992d2db08bbb8216909c4cf105c804ca_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

992d2db08bbb8216909c4cf105c804ca_JaffaCakes118
Size

2.5MB
MD5

992d2db08bbb8216909c4cf105c804ca
SHA1

09223437db695493e50e96f6ccff5ef6d126e56a
SHA256

041d6a83d95b9f350ced539ff6cae5aa996244479dd6ed8f13343b4e3e3342bf
SHA512

a125b33541ec4754e7dad4e002568e43c291fa3e348bdb1d0ba474d03a8648c4e0bed5f7e8e3036ec3d91a39504d656198d0709a9b76b32a4087181f584276c1
SSDEEP

49152:I+zbNehomBwj1uOyHU+hqrlchch4rlA1JuLHwf7pLqw/BkGszp57zD5fvD:I+tehOhnufkr+C3Jukf8qkRzp57zhvD

Score

1^/10

Malware Config

Signatures

Files

992d2db08bbb8216909c4cf105c804ca_JaffaCakes118
.7z
1031.mst
1033.mst
1034.mst
1036.mst
1040.mst
1041.mst
1043.mst
1045.mst
1049.mst
2070.mst
AskToolbarInstaller-12.40.6_SGT-V6.msi
.msi
appdata/Mozilla/Firefox/Profiles/{DefaultProfilesFolder}/extensions/[email protected]
.zip
META-INF/manifest.mf
META-INF/mozilla.rsa
META-INF/mozilla.sf
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
chrome.manifest
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/logo_32x_24x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/button.png
.png
config/skin/images/search/line.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/js/init-tb-stuff.js
config/skin/js/newtab-overlay.js
.js
config/skin/js/newtab-subscript.js
.js
config/skin/newtab-overlay.xul
.xml
config/skin/overlay.xul
.xml
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/SPE-options/css/options.css
config/skin/widgets/SPE-options/images/button-blue-1x20.png
.png
config/skin/widgets/SPE-options/images/button-grey-1x26.png
.png
config/skin/widgets/SPE-options/images/button.png
.png
config/skin/widgets/SPE-options/images/icons.png
.png
config/skin/widgets/SPE-options/images/lightblue-1x43.png
.png
config/skin/widgets/SPE-options/images/trans-big.gif
.gif
config/skin/widgets/SPE-options/js/options.js
.js
config/skin/widgets/SPE-options/js/translations.js
.js
config/skin/widgets/SPE-options/js/translations.json
config/skin/widgets/SPE-options/options.html
.html
config/skin/widgets/amazon-navigation/button.png
.png
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/cnn/3.0/button.png
.png
config/skin/widgets/ebay_vanilla/button.png
.png
config/skin/widgets/facebook/button.png
.png
config/skin/widgets/map/3.0/button.png
.png
config/skin/widgets/netvibes-abc/button.png
.png
config/skin/widgets/netvibes-ascom/button.png
.png
config/skin/widgets/netvibes-bbc/button.png
.png
config/skin/widgets/netvibes-bbcsports/button.png
.png
config/skin/widgets/netvibes-beppegrillo/button.png
.png
config/skin/widgets/netvibes-corrieredellasera/button.png
.png
config/skin/widgets/netvibes-elmundo/button.png
.png
config/skin/widgets/netvibes-expansion/button.png
.png
config/skin/widgets/netvibes-financialtimes.de/button.png
.png
config/skin/widgets/netvibes-financialtimes/button.png
.png
config/skin/widgets/netvibes-folha/button.png
.png
config/skin/widgets/netvibes-g1/button.png
.png
config/skin/widgets/netvibes-kicker/button.png
.png
config/skin/widgets/netvibes-lagazzettadellosport/button.png
.png
config/skin/widgets/netvibes-lemonde/button.png
.png
config/skin/widgets/netvibes-lequipe/button.png
.png
config/skin/widgets/netvibes-mtv.it/button.png
.png
config/skin/widgets/netvibes-newsru/button.png
.png
config/skin/widgets/netvibes-nu-nl/button.png
.png
config/skin/widgets/netvibes-pbkdaily/button.png
.png
config/skin/widgets/netvibes-programmetv/button.png
.png
config/skin/widgets/netvibes-sportsnl/button.png
.png
config/skin/widgets/netvibes-sportsru/button.png
.png
config/skin/widgets/netvibes-todayinhistory/button.png
.png
config/skin/widgets/netvibes-uol/button.png
.png
config/skin/widgets/netvibes-voici/button.png
.png
config/skin/widgets/orkut/button.png
.png
config/skin/widgets/radio/5.0/button.png
.png
config/skin/widgets/simple-email-list/button.png
.png
config/skin/widgets/simple-email-list/gmail.png
.png
config/skin/widgets/simple-email-list/hotmail.png
.png
config/skin/widgets/simple-email-list/outlook.png
.png
config/skin/widgets/simple-email-list/yahoo!.png
.png
config/skin/widgets/ultimosegundo/button.png
.png
config/skin/widgets/vk/button.png
.png
config/skin/widgets/weather/7.0/button.png
.png
config/skin/widgets/wordoftheday/button.png
.png
config/skin/widgets/yt/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
.js
config/widget-config.json
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
icon.png
.png
install.rdf
.xml
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/constant.json
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/shims/jquery.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/update-constant.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
manifest.json
mozilla/JSONStore.jsm
.js
newtab/_newtab.html
.html
newtab/css/newtab.css
newtab/js/_newtab.js
newtab/js/jquery.js
.js
newtab/js/newtab.js
.js
newtab/newtab.html
newtab/search-suggestion/css/images/animated-overlay.gif
.gif
newtab/search-suggestion/css/images/ui-bg_diagonals-thick_18_b81900_40x40.png
.png
newtab/search-suggestion/css/images/ui-bg_diagonals-thick_20_666666_40x40.png
.png
newtab/search-suggestion/css/images/ui-bg_flat_10_000000_40x100.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_100_f6f6f6_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_100_fdf5ce_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_65_ffffff_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_gloss-wave_35_f6a828_500x100.png
.png
newtab/search-suggestion/css/images/ui-bg_highlight-soft_100_eeeeee_1x100.png
.png
newtab/search-suggestion/css/images/ui-bg_highlight-soft_75_ffe45c_1x100.png
.png
newtab/search-suggestion/css/images/ui-icons_222222_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_228ef1_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ef8c08_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ffd27a_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ffffff_256x240.png
.png
newtab/search-suggestion/css/jquery-ui.css
newtab/search-suggestion/css/search-suggestion.css
newtab/search-suggestion/js/jquery-ui.js
.js
newtab/search-suggestion/js/search-suggestion.js
.js
newtab/search-suggestion/js/storage.js
.js
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/ToolbarCR.crx
.zip
_metadata/verified_contents.json
background/OneTimeCode.js
.js
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/content-script.xul
.xml
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/init-tb-stuff.js
config/skin/newtab-overlay.xul
.js .xml polyglot
config/skin/newtab-subscript.js
.js
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/SPE-hide/button.png
.png
config/skin/widgets/SPE-options/css/options.css
config/skin/widgets/SPE-options/images/button-blue-1x20.png
.png
config/skin/widgets/SPE-options/images/button-grey-1x26.png
.png
config/skin/widgets/SPE-options/images/button.png
.png
config/skin/widgets/SPE-options/images/icons.png
.png
config/skin/widgets/SPE-options/images/lightblue-1x43.png
.png
config/skin/widgets/SPE-options/images/trans-big.gif
.gif
