22ecef7101f3b5776a7700b203a97e07_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

22ecef7101f3b5776a7700b203a97e07_JaffaCakes118
Size

1.4MB
MD5

22ecef7101f3b5776a7700b203a97e07
SHA1

88b960afd001bfe43129ae7c79f9f4d9b7ffeec3
SHA256

e193bd943020e858d102364c7fe9af717a9a95538056ca1fc17da5c030d86b02
SHA512

3a0e88b81071d29f1f62317eea3e12c6854cda6415a53aef7cc7db54a0319ddde3bd4bd8f32a6d814c6e2aa500c4cc176cc7d1ab8107695f2bd76803724c5519
SSDEEP

24576:CRIsqzNAtYKplpZFdKwKg8AUG06Wa0XrOedsd7t+K9SPok55IJNylCT7gTj:cdqzNAtz3kwt8f68g1SdIT70j

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
22ecef7101f3b5776a7700b203a97e07_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$TEMP/4890_alotappbarinstaller_enus7flv_ff.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsisunz.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/4890_alotappbarinstaller_enus7flv_ff.exe	nsis_installer_1
static1/unpack001/$TEMP/4890_alotappbarinstaller_enus7flv_ff.exe	nsis_installer_2

Files

22ecef7101f3b5776a7700b203a97e07_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/4890_alotappbarinstaller_enus7flv.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:78:b2:50:0b:11:2a:0a:92:80:65:dc:e6:b0:d5:de:00:df:25:ed
Signer

Actual PE Digest

4e:78:b2:50:0b:11:2a:0a:92:80:65:dc:e6:b0:d5:de:00:df:25:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 980KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$1/$PROGRAMFILES/alotappbar/alotUninst.exe.nsis
$1/ALOTSettings.exe
.exe windows:5 windows x86 arch:x86

ba8e0ea689ca147fe801b09814f69ea1

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\alotappbar\bin\support\ALOTSettings.pdb

Imports

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules

kernel32

LCMapStringW
Sleep
RtlUnwind
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
CreateRemoteThread
OpenProcess
WideCharToMultiByte
VirtualFreeEx
TerminateProcess
lstrlenW
GetLastError
SetLastError
GetProcAddress
VirtualAllocEx
GetExitCodeThread
CloseHandle
WriteProcessMemory
GetProcessHeap
HeapAlloc
HeapSize
MultiByteToWideChar
RaiseException
HeapFree
HeapReAlloc
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleA
VirtualProtect
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
PostMessageW
RegisterWindowMessageW
SetParent
SendMessageW

advapi32

RegCreateKeyExW
RegSetValueExW

shlwapi

SHDeleteKeyW

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotappbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

4c3d69d950a178143f6cab975b5d2253

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\alotappbar\bin\support\band_ew.pdb

Imports

uxtheme

SetWindowTheme

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
FindResourceExW
LoadLibraryA
InterlockedExchange
OpenMutexW
GetTempFileNameW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
CreateFileW
SetEndOfFile
SetFileAttributesW
InitializeCriticalSection
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
ResumeThread
TerminateThread
ResetEvent
SetCurrentDirectoryW
GetSystemTimeAsFileTime
LocalFree
FormatMessageW
GetModuleFileNameA
GetFileAttributesExW
GetLongPathNameW
GetExitCodeProcess
CreateProcessW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrlenA
GetCurrentDirectoryW
FindNextFileW
CreateDirectoryW
GetProcessHeap
CreateMutexW
HeapReAlloc
HeapAlloc
HeapFree
SignalObjectAndWait
lstrcpynW
SystemTimeToFileTime
GetSystemTime
DuplicateHandle
VirtualProtect
VirtualQuery
Thread32Next
Thread32First
SuspendThread
OpenThread
DecodePointer
EncodePointer
ExitThread
CreateThread
RtlUnwind
VirtualAlloc
GetSystemInfo
GetCommandLineA
IsProcessorFeaturePresent
HeapCreate
HeapDestroy
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
WaitForMultipleObjects
ReleaseMutex
CreateEventW
SetEvent
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
VirtualFreeEx
CloseHandle
GetCurrentProcessId
Sleep
lstrlenW
FreeLibrary
GetCurrentThreadId
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
lstrcpyW
GetCurrentProcess
FlushInstructionCache
GetTickCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
HeapSize
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
LocalAlloc

