessId

  GetCurrentThreadId

  GetTickCount

  QueryPerformanceCounter

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  GetSystemTimeAsFileTime

  GetCurrentProcess

  InterlockedCompareExchange

  InterlockedExchange

  DecodePointer

  UnhandledExceptionFilter

  EncodePointer

  user32

  GetWindowThreadProcessId

  FindWindowW

  CharUpperW

  wsprintfW

  advapi32

  RegCloseKey

  RegOpenKeyExW

  DuplicateTokenEx

  OpenProcessToken

  RegQueryValueExW

  shlwapi

  PathFileExistsW

  msvcp100

  ?_Xlength_error@std@@YAXPBD@Z

  ?_Xout_of_range@std@@YAXPBD@Z

  msvcr100

  ?terminate@@YAXXZ

  ?_type_info_dtor_internal_method@type_info@@QAEXXZ

  _except_handler4_common

  __clean_type_info_names_internal

  memset

  memcpy

  _CxxThrowException

  __CxxFrameHandler3

  ??3@YAXPAX@Z

  ??0exception@std@@QAE@ABV01@@Z

  ?what@exception@std@@UBEPBDXZ

  ??1exception@std@@UAE@XZ

  ??0exception@std@@QAE@ABQBD@Z

  ??2@YAPAXI@Z

  memmove

  _wfsopen

  fwrite

  fflush

  fclose

  ??_V@YAXPAX@Z

  fseek

  ftell

  rewind

  fread

  malloc

  realloc

  free

  _wtoi

  calloc

  iswspace

  _unlock

  __dllonexit

  _lock

  _onexit

  _malloc_crt

  _encoded_null

  _initterm

  _initterm_e

  _amsg_exit

  __CppXcptFilter

  _crt_debugger_hook

  Exports

  Exports

  DllIsFireFoxRunning

  DllRestoreFF

  DllTerminateFF

  Sections

  .text

  Size: 24KB - Virtual size: 24KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 6KB - Virtual size: 6KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 512B - Virtual size: 436B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/OCSetupHlp.dll

  .dll regsvr32 windows:5 windows x86 arch:x86

  bcc9fc26368b3f6e1a5258f41bed8ac8

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  25-01-2011 00:00

  Not After

  14-03-2014 23:59

  Subject

  CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  dc:e0:4f:f2:18:36:46:37:ce:11:b5:05:e9:2b:e7:3d:77:5a:f8:ff