config/skin/widgets/SPE-options/js/options.js
.js
config/skin/widgets/SPE-options/js/translations.js
config/skin/widgets/SPE-options/options.html
.html
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/searchTheme-QA/button.png
.png
config/skin/widgets/searchTheme-images/button.png
.png
config/skin/widgets/searchTheme-news/button.png
.png
config/skin/widgets/searchTheme-video/button.png
.png
config/skin/widgets/searchTheme-web/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
config/widget-config.jse
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
icon.png
.png
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/json.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
manifest.json
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/bl-new-tab-page.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/new-tab-page.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/Update.xml
.xml
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/{Crx_Version}/Toolbar.crx
.zip
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/logo_32x_24x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/button.png
.png
config/skin/images/search/line.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/js/init-tb-stuff.js
config/skin/js/newtab-overlay.js
.js
config/skin/js/newtab-subscript.js
.js
config/skin/newtab-overlay.xul
.xml
config/skin/overlay.xul
.xml
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/about-ld/button.png
.png
config/skin/widgets/amazon_vanillald/button.png
.png
config/skin/widgets/amzon1_vanillald/button.png
.png
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/ebay_vanillald/button.png
.png
config/skin/widgets/facebook/button.png
.png
config/skin/widgets/games2_vanillald/BubbleTown.png
.png
config/skin/widgets/games2_vanillald/SlingoSupreme.png
.png
config/skin/widgets/games2_vanillald/blackjack_32.png
.png
config/skin/widgets/games2_vanillald/button.png
.png
config/skin/widgets/games2_vanillald/game-3in1checkers-01.png
.png
config/skin/widgets/games2_vanillald/game-4balls-01.png
.png
config/skin/widgets/games2_vanillald/game-cubefield-01.png
.png
config/skin/widgets/games2_vanillald/game-doublewires-01.png
.png
config/skin/widgets/games2_vanillald/game-fishdom.png
.png
config/skin/widgets/games2_vanillald/game-goldminer-01.png
.png
config/skin/widgets/games2_vanillald/game-jewelsolitare-01.png
.png
config/skin/widgets/games2_vanillald/game-pacxon-01.png
.png
config/skin/widgets/games2_vanillald/game-supercollapse.png
.png
config/skin/widgets/games2_vanillald/game-tropix-01.png
.png
config/skin/widgets/games2_vanillald/games.png
.png
config/skin/widgets/games2_vanillald/sudoku_32.png
.png
config/skin/widgets/games_vanillald/BubbleTown.png
.png
config/skin/widgets/games_vanillald/SlingoSupreme.png
.png
config/skin/widgets/games_vanillald/blackjack_32.png
.png
config/skin/widgets/games_vanillald/button.png
.png
config/skin/widgets/games_vanillald/game-3in1checkers-01.png
.png
config/skin/widgets/games_vanillald/game-4balls-01.png
.png
config/skin/widgets/games_vanillald/game-cubefield-01.png
.png
config/skin/widgets/games_vanillald/game-doublewires-01.png
.png
config/skin/widgets/games_vanillald/game-fishdom.png
.png
config/skin/widgets/games_vanillald/game-goldminer-01.png
.png
config/skin/widgets/games_vanillald/game-jewelsolitare-01.png
.png
config/skin/widgets/games_vanillald/game-pacxon-01.png
.png
config/skin/widgets/games_vanillald/game-supercollapse.png
.png
config/skin/widgets/games_vanillald/game-tropix-01.png
.png
config/skin/widgets/games_vanillald/games.png
.png
config/skin/widgets/games_vanillald/sudoku_32.png
.png
config/skin/widgets/mail_ld/button.png
.png
config/skin/widgets/mail_ld/gmail.png
.png
config/skin/widgets/mail_ld/hotmail.png
.png
config/skin/widgets/mail_ld/yahoo!.png
.png
config/skin/widgets/mail_vanillald/button.png
.png
config/skin/widgets/mail_vanillald/gmail.png
.png
config/skin/widgets/mail_vanillald/hotmail.png
.png
config/skin/widgets/mail_vanillald/yahoo!.png
.png
config/skin/widgets/map/3.0/button.png
.png
config/skin/widgets/netvibes-abc/button.png
.png
config/skin/widgets/netvibes-ascom/button.png
.png
config/skin/widgets/netvibes-bbc/button.png
.png
config/skin/widgets/netvibes-bbcsports/button.png
.png
config/skin/widgets/netvibes-beppegrillo/button.png
.png
config/skin/widgets/netvibes-corrieredellasera/button.png
.png
config/skin/widgets/netvibes-elmundo/button.png
.png
config/skin/widgets/netvibes-expansion/button.png
.png
config/skin/widgets/netvibes-financialtimes.de/button.png
.png
config/skin/widgets/netvibes-financialtimes/button.png
.png
config/skin/widgets/netvibes-folha/button.png
.png
config/skin/widgets/netvibes-g1/button.png
.png
config/skin/widgets/netvibes-kicker/button.png
.png
config/skin/widgets/netvibes-lagazzettadellosport/button.png
.png
config/skin/widgets/netvibes-lemonde/button.png
.png
config/skin/widgets/netvibes-lequipe/button.png
.png
config/skin/widgets/netvibes-mtv.it/button.png
.png
config/skin/widgets/netvibes-newsru/button.png
.png
config/skin/widgets/netvibes-nu-nl/button.png
.png
config/skin/widgets/netvibes-pbkdaily/button.png
.png
config/skin/widgets/netvibes-programmetv/button.png
.png
config/skin/widgets/netvibes-sportsnl/button.png
.png
config/skin/widgets/netvibes-sportsru/button.png
.png
config/skin/widgets/netvibes-todayinhistory/button.png
.png
config/skin/widgets/netvibes-uol/button.png
.png
config/skin/widgets/netvibes-voici/button.png
.png
config/skin/widgets/news/4.0/button.png
.png
config/skin/widgets/orkut/button.png
.png
config/skin/widgets/radio-dark-gray/5.0/button.png
.png
config/skin/widgets/toolbar-options_oracle/button.png
.png
config/skin/widgets/toolbar-options_oracle/css/options.css
config/skin/widgets/toolbar-options_oracle/images/button-blue-1x20.png
.png
config/skin/widgets/toolbar-options_oracle/images/button-grey-1x26.png
.png
config/skin/widgets/toolbar-options_oracle/images/button.png
.png
config/skin/widgets/toolbar-options_oracle/images/icons.png
.png
config/skin/widgets/toolbar-options_oracle/images/lightblue-1x43.png
.png
config/skin/widgets/toolbar-options_oracle/js/options.js
.js
config/skin/widgets/toolbar-options_oracle/js/translations.js
.js
config/skin/widgets/toolbar-options_oracle/js/translations.json
config/skin/widgets/toolbar-options_oracle/options.html
.html
config/skin/widgets/ultimosegundo/button.png
.png
config/skin/widgets/vk/button.png
.png
config/skin/widgets/wikipedia/button.png
.png
config/skin/widgets/yt/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
.js
config/widget-config.json
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/overlay.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
icon.png
.png
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/constant.json
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/update-constant.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
manifest.json
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
program files/AskPartnerNetwork/ChromeUtils/APNNativeMsgHost.exe
.exe windows:5 windows x86 arch:x86