user32

ModifyMenuW
GetSystemMenu
SetClassLongW
DrawTextW
MonitorFromPoint
EndDialog
SendNotifyMessageW
UpdateWindow
WindowFromPoint
FrameRect
CreatePopupMenu
TrackPopupMenu
GetUpdateRect
AppendMenuW
InsertMenuW
SetMenuItemInfoW
SetDlgItemTextW
CheckDlgButton
CheckRadioButton
GetDlgItemTextW
IsDlgButtonChecked
SendDlgItemMessageW
GetWindowDC
DrawTextExW
UnregisterClassW
GetSystemMetrics
GetTopWindow
IntersectRect
GetActiveWindow
IsIconic
RegisterClipboardFormatW
GetMenuState
GetSysColorBrush
GetMenuItemRect
DeleteMenu
DestroyMenu
CopyRect
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
CopyImage
DialogBoxParamW
KillTimer
SetTimer
CharLowerW
CharUpperW
SendMessageTimeoutW
SystemParametersInfoW
EnumChildWindows
GetAncestor
EnumWindows
OffsetRect
MsgWaitForMultipleObjects
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
BroadcastSystemMessageW
LoadImageW
DestroyCursor
DestroyIcon
GetCursorPos
SetCursor
GetCursor
SetWindowRgn
PtInRect
TrackMouseEvent
IsWindowEnabled
DialogBoxIndirectParamW
CreateDialogIndirectParamW
IsWindowVisible
MessageBoxW
GetWindowTextLengthW
CreateAcceleratorTableW
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
SetCapture
UnregisterClassA
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
IsChild
GetDlgItem
CharNextW
GetWindowPlacement
SetForegroundWindow
SetActiveWindow
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
ShowWindow
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageA
DispatchMessageA
RegisterWindowMessageW
PostThreadMessageW
GetWindowThreadProcessId
CallWindowProcW
LoadStringW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowTextW
GetKeyState
SetWindowTextW
GetFocus
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
wsprintfW
LoadCursorW
IsWindow
SendMessageW
PostMessageW
SetWindowLongW
EnableWindow

gdi32

DeleteDC
DeleteObject
GetTextMetricsW
IntersectClipRect
SetBkMode
GetPixel
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
GetDIBColorTable
MoveToEx
LineTo
CreateFontIndirectW
SetBkColor
ExtTextOutW
GetTextExtentPoint32W
CreatePen
RoundRect
SetTextColor
CreateFontW
FrameRgn
SetDIBColorTable
CreateRoundRectRgn
CreatePolygonRgn
CreateRectRgn
CombineRgn
CreateDIBSection
SetStretchBltMode
StretchBlt
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetDesktopFolder
SHGetMalloc
ord165
ShellExecuteExW
SHGetSpecialFolderPathW
ord92
SHFileOperationW
SHFileOperationA

ole32

CoGetInterfaceAndReleaseStream
OleDuplicateData
CoInitialize
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
StringFromCLSID
OleInitialize
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SafeArrayPutElement
VariantInit
SafeArrayDestroy
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
GetErrorInfo
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayUnaccessData
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VarBstrCmp
SysStringLen
VarUI4FromStr
SysFreeString
VariantCopyInd
VariantChangeType
DispCallFunc
VariantClear

shlwapi

SHGetValueW
UrlIsW
PathCreateFromUrlW
PathFindFileNameW
PathIsRelativeW
SHRegWriteUSValueW
SHRegCreateUSKeyW
UrlUnescapeW
PathAppendW
StrCmpIW
PathFileExistsW
SHDeleteValueW
StrRetToStrW
PathIsURLW
SHCopyKeyW
UrlGetPartW
PathFindExtensionW
UrlCanonicalizeW
SHDeleteKeyW

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 778KB - Virtual size: 778KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 163KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alothelper.dll
.dll regsvr32 windows:5 windows x86 arch:x86

45ba23ce55fab08c44526b36f3dd715a

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\alotappbar\ALOTHelper\Release\ALOTHelper.pdb

Imports

shlwapi

SHGetValueW

kernel32

EncodePointer
lstrcpyW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
lstrcatW
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
WriteFile
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
RaiseException
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter

user32

DestroyWindow
PostMessageW
GetClassInfoW
IsWindow
GetWindowLongW
SetWindowLongW
DefWindowProcW
ShowWindow
GetParent
CreateWindowExW
RegisterClassW
GetClientRect

oleaut32

VariantInit
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotservice.exe
.exe windows:5 windows x86 arch:x86

042c919e13a5046adf0dbc56330f60bb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

CoInternetCompareUrl
URLDownloadToFileW
ObtainUserAgentString

wtsapi32

WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSQueryUserToken
WTSSendMessageW
WTSRegisterSessionNotification
WTSFreeMemory