  Signer

  Actual PE Digest

  dc:e0:4f:f2:18:36:46:37:ce:11:b5:05:e9:2b:e7:3d:77:5a:f8:ff

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SetErrorMode

  GetFileAttributesW

  CreateFileW

  GetFileSize

  GetCurrentProcessId

  GetEnvironmentVariableW

  FindFirstFileW

  FindNextFileW

  FindClose

  ReadFile

  GetTimeZoneInformation

  GetTempPathW

  DeleteFileW

  WriteFile

  ProcessIdToSessionId

  HeapAlloc

  GetProcessHeap

  HeapFree

  CreateDirectoryW

  ExpandEnvironmentStringsW

  WaitForSingleObject

  OutputDebugStringW

  CreateMutexW

  OpenMutexW

  ReleaseMutex

  UnmapViewOfFile

  MapViewOfFileEx

  CreateFileMappingW

  OpenFileMappingW

  GetShortPathNameW

  SetFilePointer

  CreateEventW

  GlobalFree

  ResumeThread

  FreeResource

  SetEvent

  ResetEvent

  GetTickCount

  GetCurrentThread

  CreateProcessW

  MoveFileExW

  OpenEventW

  lstrlenA

  WideCharToMultiByte

  SetEnvironmentVariableW

  SetEnvironmentVariableA

  CompareStringW

  CompareStringA

  GetExitCodeProcess

  GetStringTypeW

  GetStringTypeA

  GetLocaleInfoA

  GetFullPathNameW

  SetEndOfFile

  SetStdHandle

  WriteConsoleW

  GetConsoleOutputCP

  WriteConsoleA

  DeleteCriticalSection

  CreateFileA

  lstrcmpiW

  GetProcAddress

  PeekNamedPipe

  GetFileInformationByHandle

  GetFullPathNameA

  FlushFileBuffers

  GetModuleHandleA

  QueryPerformanceCounter

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetStartupInfoA

  SetHandleCount

  LCMapStringA

  ExitProcess

  LCMapStringW

  IsValidCodePage

  GetOEMCP

  GetACP

  GetCPInfo

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  GetModuleFileNameA

  GetStdHandle

  HeapCreate

  RtlUnwind

  GetDriveTypeW

  GetFileType

  GetConsoleMode

  GetConsoleCP

  FindFirstFileA

  GetDriveTypeA

  FileTimeToLocalFileTime

  GetCommandLineA

  IsDebuggerPresent

  SetUnhandledExceptionFilter

  UnhandledExceptionFilter

  TerminateProcess

  ExitThread

  GetSystemTimeAsFileTime

  HeapSize

  HeapReAlloc

  HeapDestroy

  VirtualAlloc

  VirtualFree

  IsProcessorFeaturePresent

  LoadLibraryA

  InterlockedCompareExchange

  FindResourceA

  GlobalMemoryStatusEx

  GetDiskFreeSpaceExW

  GetFileAttributesExW

  CompareFileTime

  GetVersion

  GetTempFileNameW

  ReleaseSemaphore

  InitializeCriticalSectionAndSpinCount

  CreateSemaphoreW

  GetSystemInfo

  GetVersionExW

  FileTimeToSystemTime

  GetSystemDefaultLCID

  FormatMessageA

  ExpandEnvironmentStringsA

  SleepEx

  GetThreadLocale

  GetLastError

  SetThreadLocale

  MultiByteToWideChar

  GetModuleFileNameW

  InitializeCriticalSection

  GetModuleHandleW

  InterlockedDecrement

  InterlockedIncrement

  LoadLibraryExW

  GlobalUnlock

  GlobalLock

  GlobalAlloc

  Process32NextW

  Process32FirstW

  CreateToolhelp32Snapshot

  CloseHandle

  OpenProcess

  GetUserDefaultUILanguage

  GetLocaleInfoW

  FreeLibrary

  LoadLibraryW

  MulDiv

  lstrlenW

  lstrcpynW

  SetLastError

  RaiseException

  Sleep

  CreateThread

  FindResourceExW

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  LeaveCriticalSection

  EnterCriticalSection

  GetCurrentThreadId

  FlushInstructionCache

  GetCurrentDirectoryA

  GetCurrentProcess

  psapi

  GetProcessImageFileNameW

  EnumProcesses

  ws2_32

  select

  WSACleanup

  WSAStartup

  closesocket

  WSAGetLastError

  socket

  recv

  send

  getsockname

  ntohs

  bind

  htons

  getsockopt

  getpeername

  setsockopt

  connect

  WSASetLastError

  __WSAFDIsSet

  gethostname

  freeaddrinfo

  ioctlsocket

  getaddrinfo

  msimg32

  AlphaBlend

  shlwapi

  PathMatchSpecW

  user32

  DestroyMenu

  SetActiveWindow

  DestroyCursor

  NotifyWinEvent

  FindWindowW

  PeekMessageW

  TrackPopupMenu

  ReleaseCapture

  DrawFocusRect

  UnregisterClassA

  GetCursor

  SetCursor

  SetWindowLongW

  GetWindowLongW

  DefWindowProcW

  CallWindowProcW

  DestroyWindow

  LoadCursorW

  IsWindow

  GetDesktopWindow

  MsgWaitForMultipleObjects

  GetWindow

  MonitorFromWindow

  GetSysColor

  GetUpdateRect

  SetRect

  CreateDialogParamW

  GetSystemMetrics

  CallNextHookEx

  UnhookWindowsHookEx

  SystemParametersInfoW

  SetWindowsHookExW

  DrawIconEx

  GetIconInfo

  SetMenuItemInfoW

  IsWindowVisible

  PostQuitMessage

  KillTimer

  SetTimer

  PostMessageW

  GetWindowTextLengthW

  GetWindowTextW

  EnumChildWindows

  EnumWindows

  RegisterClassExW

  GetClassInfoExW

  CreateWindowExW

  GetSysColorBrush

  GetDC

  SendMessageW

  SetFocus

  TrackMouseEvent

  InvalidateRect

  GetClientRect

  BeginPaint

  EndPaint

  GetCursorPos