55db544d9dfac26e9ec0b4cce98f3152

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

05/05/2015, 00:00

Not After

31/12/2015, 23:59

Subject

CN=COMODO Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:6b:e8:6f:25:92:81:38:b4:12:74:9a:c4:dc:ad:de:fb:51:86:3e
Signer

Actual PE Digest

41:6b:e8:6f:25:92:81:38:b4:12:74:9a:c4:dc:ad:de:fb:51:86:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\ANH_SRC\Release\APNNativeMsgHost.pdb

Imports

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

kernel32

GetModuleHandleW
WriteFile
OpenProcess
WideCharToMultiByte
LoadLibraryW
Sleep
SizeofResource
FormatMessageW
ReadFile
MultiByteToWideChar
lstrlenW
GetStdHandle
GetLastError
GetProcAddress
Process32FirstW
LocalAlloc
LockResource
GetLogicalDriveStringsW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
LocalSize
CloseHandle
GetCurrentProcessId
LocalFree
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
WriteConsoleW
CreateFileW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
RtlUnwind
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetModuleFileNameW
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW

user32

IsWindowEnabled
EnumWindows
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
IsWindowVisible
SendMessageW
GetWindowThreadProcessId
GetWindow

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/ChromeUtils/com.apn.native_messaging_host_aaaaklflnpehbaoodgpdnnfmnpobplpk.json
program files/AskPartnerNetwork/Toolbar/SO.dll
.dll windows:5 windows x86 arch:x86

e6b882e786d10f8a19dafa43be3dad53

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b6:0b:91:5f:a3:48:d1:9c:5e:44:86:ff:8a:9c:1c:ea:93:4f:3c:3b
Signer

Actual PE Digest

b6:0b:91:5f:a3:48:d1:9c:5e:44:86:ff:8a:9c:1c:ea:93:4f:3c:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\so.pdb

Imports

kernel32

ReadFile
GetFileSize
lstrlenA
GlobalAlloc
Sleep
MulDiv
GlobalUnlock
GlobalLock
InterlockedExchange
GlobalFree
GlobalHandle
CreateEventW
lstrcmpiW
SetEvent
WaitForMultipleObjects
SetFileAttributesW
GetFileAttributesW
DeleteFileW
SetFilePointer
GetVersionExW
LocalFree
LocalAlloc
WriteFile
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
CreateFileW
SetLastError
GetFileType
SetHandleCount
LCMapStringW
RtlUnwind
GetTimeZoneInformation
ExitProcess
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
ResumeThread
CreateThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
WideCharToMultiByte
WaitForSingleObject
CloseHandle
ReleaseMutex
CreateMutexW
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameA
OutputDebugStringW
GetCurrentThreadId
lstrcmpW
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
GetStartupInfoW
HeapAlloc
HeapDestroy

user32

DestroyWindow
RegisterWindowMessageW
CallWindowProcW
GetWindowLongW
CreateWindowExW
PostMessageW
DefWindowProcW
SetWindowRgn
SetLayeredWindowAttributes
ShowWindow
GetMonitorInfoW
IsWindow
SetTimer
KillTimer
RegisterClassExW
MonitorFromWindow
SendMessageW
GetKeyState
GetSysColor
GetWindow
GetParent
MoveWindow
GetWindowRect
CharNextW
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
UnregisterClassA
SetCapture
IsChild
GetDlgItem
LoadCursorW
GetClassInfoExW
SetWindowLongW
LoadStringW
EnableWindow
MapWindowPoints
GetForegroundWindow
CreateDialogIndirectParamW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
FrameRect
EndDialog
MapDialogRect
SetWindowContextHelpId
CreateAcceleratorTableW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW

gdi32

SetDIBColorTable
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
CreateRectRgn
CreateDIBSection

advapi32

InitializeAcl
GetNamedSecurityInfoW
GetAclInformation
ConvertStringSidToSidW
GetLengthSid
GetAce
AddAce
EqualSid
CopySid
SetNamedSecurityInfoW
FreeSid
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathAndSubDirW

ole32

CLSIDFromString
CoInitializeEx
CoUninitialize
ProgIDFromCLSID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

VarBstrCat
SafeArrayGetUBound
CreateErrorInfo
SetErrorInfo
OleCreateFontIndirect
SafeArrayGetLBound
SystemTimeToVariantTime
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCopy
SysFreeString
VariantClear
VariantCopy
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
SysAllocString
DispCallFunc
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VariantChangeType
VariantTimeToSystemTime
SafeArrayGetVartype

wininet

PrivacySetZonePreferenceW
InternetCrackUrlW
PrivacyGetZonePreferenceW

shlwapi

StrCmpW
StrCmpNW
UrlCreateFromPathW

urlmon

URLDownloadToFileW

gdiplus

GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdiplusStartup
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipFree
GdiplusShutdown
GdipDrawImageI
GdipGetImageGraphicsContext
GdipCloneImage
GdipGetImagePixelFormat

msimg32

AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 344KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/ServiceLocator.exe
.exe windows:5 windows x86 arch:x86

89deb219dcfb1b48f3237ccde8a4ff81

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:26:0f:5f:29:bc:9a:68:47:4a:67:49:21:cb:35:a1:ec:ef:a4:9a
Signer

Actual PE Digest

8a:26:0f:5f:29:bc:9a:68:47:4a:67:49:21:cb:35:a1:ec:ef:a4:9a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\ServiceLocator.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetModuleFileNameW
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
SetEvent
FreeLibrary
MultiByteToWideChar
DeleteCriticalSection
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
LockResource
FindResourceExW
GetStringTypeW
LCMapStringW
WideCharToMultiByte
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
WaitForSingleObject
CloseHandle
SizeofResource
lstrlenW
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
DecodePointer
EncodePointer
HeapSetInformation
GetStartupInfoW
ExitProcess
WriteFile
GetStdHandle
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess

user32

TranslateMessage
GetMessageW
PostThreadMessageW
CharNextW
CharUpperW
DispatchMessageW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoRegisterClassObject
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoResumeClassObjects
CoAddRefServerProcess
CoTaskMemAlloc
CoReleaseServerProcess
StringFromGUID2

oleaut32

VariantClear
VariantInit
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Toolbar.exe
.exe windows:5 windows x86 arch:x86

6915ed48c32ec702041d64a7316ce19c

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

b2:4f:47:f3:1c:26:2c:88:e7:4f:62:16:b6:73:fa:0e:a7:0a:70:47
Signer

Actual PE Digest

b2:4f:47:f3:1c:26:2c:88:e7:4f:62:16:b6:73:fa:0e:a7:0a:70:47

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\Toolbarcore.pdb

Imports

kernel32

DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
ResetEvent
GetCurrentProcessId
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExW
WaitForMultipleObjects
WaitForSingleObject
Sleep
CreateThread
GetCommandLineW
SetErrorMode
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
SetEndOfFile
GetStringTypeW
LCMapStringW
WriteFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
CreateFileA
LoadResource
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
HeapDestroy
HeapCreate
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
ReadFile
WideCharToMultiByte
CloseHandle
GetModuleHandleW
GetProcAddress
CreateFileW
GetFileSize
SetFilePointer
FindResourceExW
FindResourceW
LockResource
SizeofResource
LocalFree
SetLastError
GetCurrentThreadId
RaiseException
GlobalAlloc
EnterCriticalSection
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
GetLastError
lstrlenW
lstrlenA
GetCurrentProcess
FlushInstructionCache
MultiByteToWideChar
lstrcmpiW
HeapSetInformation
EncodePointer
DecodePointer
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
HeapAlloc
HeapFree
SetEvent
LeaveCriticalSection
GetSystemTimeAsFileTime

user32

IsWindow
SendMessageW
DefWindowProcW
PostMessageW
CallWindowProcW
GetKeyState
GetWindow
GetParent
GetSysColor
CharNextW
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
DestroyWindow
CreateWindowExW
GetWindowLongW
SetWindowLongW
PostThreadMessageW
CharUpperW
UnregisterClassA
GetMessageW
DispatchMessageW
TranslateMessage
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
GetStockObject

advapi32

RegOpenKeyExW
CryptVerifySignatureW
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CryptGetHashParam
RegSetValueExW
RegEnumKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey

shell32

SHGetFolderPathAndSubDirW
ord165

ole32

StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
OleUninitialize
CoReleaseServerProcess
CoAddRefServerProcess
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitialize
CoTaskMemFree

oleaut32

VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarBstrCmp
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
VariantCopy
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysAllocString
VarBstrCat

shlwapi

PathFileExistsW
UrlCreateFromPathW

urlmon

CoInternetSetFeatureEnabled

crypt32

CryptDecodeObjectEx
CryptImportPublicKeyInfo

Sections

.text
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/ToolbarPS.dll
.dll regsvr32 windows:5 windows x86 arch:x86