  SetForegroundWindow

  SetDlgItemTextW

  SendDlgItemMessageW

  EnableMenuItem

  GetSystemMenu

  EnableWindow

  LoadImageW

  MessageBoxW

  MapWindowPoints

  GetParent

  CharNextW

  GetAsyncKeyState

  CopyRect

  GetMonitorInfoW

  MonitorFromPoint

  GetForegroundWindow

  SetClipboardData

  CloseClipboard

  EmptyClipboard

  OpenClipboard

  GetWindowThreadProcessId

  SetWindowPos

  SetWindowTextW

  LoadIconW

  DispatchMessageW

  TranslateMessage

  IsDialogMessageW

  GetMessageW

  GetDlgItem

  ShowWindow

  ReleaseDC

  DrawTextW

  FillRect

  MoveWindow

  GetWindowRect

  GetAncestor

  PtInRect

  ScreenToClient

  gdi32

  SelectObject

  SetBkMode

  SetTextColor

  GetDeviceCaps

  DPtoLP

  CreateFontIndirectW

  CreateSolidBrush

  SetViewportOrgEx

  GetTextExtentPoint32W

  GetObjectW

  CreatePatternBrush

  SetBkColor

  ExtTextOutW

  CreateDIBSection

  GdiFlush

  DeleteDC

  GetStockObject

  CreateCompatibleBitmap

  DeleteObject

  CreateCompatibleDC

  BitBlt

  advapi32

  RegCreateKeyExW

  RegOpenKeyExW

  RegCloseKey

  RegEnumKeyW

  RegQueryInfoKeyW

  RegDeleteKeyW

  RegDeleteValueW

  RegEnumKeyExW

  RegSetValueExW

  OpenProcessToken

  GetTokenInformation

  DuplicateTokenEx

  LookupAccountSidW

  GetUserNameW

  CreateProcessAsUserW

  LookupPrivilegeValueW

  AdjustTokenPrivileges

  RegQueryValueExW

  shell32

  Shell_NotifyIconW

  SHGetFolderPathW

  ShellExecuteW

  ole32

  CoInitializeSecurity

  CreateStreamOnHGlobal

  CLSIDFromProgID

  CoInitialize

  CoUninitialize

  CoSetProxyBlanket

  CoTaskMemFree

  CoCreateInstance

  CoInitializeEx

  CoCreateGuid

  CoTaskMemAlloc

  StringFromGUID2

  CoTaskMemRealloc

  oleaut32

  LoadTypeLi

  UnRegisterTypeLi

  VarUI4FromStr

  RegisterTypeLi

  SysFreeString

  SysStringLen

  VariantClear

  SysAllocStringLen

  VariantChangeType

  LoadRegTypeLi

  OleLoadPicture

  SysAllocString

  VariantInit

  comctl32

  InitCommonControlsEx

  uxtheme

  DrawThemeBackground

  OpenThemeData

  CloseThemeData

  gdiplus

  GdipDeleteGraphics

  GdipCreateFromHDC

  GdipDisposeImage

  GdipAlloc

  GdipFree

  GdiplusShutdown

  GdiplusStartup

  GdipLoadImageFromFile

  GdipCloneImage

  GdipDrawImagePointRectI

  GdipDrawImageRectRect

  version

  GetFileVersionInfoW

  VerQueryValueW

  GetFileVersionInfoSizeW

  urlmon

  URLDownloadToFileW

  wininet

  InternetQueryOptionW

  InternetGetConnectedStateExW

  Exports

  Exports

  DllCanUnloadNow

  DllGetClassObject

  DllInstall

  DllRegisterServer

  DllUnregisterServer

  OCPRD1162OpenCandy1

  OCPRD1162OpenCandy10

  OCPRD1162OpenCandy11

  OCPRD1162OpenCandy12

  OCPRD1162OpenCandy13

  OCPRD1162OpenCandy14

  OCPRD1162OpenCandy15

  OCPRD1162OpenCandy16

  OCPRD1162OpenCandy17

  OCPRD1162OpenCandy18

  OCPRD1162OpenCandy19

  OCPRD1162OpenCandy20

  OCPRD1162OpenCandy21

  OCPRD1162OpenCandy22

  OCPRD1162OpenCandy23

  OCPRD1162OpenCandy24

  OCPRD1162OpenCandy29

  OCPRD1162OpenCandy30

  OCPRD1162OpenCandy31

  OCPRD1162OpenCandy32

  OCPRD1162OpenCandy33

  OCPRD1162OpenCandy34

  OCPRD1162OpenCandy35

  OCPRD1162OpenCandy36

  OCPRD1162OpenCandy37

  OCPRD1162OpenCandy38

  OCPRD1162OpenCandy39

  OCPRD1162OpenCandy40

  OCPRD1162OpenCandy41

  OCPRD1162OpenCandy42

  OCPRD1162OpenCandy44

  OCPRD1162OpenCandy45

  OCPRD1162OpenCandy46

  OCPRD1162OpenCandy47

  OCPRD1162OpenCandy48

  OCPRD1162OpenCandy49

  OCPRD1162OpenCandy5

  OCPRD1162OpenCandy50

  OCPRD1162OpenCandy51

  OCPRD1162OpenCandy52

  OCPRD1162OpenCandy53

  OCPRD1162OpenCandy54

  OCPRD1162OpenCandy55

  OCPRD1162OpenCandy56

  OCPRD1162OpenCandy57

  OCPRD1162OpenCandy58

  OCPRD1162OpenCandy59

  OCPRD1162OpenCandy6

  OCPRD1162OpenCandy60

  OCPRD1162OpenCandy61

  OCPRD1162OpenCandy62

  OCPRD1162OpenCandy63

  OCPRD1162OpenCandy64

  OCPRD1162OpenCandy65

  OCPRD1162OpenCandy7

  OCPRD1162OpenCandy8

  OCPRD1162OpenCandy9

  _OCPRD1162OpenCandy2@16

  _OCPRD1162OpenCandy3@16

  _OCPRD1162OpenCandy43@16

  _OCPRD1162OpenCandy4@16

  Sections

  .text

  Size: 574KB - Virtual size: 574KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 195KB - Virtual size: 194KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 11KB - Virtual size: 22KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 18KB - Virtual size: 18KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 36KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/System.dll

  .dll windows:5 windows x86 arch:x86

  039bcbc605477e8e87ec550c2e60e748

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  78:2b:69:d9:a6:d3:2b:02:2f:0d:f6:35:ca:3e:de:c8:b4:96:ab:13