535bb2ccc6052bcfc9df013593e51b6b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:3a:bb:1c:6a:48:3e:96:ac:23:c7:2b:a9:92:e2:a0:9e:c7:b5:32
Signer

Actual PE Digest

20:3a:bb:1c:6a:48:3e:96:ac:23:c7:2b:a9:92:e2:a0:9e:c7:b5:32

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
HeapSize
GetStringTypeW
MultiByteToWideChar
LCMapStringW
RtlUnwind
GetModuleFileNameW
WriteFile
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
HeapReAlloc
HeapAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent

rpcrt4

NdrOleAllocate
NdrOleFree
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy

oleaut32

VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/UpdateManager.exe
.exe windows:5 windows x86 arch:x86

d82b0d874f4b64c36ccecebc5a328cc2

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:93:ae:33:fe:b3:8b:62:42:e9:cd:f5:77:bd:be:20:82:23:39:c4
Signer

Actual PE Digest

32:93:ae:33:fe:b3:8b:62:42:e9:cd:f5:77:bd:be:20:82:23:39:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\UpdateManager.pdb

Imports

kernel32

CreateDirectoryW
LoadLibraryW
FreeLibrary
lstrcmpiW
GetExitCodeProcess
GetVersionExW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
WaitForSingleObject
SetEvent
CreateEventW
GetLastError
GetModuleHandleW
GetProcAddress
Sleep
CloseHandle
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
FlushFileBuffers
MultiByteToWideChar
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
SetFilePointer
GetConsoleCP
GetConsoleMode

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumValueW

shell32

ShellExecuteExW
SHGetFolderPathW

ole32

CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitializeEx

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/TBNotifier.exe
.exe windows:5 windows x86 arch:x86

884e20ffbabcd08a1a11c806045d94e9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:27:31:65:b8:8f:b7:1a:b2:54:63:97:46:03:bd:2a:71:eb:4c:d7
Signer

Actual PE Digest

ec:27:31:65:b8:8f:b7:1a:b2:54:63:97:46:03:bd:2a:71:eb:4c:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\TBNotifier.pdb

Imports

msi

ord70
ord195

wtsapi32

WTSQuerySessionInformationW
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSEnumerateProcessesW
WTSFreeMemory

kernel32

SetEvent
CreateEventW
ReleaseMutex
CreateMutexW
GetSystemTime
ResetEvent
WaitForMultipleObjects
LocalFree
GetCurrentProcessId
GetFileSize
ReadFile
FindClose
GetPrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
ProcessIdToSessionId
GetUserDefaultUILanguage
CreateThread
FormatMessageW
GetFileAttributesW
TerminateThread
GetWindowsDirectoryW
MoveFileW
SetNamedPipeHandleState
OutputDebugStringW
WaitNamedPipeW
CreateTimerQueueTimer
DeleteTimerQueueTimer
LocalAlloc
lstrcmpA
DuplicateHandle
lstrcmpiW
LoadLibraryExW
GetSystemInfo
GetNativeSystemInfo
IsWow64Process
WritePrivateProfileStringW
LockFile
UnlockFile
SetFilePointer
GetLocalTime
OutputDebugStringA
DecodePointer
CreateProcessW
SystemTimeToFileTime
CompareFileTime
lstrlenA
FindFirstChangeNotificationW
FindNextChangeNotification
FormatMessageA
CreateFileA
GetFullPathNameA
GetFullPathNameW
SetEnvironmentVariableA
SetEndOfFile
WriteConsoleW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
InterlockedDecrement
GetOEMCP
GetACP
IsValidCodePage
AreFileApisANSI
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineW
GetSystemTimeAsFileTime
VirtualQuery
VirtualProtect
ExitThread
RtlUnwind
EncodePointer
GetStringTypeW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
QueryDosDeviceW
LoadLibraryW
DeleteFileA
GetTempPathA
GetVersionExA
LoadLibraryA
LockFileEx
GetFileAttributesA
LockResource
GetProcAddress
GetLogicalDriveStringsW
GetProcessId
TerminateProcess
OpenProcess
FreeLibrary
WideCharToMultiByte
CreateFileW
WriteFile
GetSystemDefaultLangID
MultiByteToWideChar
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
SizeofResource
GetModuleHandleW
FindResourceW
FindResourceExW
RaiseException
GetTickCount
lstrlenW
InterlockedIncrement
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
CloseHandle
InterlockedExchange
GlobalAlloc
GlobalLock
GlobalHandle
GetVersionExW
GetModuleFileNameW
OpenMutexW
lstrcmpW
MulDiv
Sleep
InitializeCriticalSection
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
GlobalFree
GlobalUnlock
GetStdHandle

user32

GetClassInfoExW
CreateWindowExW
IsWindow
IsChild
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
TranslateMessage
LoadStringW
GetSysColorBrush
MessageBoxW
GetMessageW
LoadAcceleratorsW
DialogBoxIndirectParamW
RegisterClassExW
WindowFromPoint
SystemParametersInfoW
IsDlgButtonChecked
CheckDlgButton
AnimateWindow
IsRectEmpty
SetRectEmpty
PostThreadMessageW
SetRect
IsDialogMessageW
CallNextHookEx
SetWindowsHookExW
GetActiveWindow
MsgWaitForMultipleObjects
PeekMessageW
FindWindowW
GetForegroundWindow
CallWindowProcW
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
RegisterWindowMessageW
UnregisterClassW
TranslateAcceleratorW
keybd_event
GetAsyncKeyState
SendMessageTimeoutW
GetWindowThreadProcessId
EnumThreadWindows
EnumWindows
SetForegroundWindow
SetActiveWindow
SetWindowRgn
BringWindowToTop
IsWindowVisible
CreateDialogIndirectParamW
EndDialog
GetDlgItem
SendDlgItemMessageW
CharNextW
SetFocus
GetFocus
SetCapture
ReleaseCapture
EnableWindow
CreateAcceleratorTableW
DestroyAcceleratorTable
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
SetWindowContextHelpId
ClientToScreen
ScreenToClient
GetSysColor
FillRect
GetWindowLongW
SetWindowLongW
PostQuitMessage
KillTimer
SetTimer
GetDesktopWindow
GetParent
SetDlgItemTextW
EnumChildWindows
PtInRect
GetCursorPos
UnhookWinEvent
GetClassNameW
GetWindow
LoadCursorW
LoadImageW
DrawIconEx
MapDialogRect
SetWinEventHook