  Signer

  Actual PE Digest

  78:2b:69:d9:a6:d3:2b:02:2f:0d:f6:35:ca:3e:de:c8:b4:96:ab:13

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  GlobalSize

  GetLastError

  lstrcpyW

  lstrcpynW

  GetProcAddress

  WideCharToMultiByte

  lstrcatW

  lstrlenW

  lstrcmpiW

  LoadLibraryW

  GetModuleHandleW

  MultiByteToWideChar

  VirtualAlloc

  VirtualProtect

  FreeLibrary

  user32

  wsprintfW

  ole32

  CLSIDFromString

  StringFromGUID2

  Exports

  Exports

  Alloc

  Call

  Copy

  Free

  Get

  Int64Op

  Store

  StrAlloc

  Sections

  .text

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1024B - Virtual size: 963B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 64B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 1024B - Virtual size: 588B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/execDos.dll

  .dll windows:5 windows x86 arch:x86

  a5d239ed12c9442d63c73cb9ff7cad0e

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  58:e1:a1:33:8b:28:3a:2c:6f:24:11:4d:15:7f:5e:9e:44:f1:99:4e

  Signer

  Actual PE Digest

  58:e1:a1:33:8b:28:3a:2c:6f:24:11:4d:15:7f:5e:9e:44:f1:99:4e

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalFree

  Sleep

  lstrcatW

  lstrcmpiW

  TerminateProcess

  ReadFile

  GetExitCodeProcess

  PeekNamedPipe

  CreateFileW

  FlushFileBuffers

  WriteFile

  lstrlenW

  CloseHandle

  CreateProcessW

  DuplicateHandle

  GetCurrentProcess

  CreatePipe

  GetProcAddress

  GetModuleHandleW

  GlobalAlloc

  GetExitCodeThread

  WaitForSingleObject

  CreateThread

  lstrcpyW

  lstrcpynW

  user32

  wsprintfW

  GetClassNameW

  GetDlgItem

  FindWindowExW

  SendMessageW

  Exports

  Exports

  exec

  isdone

  wait

  Sections

  .text

  Size: 2KB - Virtual size: 2KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: - Virtual size: 20B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 512B - Virtual size: 334B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/icon.png

  .png
• $PLUGINSDIR/inetc.dll

  .dll windows:5 windows x86 arch:x86

  f875bae32a9dfc52e16e9adf71bffe75

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  3a:78:42:05:08:9a:17:5d:13:de:e7:de:d0:92:59:5e:26:0b:ed:ff

  Signer

  Actual PE Digest

  3a:78:42:05:08:9a:17:5d:13:de:e7:de:d0:92:59:5e:26:0b:ed:ff

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  SetFilePointer

  WaitForSingleObject

  SleepEx

  GetModuleHandleW

  GetTickCount

  WriteFile

  GlobalAlloc

  WideCharToMultiByte

  LoadLibraryW

  TerminateThread

  lstrcpynW

  MulDiv

  ReadFile

  CreateFileW

  lstrcmpW

  lstrlenW

  GetLastError

  GetProcAddress

  GlobalFree

  lstrcmpiW

  lstrcatW

  CloseHandle

  DeleteFileW

  lstrcpyW

  CreateThread

  HeapSize

  RtlUnwind

  InitializeCriticalSectionAndSpinCount

  LoadLibraryA

  HeapReAlloc

  VirtualAlloc

  HeapAlloc

  GetFileSize

  GetLocaleInfoA

  EnterCriticalSection

  LeaveCriticalSection

  GetStringTypeW

  GetStringTypeA

  LCMapStringW

  MultiByteToWideChar

  LCMapStringA

  GetSystemTimeAsFileTime

  GetCurrentProcessId

  QueryPerformanceCounter

  VirtualFree

  HeapDestroy

  HeapCreate

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  GetEnvironmentStrings

  FreeEnvironmentStringsA

  GetModuleFileNameA

  DeleteCriticalSection

  GetStartupInfoA

  GetFileType

  GetStdHandle

  SetHandleCount

  ExitProcess

  Sleep

  HeapFree

  SetLastError

  TlsFree

  TlsSetValue

  TlsAlloc

  TlsGetValue

  IsValidCodePage

  CreateFileA

  GetCurrentThreadId

  GetCommandLineA

  TerminateProcess

  GetCurrentProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetCPInfo

  InterlockedIncrement

  InterlockedDecrement

  GetACP

  GetOEMCP

  user32

  GetParent

  SetWindowTextW

  EnableWindow

  UpdateWindow

  SendMessageW

  SetDlgItemTextW

  IsWindowVisible

  MessageBoxW

  FindWindowExW

  IsWindow

  CreateDialogParamW

  ShowWindow

  SetWindowPos

  SendDlgItemMessageW

  RedrawWindow

  SetWindowLongW

  GetDlgItem

  SystemParametersInfoW

  GetWindowTextW

  GetWindowLongW

  DestroyWindow

  SetTimer

  GetWindowRect

  GetMessageW

  PostMessageW

  KillTimer

  DispatchMessageW

  wsprintfA

  GetClientRect

  wsprintfW

  TranslateMessage

  IsDialogMessageW

  LoadIconW

  wininet

  InternetOpenW

  InternetQueryOptionW

  HttpSendRequestExW

  InternetCrackUrlW

  FtpOpenFileW

  InternetReadFile

  InternetConnectW

  InternetWriteFile

  HttpSendRequestW

  FtpCreateDirectoryW

  InternetSetOptionW

  HttpAddRequestHeadersW

  HttpQueryInfoW

  HttpOpenRequestW

  InternetSetFilePointer

  HttpAddRequestHeadersA

  InternetGetLastResponseInfoW

  HttpEndRequestW

  InternetCloseHandle

  InternetErrorDlg

  comctl32

  ord17

  Exports

  Exports

  get

  head

  load

  post

  put

  Sections

  .text

  Size: 37KB - Virtual size: 36KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 10KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 6KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/nsArray.dll

  .dll windows:5 windows x86 arch:x86

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  94:eb:94:4b:9d:24:33:a9:67:f4:ef:16:fa:e3:25:c3:31:df:07:c8

  Signer

  Actual PE Digest

  94:eb:94:4b:9d:24:33:a9:67:f4:ef:16:fa:e3:25:c3:31:df:07:c8

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Exports

  Exports

  Clear

  Get

  Join

  Length

  Remove

  RemoveList

  Set

  SetList

  Sort

  Split

  Sections

  UPX0

  Size: - Virtual size: 28KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .dll windows:5 windows x86 arch:x86

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Sections

  .text

  Size: 6KB - Virtual size: 5KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 512B - Virtual size: 503B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 512B - Virtual size: 280B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1024B - Virtual size: 864B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 1024B - Virtual size: 524B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/wajam_validate.exe

  .exe windows:4 windows x86 arch:x86

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  18:20:8f:51:bb:ce:48:28:5d:1b:f2:d2:da:83:b2:2b:db:9a:b9:0f

  Signer

  Actual PE Digest

  18:20:8f:51:bb:ce:48:28:5d:1b:f2:d2:da:83:b2:2b:db:9a:b9:0f

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  UPX0

  Size: - Virtual size: 24KB

  IMAGE_SCN_CNT_UNINITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX1

  Size: 9KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  UPX2

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• out.upx

  .exe windows:4 windows x86 arch:x86

  
  

  Headers

  File Characteristics

  IMAGE_FILE_RELOCS_STRIPPED

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  Sections

  .text

  Size: 20KB - Virtual size: 16KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 4KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 812B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

• $PLUGINSDIR/webapphost.dll

  .dll windows:5 windows x86 arch:x86

  5336e7deb3d65c867f8559f7f16b9f05

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  a4:77:c8:78:68:04:c2:d4:c0:08:5b:fc:c7:ee:23:14:ea:25:e2:04