gdi32

SetBkMode
SelectObject
GetTextExtentPoint32W
GetStockObject
GetDeviceCaps
SetTextColor
CreateSolidBrush
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
GetTextMetricsW
CreateDIBSection
SetDIBColorTable
GetObjectW
TextOutW
CreatePolygonRgn
CreatePen
StretchBlt
DeleteObject
GetTextExtentPointW
Rectangle

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegNotifyChangeKeyValue
RegFlushKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
SHAppBarMessage
SHGetFolderPathAndSubDirW
SHGetSpecialFolderPathW
ShellExecuteExW
SHGetFolderPathW

ole32

OleInitialize
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoUninitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess
OleLockRunning
CoInitialize
CreateStreamOnHGlobal

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
VarCmp
SysAllocStringByteLen
OleCreateFontIndirect
VarDateFromStr
VarBstrCmp
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
VarUI4FromStr
VarUdateFromDate
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
SysStringByteLen
SysAllocString
SysFreeString

shlwapi

PathFindFileNameW
StrStrIW
UrlCreateFromPathW
PathFileExistsW
PathRemoveFileSpecW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptBinaryToStringA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDeleteBrush
GdipCreateSolidFill
GdipCreateFromHDC
GdipFillRectangleI
GdipCreateFontFromDC
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipSetTextRenderingHint

msimg32

TransparentBlt
AlphaBlend

wintrust

WinVerifyTrust

oleacc

WindowFromAccessibleObject
AccessibleChildren
AccessibleObjectFromEvent
AccessibleObjectFromWindow

wininet

InternetSetOptionW
InternetCanonicalizeUrlW
HttpQueryInfoW
HttpOpenRequestW
InternetCrackUrlW
InternetOpenW
InternetCloseHandle
InternetConnectW
InternetReadFile
HttpSendRequestW

comctl32

ord17

ws2_32

WSACleanup
getaddrinfo
setsockopt
WSAStartup
recv
ntohs
listen
getsockname
socket
send
accept
bind
closesocket
freeaddrinfo

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 246KB - Virtual size: 245KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 37KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/ask-search.xml
.xml
program files/AskPartnerNetwork/Toolbar/Updater/tbnhlpr.exe
.exe windows:5 windows x86 arch:x86

45b888999868de5172cedef29529e4d5

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

66:ab:ad:c5:17:fe:73:41:8b:82:4f:b7:50:46:6f:4e:38:9e:00:66
Signer

Actual PE Digest

66:ab:ad:c5:17:fe:73:41:8b:82:4f:b7:50:46:6f:4e:38:9e:00:66

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\tbnhlpr.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
GetProcAddress
OutputDebugStringA
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
GetModuleHandleW
CreateFileW
ReadConsoleW
HeapFree
HeapAlloc
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetStdHandle
LoadLibraryExW
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
MultiByteToWideChar
GetStringTypeW
GetCommandLineW
RtlUnwind
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/tbnhlpr_x64.exe
.exe windows:5 windows x64 arch:x64

845c829a257701c426ef7aeede2ceae9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

29:d0:1a:d7:93:9b:9c:6a:10:3c:95:bb:6c:07:6b:9d:f9:54:96:71
Signer

Actual PE Digest

29:d0:1a:d7:93:9b:9c:6a:10:3c:95:bb:6c:07:6b:9d:f9:54:96:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\tbnhlpr_x64.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
GetProcAddress
OutputDebugStringA
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
GetModuleHandleW
CreateFileW
ReadConsoleW
HeapFree
HeapAlloc
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetStdHandle
LoadLibraryExW
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
MultiByteToWideChar
GetStringTypeW
GetCommandLineW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/{PartnerID}/config.xml
program files/AskPartnerNetwork/Toolbar/apnmcp.exe
.exe windows:5 windows x86 arch:x86

a9f3f4f9683b4e838751af9481997dff

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fd:1d:ea:e4:8e:c1:1e:e8:b1:91:63:2e:02:8a:f0:df:68:b5:b3:8f
Signer

Actual PE Digest

fd:1d:ea:e4:8e:c1:1e:e8:b1:91:63:2e:02:8a:f0:df:68:b5:b3:8f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\apnmcp.pdb

Imports

psapi

GetModuleFileNameExW

kernel32

Sleep
MultiByteToWideChar
FreeLibrary
LoadLibraryW
GetCurrentProcessId
lstrcmpA
WTSGetActiveConsoleSessionId
CreateDirectoryW
GetTempPathW
WriteFile
ReadFile
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
GetStringTypeW
GetConsoleMode
GetConsoleCP
SetFilePointer
FindFirstFileW
lstrcmpW
FindNextFileW
FindClose
WaitForSingleObject
SetEvent
GetSystemTime
lstrcpynW
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
Process32NextW
OpenProcess
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
ResetEvent
GetModuleFileNameW
lstrcpyW
lstrlenW
lstrcmpiW
InterlockedDecrement
MapViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateEventW
LocalAlloc
LocalFree
GetCurrentThreadId
GetVersionExW
GetModuleHandleW
GetProcAddress
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SetEnvironmentVariableA
GetLastError
RaiseException
CompareStringW
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetTimeZoneInformation
WideCharToMultiByte
GetStdHandle
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
ExitThread
EncodePointer
DecodePointer
RtlUnwind
GetSystemTimeAsFileTime
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
GetCommandLineW
CreateThread
SetThreadPriority
WaitForMultipleObjects
FindCloseChangeNotification
FindFirstChangeNotificationW
CreateFileW
CloseHandle
lstrcatW
HeapAlloc
HeapDestroy
LeaveCriticalSection
EnterCriticalSection