  Signer

  Actual PE Digest

  a4:77:c8:78:68:04:c2:d4:c0:08:5b:fc:c7:ee:23:14:ea:25:e2:04

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GetFileAttributesW

  GetFileSizeEx

  GetFileTime

  WritePrivateProfileStringW

  GetTickCount

  ExitThread

  TerminateProcess

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsDebuggerPresent

  GetFileType

  VirtualProtect

  VirtualAlloc

  GetSystemInfo

  VirtualQuery

  GetCommandLineA

  HeapAlloc

  RtlUnwind

  RaiseException

  HeapReAlloc

  ExitProcess

  HeapSize

  SetStdHandle

  GetCPInfo

  GetACP

  GetOEMCP

  IsValidCodePage

  GetModuleFileNameA

  HeapDestroy

  VirtualFree

  SetHandleCount

  GetStartupInfoA

  GetConsoleCP

  GetConsoleMode

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  QueryPerformanceCounter

  GetSystemTimeAsFileTime

  LCMapStringA

  LCMapStringW

  GetTimeZoneInformation

  InitializeCriticalSectionAndSpinCount

  GetStringTypeA

  GetStringTypeW

  GetUserDefaultLCID

  GetLocaleInfoA

  EnumSystemLocalesA

  IsValidLocale

  WriteConsoleA

  GetConsoleOutputCP

  CreateFileA

  SetEnvironmentVariableA

  GlobalFlags

  GetCurrentProcessId

  SetErrorMode

  TlsFree

  LocalReAlloc

  TlsSetValue

  TlsAlloc

  GlobalHandle

  GlobalReAlloc

  TlsGetValue

  GetCurrentThread

  ConvertDefaultLocale

  EnumResourceLanguagesW

  GetLocaleInfoW

  LoadLibraryExW

  CompareStringA

  InterlockedExchange

  lstrcmpA

  LeaveCriticalSection

  EnterCriticalSection

  DeleteCriticalSection

  InitializeCriticalSection

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  InterlockedIncrement

  SuspendThread

  GetModuleFileNameW

  GetFullPathNameW

  GetVolumeInformationW

  GetFileSize

  SetEndOfFile

  UnlockFile

  LockFile

  SetFilePointer

  GetThreadLocale

  GlobalAddAtomW

  GlobalFindAtomW

  GlobalDeleteAtom

  CompareStringW

  LoadLibraryA

  lstrcmpW

  GetVersionExA

  GetModuleHandleA

  FormatMessageW

  SetLastError

  GetProcessHeap

  HeapFree

  lstrlenA

  CreateThread

  GetExitCodeThread

  Sleep

  lstrcatW

  lstrcmpiW

  ReadFile

  PeekNamedPipe

  FlushFileBuffers

  lstrlenW

  CreateProcessW

  GetCurrentProcess

  DuplicateHandle

  CreatePipe

  GetModuleHandleW

  GetLastError

  lstrcpyW

  OpenEventW

  lstrcpynW

  GetCurrentThreadId

  WideCharToMultiByte

  FreeResource

  GlobalAlloc

  ResumeThread

  GlobalFree

  MulDiv

  GlobalUnlock

  GlobalLock

  GetProcAddress

  LoadLibraryW

  FreeLibrary

  SetEvent

  ResetEvent

  CreateEventW

  GetUserDefaultLangID

  ReleaseMutex

  CreateMutexW

  WriteConsoleW

  GetStdHandle

  AllocConsole

  FindResourceW

  LoadResource

  LockResource

  SizeofResource

  MultiByteToWideChar

  GetExitCodeProcess

  FindClose

  FindFirstFileW

  LocalFree

  CloseHandle

  WriteFile

  CreateFileW

  LocalAlloc

  InterlockedDecrement

  WaitForSingleObject

  SleepEx

  DeleteFileW

  HeapCreate

  GetVersionExW

  InterlockedCompareExchange

  user32

  GetTopWindow

  DestroyWindow

  UnhookWindowsHookEx

  GetMessageTime

  GetMessagePos

  PeekMessageW

  MapWindowPoints

  GetKeyState

  SetMenu

  CreateWindowExW

  GetClassInfoExW

  GetClassInfoW

  RegisterClassW

  AdjustWindowRectEx

  EqualRect

  DefWindowProcW

  CallWindowProcW

  GetMenu

  OffsetRect

  IntersectRect

  SystemParametersInfoA

  GetWindowPlacement

  EndPaint

  BeginPaint

  GetWindowDC

  ClientToScreen

  GrayStringW

  DrawTextExW

  DrawTextW

  TabbedTextOutW

  GetMenuState

  GetMenuItemID

  GetMenuItemCount

  GetSubMenu

  GetWindowTextW

  GetFocus

  GetParent

  IsWindowEnabled

  SetWindowLongW

  GetDlgCtrlID

  SetWindowTextW

  GetWindowLongW

  IsDialogMessageW

  SendDlgItemMessageW

  GetWindow

  GetClassNameW

  MessageBoxW

  SetForegroundWindow

  BringWindowToTop

  SetActiveWindow

  AttachThreadInput

  GetWindowThreadProcessId

  LoadImageW

  PostMessageW

  UpdateWindow

  IsWindowVisible

  EnableScrollBar

  SetCursor

  PtInRect

  ScreenToClient

  GetCursorPos

  DrawIcon

  GetSystemMetrics

  IsIconic

  AppendMenuW

  GetSystemMenu

  LoadCursorW

  LoadIconW

  CopyRect

  GetSysColor

  FillRect

  ReleaseDC

  GetDC

  SetRect

  EnableWindow

  InvalidateRect

  IsWindow

  MoveWindow

  GetClientRect

  GetDesktopWindow

  DispatchMessageW

  GetLastActivePopup

  GetForegroundWindow

  RemovePropW

  GetPropW

  PostThreadMessageW

  RegisterClipboardFormatW

  GetWindowRect

  GetDlgItem

  SendMessageW

  wsprintfW

  SetWindowPos

  SetFocus

  EndDialog

  DialogBoxParamW

  MessageBeep

  GetNextDlgGroupItem

  ReleaseCapture

  SetCapture

  InvalidateRgn

  IsRectEmpty

  CopyAcceleratorTableW

  GetSysColorBrush

  UnregisterClassW