user32

PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
MsgWaitForMultipleObjects
CharUpperW
CharNextW
LoadStringW
MessageBoxW
SetTimer
KillTimer
RegisterWindowMessageW
PostThreadMessageW

advapi32

SetTokenInformation
RegEnumValueW
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumKeyExW
GetTokenInformation
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
ControlService
DeleteService
CreateServiceW
OpenProcessToken
DuplicateTokenEx
CreateProcessAsUserW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
QueryServiceConfigW
ChangeServiceConfigW
ChangeServiceConfig2W
CreateWellKnownSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetAclInformation
GetAce
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CoCreateInstance
CoAddRefServerProcess
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoReleaseServerProcess
CoTaskMemFree
CoInitializeSecurity

oleaut32

SysFreeString
VariantInit
VariantClear
VariantChangeType
SysAllocString

shlwapi

SHSetValueW
PathQuoteSpacesW
PathFindFileNameW
PathAddBackslashW
SHGetValueW

winhttp

WinHttpCloseHandle
WinHttpOpen
WinHttpSetOption
WinHttpCrackUrl
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock
UnloadUserProfile

crypt32

CertCloseStore
CryptMsgClose
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext

wintrust

WinVerifyTrust

msi

ord195

Sections

.text
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/searchhook.dll
.dll regsvr32 windows:5 windows x86 arch:x86

d315beb5b6d9bf1e814e0f786dfaa448

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2a:a7:93:58:23:1b:13:ec:2c:f7:0a:1e:7f:40:b0:02:96:5c:d0:af
Signer

Actual PE Digest

2a:a7:93:58:23:1b:13:ec:2c:f7:0a:1e:7f:40:b0:02:96:5c:d0:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\searchhook.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
lstrlenW
GetModuleFileNameW
SetThreadLocale
GetThreadLocale
InterlockedDecrement
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
SizeofResource
RaiseException
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
RtlUnwind
GetCurrentThreadId
GetCommandLineA
Sleep
ExitProcess
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

ole32

StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

ws2_32

freeaddrinfo
getaddrinfo

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/toolbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

26da0019c4be13aff5cbbbde96e0cdc1

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d3:91:58:f2:73:57:1b:47:3b:af:91:0d:db:05:d9:d9:fc:30:40:39
Signer

Actual PE Digest

d3:91:58:f2:73:57:1b:47:3b:af:91:0d:db:05:d9:d9:fc:30:40:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\toolbar.pdb

Imports

kernel32

LocalAlloc
LocalFree
LoadLibraryW
lstrcmpiW
Sleep
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
WaitForSingleObject
ResumeThread
lstrcmpA
MoveFileW
GetTempFileNameW
GetTempPathW
MulDiv
CreateFileW
MultiByteToWideChar
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
DecodePointer
EncodePointer
RtlUnwind
CreateThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
lstrcmpW
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetTickCount
FreeLibrary
GetVersionExW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalFindAtomW
WaitForMultipleObjects
GetLastError
ResetEvent
GetModuleFileNameW
InterlockedExchange
lstrlenW
SetLastError
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
CloseHandle
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
IsValidCodePage
WriteFile
GetStdHandle
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetEvent
CreateEventW
HeapAlloc
GetStringTypeW
TerminateProcess

user32

GetDesktopWindow
IsIconic
SetWindowTextW
InvalidateRect
GetClientRect
PeekMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA
UpdateWindow
PtInRect
SendMessageW
GetCursorPos
WindowFromPoint
ScreenToClient
GetParent
GetClassNameW
GetAncestor
FindWindowExW
RegisterWindowMessageW
CreateWindowExW
CallWindowProcW
GetWindowLongW
RegisterClassExW
DefWindowProcW
IsWindow
GetWindowRect
GetDC
ReleaseDC
DestroyWindow
LoadCursorW
GetClassInfoExW
PostMessageW
SetWindowLongW
ShowWindow

gdi32

CreateFontW
SetBkMode
GetStockObject
CreateDIBSection
CreateCompatibleBitmap
BitBlt
GetPixel
DeleteObject
GetObjectW
SelectObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps

advapi32

RegCloseKey
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW

shell32

SHGetFolderPathAndSubDirW
ShellExecuteW

ole32

CLSIDFromString
CreateStreamOnHGlobal
CoLockObjectExternal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2

oleaut32

SysFreeString
VariantInit
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear

shlwapi

PathFindExtensionW
UrlCreateFromPathW

crypt32

CryptDecodeObject
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust

gdiplus

GdipDrawImageRectI
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipLoadImageFromStreamICM
GdipDeleteGraphics
GdipCloneImage
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImageWidth

uxtheme

DrawThemeParentBackground
IsThemeActive

Exports

Exports

DllCanUnloadNow
DllCanUnloadNowCRX
DllCanUnloadNowTSB
DllGetClassObject
DllGetClassObjectCRX
DllGetClassObjectTSB
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/toolbar_x64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

cb1ad7486f4da2a8b4c9d769f169188f

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:1c:17:04:fb:96:6c:16:1f:92:f9:1b:a4:ed:f5:15:b6:b4:84:28
Signer

Actual PE Digest

06:1c:17:04:fb:96:6c:16:1f:92:f9:1b:a4:ed:f5:15:b6:b4:84:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\x64\Release\toolbar_x64.pdb