  SetWindowContextHelpId

  MapDialogRect

  PostQuitMessage

  CharNextW

  GetMessageW

  TranslateMessage

  ValidateRect

  DestroyMenu

  GetActiveWindow

  CreateDialogIndirectParamW

  SetPropW

  CharUpperW

  SetMenuItemBitmaps

  GetMenuCheckMarkDimensions

  LoadBitmapW

  ModifyMenuW

  EnableMenuItem

  CheckMenuItem

  RegisterWindowMessageW

  SendDlgItemMessageA

  WinHelpW

  IsChild

  GetCapture

  SetWindowsHookExW

  CallNextHookEx

  ShowWindow

  GetClassLongW

  GetNextDlgTabItem

  gdi32

  GetObjectW

  GetViewportExtEx

  GetWindowExtEx

  PtVisible

  RectVisible

  TextOutW

  ExtTextOutW

  Escape

  SetViewportOrgEx

  OffsetViewportOrgEx

  SetViewportExtEx

  ScaleViewportExtEx

  SetWindowExtEx

  ScaleWindowExtEx

  ExtSelectClipRgn

  CreateBitmap

  GetStockObject

  GetBkColor

  GetTextColor

  CreateRectRgnIndirect

  GetMapMode

  GetRgnBox

  GetClipBox

  SetMapMode

  SetTextColor

  SetBkColor

  RestoreDC

  SaveDC

  CreateCompatibleBitmap

  CreateCompatibleDC

  BitBlt

  CreateSolidBrush

  DeleteObject

  DeleteDC

  GetDeviceCaps

  SelectObject

  comdlg32

  GetFileTitleW

  winspool.drv

  ClosePrinter

  DocumentPropertiesW

  OpenPrinterW

  advapi32

  RegOpenKeyW

  CryptAcquireContextW

  RegOpenKeyExW

  RegQueryValueExW

  RegCloseKey

  RegSetValueExW

  CryptDestroyHash

  RegEnumKeyW

  RegDeleteKeyW

  RegQueryValueW

  RegCreateKeyExW

  CryptCreateHash

  CryptGetHashParam

  CryptHashData

  CryptReleaseContext

  shell32

  SHGetFolderPathW

  ShellExecuteExW

  ShellExecuteW

  SHBrowseForFolderW

  SHGetPathFromIDListW

  SHChangeNotify

  shlwapi

  PathIsUNCW

  PathFindFileNameW

  PathFindExtensionW

  PathStripToRootW

  oledlg

  OleUIBusyW

  ole32

  CoRegisterMessageFilter

  OleFlushClipboard

  CoInitialize

  CoUninitialize

  CoFreeUnusedLibrariesEx

  CoCreateInstance

  CreateStreamOnHGlobal

  CoInitializeEx

  OleInitialize

  CoTaskMemFree

  OleUninitialize

  CoInitializeSecurity

  CoSetProxyBlanket

  CoTaskMemAlloc

  CLSIDFromProgID

  CLSIDFromString

  CoDisconnectObject

  CoGetClassObject

  StgOpenStorageOnILockBytes

  StgCreateDocfileOnILockBytes

  CreateILockBytesOnHGlobal

  CoFreeUnusedLibraries

  CoRevokeClassObject

  OleIsCurrentClipboard

  oleaut32

  SafeArrayAccessData

  SysStringByteLen

  SysAllocStringByteLen

  VariantInit

  VariantClear

  OleLoadPicture

  SysAllocString

  SysFreeString

  GetErrorInfo

  VariantChangeType

  VariantCopy

  OleCreateFontIndirect

  LoadTypeLi

  SafeArrayGetLBound

  SafeArrayDestroy

  VariantTimeToSystemTime

  SystemTimeToVariantTime

  SafeArrayGetUBound

  SafeArrayUnaccessData

  SysStringLen

  SysAllocStringLen

  crypt32

  CryptMsgGetParam

  CertFindCertificateInStore

  CertFreeCertificateContext

  CertCloseStore

  CryptMsgClose

  CryptQueryObject

  CertGetNameStringW

  oleacc

  CreateStdAccessibleObject

  LresultFromObject

  wininet

  HttpOpenRequestW

  InternetConnectW

  HttpSendRequestW

  InternetReadFile

  InternetWriteFile

  InternetSetFilePointer

  InternetSetStatusCallbackW

  InternetOpenW

  InternetGetLastResponseInfoW

  InternetCloseHandle

  HttpQueryInfoW

  InternetQueryDataAvailable

  InternetCanonicalizeUrlW

  Exports

  Exports

  AcceptExternalOffer

  AddToOCOffersArray

  CallJSMethod

  CallJSMethodWithParams

  CancelExternalOffersInstallation

  CheckIsOfferReadyEx

  CreateWebInstallerBrowser

  DisableWindow

  EnableCurrentWindow

  GetCustomOfferCheckResult

  GetMachineID

  GetNavigateError

  Hide

  IfReadyShowExOffer

  InitBunndleExternalProvider

  InitOCOffersArray

  InitOpenCandyExternalProvider

  InstallExOffer

  IsBrowserCompletedNavigation

  IsDeclineButtonRequiredEX

  Load

  LoadNavigate

  Navigate

  NavigateAsync

  NoExternalProviderInit

  NotifyStubOnDMFinishInit

  PostInstallAction

  RunCustomOfferFile

  SearchInFile

  SearchInFileExtended

  SearchInFileExtendedChrome

  SearchInText

  SetCustomOffersNum

  SetPhase

  SetUserSession

  Show

  ShowBrowser

  ShowCertificate

  ShowLoadingScreen

  SkipAllExternalOffers

  SkipExternalOffer

  Unload

  UrlDecode

  WaitForAsyncExternalShowFinish

  WaitForDocComplete

  WaitForFinishModal

  WaitForUserLanguage

  WebAppHostExec

  WebAppHostExecWait

  Sections

  .text

  Size: 492KB - Virtual size: 492KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 182KB - Virtual size: 182KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 53KB - Virtual size: 400KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 26KB - Virtual size: 25KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 66KB - Virtual size: 65KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• $PLUGINSDIR/xml.dll

  .dll windows:4 windows x86 arch:x86

  b5ed5b3a951d4443ce56e5453702d536

  
  

  Code Sign

  7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

  Certificate

  Issuer

  CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

  Not Before

  21-12-2012 00:00

  Not After

  30-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

  Certificate

  Issuer

  CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

  Not Before

  18-10-2012 00:00

  Not After

  29-12-2020 23:59

  Subject

  CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  3a:82:65:47:19:d8:f7:5b:59:13:4f:7b:66:46:52:10

  Certificate

  Issuer

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Not Before

  03-01-2013 00:00

  Not After

  03-04-2016 23:59

  Subject

  CN=Conduit Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Conduit Ltd.,L=Ness Ziona,ST=Israel,C=IL

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

  Certificate

  Issuer

  CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

  Not Before

  08-02-2010 00:00

  Not After

  07-02-2020 23:59

  Subject

  CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageClientAuth

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageCertSign

  KeyUsageCRLSign

  30:76:b4:0f:a4:fd:d9:44:17:a0:90:5d:e0:2c:9a:83:74:65:c4:84

  Signer

  Actual PE Digest

  30:76:b4:0f:a4:fd:d9:44:17:a0:90:5d:e0:2c:9a:83:74:65:c4:84

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LINE_NUMS_STRIPPED

  IMAGE_FILE_LOCAL_SYMS_STRIPPED

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  Imports

  kernel32

  GlobalAlloc

  GlobalFree

  lstrcpynA

  lstrcmpA

  lstrcmpiA

  lstrcpyA

  RtlUnwind

  GetModuleFileNameA

  RaiseException

  GetCommandLineA

  GetVersionExA

  HeapFree

  HeapAlloc

  HeapReAlloc

  ExitProcess

  GetProcAddress

  GetModuleHandleA

  TerminateProcess

  GetCurrentProcess

  HeapSize

  GetLastError

  LoadLibraryA

  ReadFile

  SetHandleCount

  GetStdHandle

  GetFileType

  GetStartupInfoA

  SetFilePointer

  CloseHandle

  LCMapStringA

  WideCharToMultiByte

  MultiByteToWideChar

  LCMapStringW

  SetUnhandledExceptionFilter

  HeapDestroy

  HeapCreate

  VirtualFree

  FreeEnvironmentStringsA

  GetEnvironmentStrings

  FreeEnvironmentStringsW

  GetEnvironmentStringsW

  UnhandledExceptionFilter

  WriteFile

  VirtualAlloc

  IsBadWritePtr

  IsBadReadPtr

  IsBadCodePtr

  GetStringTypeA

  GetStringTypeW

  GetACP

  GetOEMCP

  GetCPInfo

  FlushFileBuffers

  QueryPerformanceCounter

  GetTickCount

  GetCurrentThreadId

  GetCurrentProcessId

  GetSystemTimeAsFileTime

  CreateFileA

  VirtualProtect

  GetSystemInfo

  VirtualQuery

  SetStdHandle

  GetLocaleInfoA

  InterlockedExchange

  SetEndOfFile

  Exports

  Exports

  _CloneNode

  _Coordinate

  _CreateNode

  _CreateText

  _CurrentAttribute

  _DeclarationEncoding

  _DeclarationStandalone

  _DeclarationVersion

  _ElementPath

  _FindCloseElement

  _FindNextElement

  _FirstAttribute

  _FirstChild

  _FirstChildElement

  _FreeNode

  _GetAttribute

  _GetNodeValue

  _GetText

  _GotoHandle

  _GotoPath

  _InsertAfterNode

  _InsertBeforeNode

  _InsertEndChild

  _IsCDATA

  _LastAttribute

  _LastChild

  _LoadFile

  _NextAttribute

  _NextSibling

  _NextSiblingElement

  _NoChildren

  _NodeHandle

  _NodeType

  _Parent

  _PreviousAttribute

  _PreviousSibling

  _RemoveAllChild

  _RemoveAttribute

  _RemoveNode

  _ReplaceNode

  _RootElement

  _SaveFile

  _SetAttribute

  _SetAttributeName

  _SetAttributeValue

  _SetCDATA

  _SetCondenseWhiteSpace

  _SetEncoding

  _SetNodeValue

  _SetText

  _Unload

  _XPathAttribute

  _XPathNode

  _XPathString

  Sections

  .text

  Size: 89KB - Virtual size: 89KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 16KB - Virtual size: 15KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 4KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .reloc

  Size: 7KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