Imports

kernel32

lstrcmpiW
Sleep
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
WaitForSingleObject
ResumeThread
lstrcmpA
MoveFileW
GetTempFileNameW
GetTempPathW
MulDiv
CreateFileW
MultiByteToWideChar
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
lstrlenW
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
FlsAlloc
FlsFree
FlsGetValue
HeapCreate
LocalFree
LocalAlloc
lstrcmpW
GetTickCount
FreeLibrary
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalFindAtomW
WaitForMultipleObjects
GetLastError
ResetEvent
GetModuleFileNameW
SetLastError
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
CloseHandle
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
GetVersion
HeapSetInformation
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
FlsSetValue
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
RtlPcToFileHeader
ExitThread
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetEvent
LCMapStringW
CreateEventW
VirtualProtect
DecodePointer
EncodePointer
RtlUnwindEx
RtlLookupFunctionEntry
CreateThread
InterlockedPushEntrySList

user32

CreateWindowExW
RegisterWindowMessageW
FindWindowExW
GetAncestor
GetClassNameW
GetParent
ScreenToClient
WindowFromPoint
GetCursorPos
SendMessageW
PtInRect
GetWindowLongPtrW
ShowWindow
DispatchMessageW
RegisterClassExW
PeekMessageW
GetClientRect
InvalidateRect
SetWindowTextW
IsIconic
GetDesktopWindow
DefWindowProcW
SetWindowLongPtrW
UpdateWindow
CallWindowProcW
PostMessageW
GetClassInfoExW
LoadCursorW
DestroyWindow
ReleaseDC
GetDC
GetWindowRect
TranslateMessage
UnregisterClassA
IsWindow

gdi32

CreateFontW
SetBkMode
GetStockObject
CreateDIBSection
CreateCompatibleBitmap
BitBlt
GetPixel
DeleteObject
GetObjectW
SelectObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps

advapi32

RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathAndSubDirW

ole32

CoTaskMemFree
CoLockObjectExternal
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc

oleaut32

LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

UrlCreateFromPathW
PathFindExtensionW

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptDecodeObject
CryptQueryObject

wintrust

WinVerifyTrust

gdiplus

GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdiplusShutdown
GdipAlloc
GdipCloneImage
GdipDeleteGraphics
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdiplusStartup
GdipFree
GdipGetImageEncoders
GdipLoadImageFromStreamICM
GdipDrawImageRectI
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount

uxtheme

DrawThemeParentBackground
IsThemeActive

Exports

Exports

DllCanUnloadNow
DllCanUnloadNowCRX
DllCanUnloadNowTSB
DllGetClassObject
DllGetClassObjectCRX
DllGetClassObjectTSB
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/{PartnerID}/Passport.dll
.dll windows:5 windows x86 arch:x86

f5aea7b43d8246a57c78cdb8d98c2685

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ff:28:6f:e6:b0:ab:7f:28:98:67:a4:a4:f9:91:6a:d8:2d:63:54:3e
Signer

Actual PE Digest

ff:28:6f:e6:b0:ab:7f:28:98:67:a4:a4:f9:91:6a:d8:2d:63:54:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\Passport.pdb

Imports

kernel32

FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryW
GetModuleFileNameW
GetProcAddress
lstrcmpiW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 874B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/{PartnerID}/Passport_x64.dll
.dll windows:5 windows x64 arch:x64

c7f3bf7296dc44c871edca9a01413923

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ab:c7:1f:11:b1:2d:7f:72:75:78:df:d7:4a:0e:4b:1b:f8:8a:4d:dd
Signer

Actual PE Digest

ab:c7:1f:11:b1:2d:7f:72:75:78:df:d7:4a:0e:4b:1b:f8:8a:4d:dd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\x64\Release\Passport_x64.pdb

Imports

kernel32

FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryW
GetModuleFileNameW
GetProcAddress
lstrcmpiW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

55db544d9dfac26e9ec0b4cce98f3152

Code Sign

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6Certificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

41:6b:e8:6f:25:92:81:38:b4:12:74:9a:c4:dc:ad:de:fb:51:86:3eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 115KB - Virtual size: 114KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

e6b882e786d10f8a19dafa43be3dad53

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

b6:0b:91:5f:a3:48:d1:9c:5e:44:86:ff:8a:9c:1c:ea:93:4f:3c:3bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

wininet

shlwapi

urlmon

gdiplus

msimg32

Exports

Exports

Sections

.text Size: 344KB - Virtual size: 343KB

.rdata Size: 94KB - Virtual size: 94KB

.data Size: 41KB - Virtual size: 49KB

.rsrc Size: 136KB - Virtual size: 135KB

.reloc Size: 40KB - Virtual size: 40KB

89deb219dcfb1b48f3237ccde8a4ff81

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

9f:ea:c8:11:b0:f1:62:47:a5:fc:20:d8:05:23:ac:e6
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

41:6b:e8:6f:25:92:81:38:b4:12:74:9a:c4:dc:ad:de:fb:51:86:3e
Signer

.text
Size: 115KB - Virtual size: 114KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b6:0b:91:5f:a3:48:d1:9c:5e:44:86:ff:8a:9c:1c:ea:93:4f:3c:3b
Signer

.text
Size: 344KB - Virtual size: 343KB

.rdata
Size: 94KB - Virtual size: 94KB

.data
Size: 41KB - Virtual size: 49KB

.rsrc
Size: 136KB - Virtual size: 135KB

.reloc
Size: 40KB - Virtual size: 40KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

8a:26:0f:5f:29:bc:9a:68:47:4a:67:49:21:cb:35:a1:ec:ef:a4:9a
Signer

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: 20KB - Virtual size: 20KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 7KB - Virtual size: 7KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

b2:4f:47:f3:1c:26:2c:88:e7:4f:62:16:b6:73:fa:0e:a7:0a:70:47
Signer

.text
Size: 189KB - Virtual size: 188KB

.rdata
Size: 50KB - Virtual size: 50KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 108KB - Virtual size: 107KB

.reloc
Size: 16KB - Virtual size: 16KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

20:3a:bb:1c:6a:48:3e:96:ac:23:c7:2b:a9:92:e2:a0:9e:c7:b5:32
Signer