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

shlwapi

PathAppendW
SHGetValueW

wininet

InternetConnectW
HttpOpenRequestW
InternetGetLastResponseInfoW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
InternetAttemptConnect
HttpAddRequestHeadersW
HttpQueryInfoW
InternetReadFile

psapi

EnumProcesses
GetModuleBaseNameW
EnumProcessModules

kernel32

CompareStringW
WriteConsoleW
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
GetFileType
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetLastError
SetLastError
lstrcpyW
SetEvent
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
ExitThread
WaitForSingleObject
WaitForMultipleObjects
GetTickCount
CreateProcessW
WTSGetActiveConsoleSessionId
lstrlenW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
GetCurrentThreadId
CopyFileW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
DeleteFileW
OpenEventW
TerminateThread
ResetEvent
CreateEventW
GetVersionExA
GetVersionExW
CreateDirectoryW
FindClose
FindFirstFileW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
OpenMutexW
CreateMutexW
ReleaseMutex
GetProcessHeap
HeapSize
HeapReAlloc
lstrcmpiW
lstrcmpW
HeapAlloc
HeapFree
lstrlenA
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
ResumeThread
CreateThread
EncodePointer
DecodePointer
GetStdHandle
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
InitializeCriticalSectionAndSpinCount
ExitProcess
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
VirtualProtect

user32

DefWindowProcW
CreateWindowExW
GetWindowLongW
CallWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
PostThreadMessageW
MsgWaitForMultipleObjects
DestroyWindow
LoadCursorW
GetClassInfoExW
SetWindowLongW
WaitForInputIdle
RegisterClassExW
wsprintfW
UnregisterClassA

advapi32

StartServiceW
CreateProcessAsUserW
DuplicateTokenEx
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
ControlService
OpenServiceW
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
SetServiceStatus

shell32

ord165
ord92

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitializeEx

oleaut32

SafeArrayDestroy
VariantChangeType
VariantClear
VarBstrCmp
SysStringLen
VariantInit
SafeArrayCreateVector
SysFreeString
SysAllocString
SysAllocStringLen
SafeArrayAccessData
SafeArrayUnaccessData

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotwidgets.exe
.exe windows:5 windows x86 arch:x86

e50e11af4b606f71d76cf282e010adac

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\alotappbar\WidgetBox\Release\WidgetBox.pdb

Imports

urlmon

CoInternetCompareUrl
ObtainUserAgentString
IsValidURL
URLDownloadToFileW

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wininet

InternetCloseHandle
InternetCrackUrlW
InternetReadFile
HttpQueryInfoW
InternetOpenUrlW
InternetOpenW
InternetCreateUrlW

psapi

EnumProcessModules
EnumProcesses
GetModuleBaseNameW

ws2_32

WSAGetLastError
gethostbyname

kernel32

HeapCreate
TlsFree
TlsSetValue
TlsGetValue
InterlockedIncrement
InterlockedDecrement
OpenMutexW
GetLastError
WaitForSingleObject
CreateMutexW
SetLastError
lstrlenW
CloseHandle
ReleaseMutex
ExitProcess
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
RaiseException
GetCurrentThreadId
WideCharToMultiByte
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
DeleteFileW
ResetEvent
CreateEventW
UnmapViewOfFile
MapViewOfFile
GetCurrentProcessId
CreateFileMappingW
Sleep
WriteFile
CreateFileW
MultiByteToWideChar
TerminateThread
MoveFileW
FreeLibrary
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
SetEndOfFile
SetFileAttributesW
GetExitCodeProcess
GetTickCount
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
lstrcpyW
GetLongPathNameW
TerminateProcess
OpenProcess
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEvent
lstrcmpiW
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
LoadLibraryA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
SizeofResource
LoadResource
FindResourceW
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapFree
GetStdHandle
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetLocaleInfoW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
RtlUnwind
DecodePointer
EncodePointer
VirtualProtect
GetSystemInfo
VirtualQuery
GetConsoleCP
ExitThread
CreateThread
GetCommandLineW
HeapSetInformation
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
InterlockedPushEntrySList
lstrlenA
InterlockedCompareExchange

user32

GetForegroundWindow
AttachThreadInput
AllowSetForegroundWindow
BringWindowToTop
SetForegroundWindow
SystemParametersInfoW
EnumWindows
MsgWaitForMultipleObjects
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetWindowThreadProcessId
BroadcastSystemMessageW
GetWindowPlacement
IsWindowVisible
GetWindowRect
IsIconic
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
LoadCursorW
GetFocus
SetFocus
FindWindowW
GetClassInfoW
GetCursorPos
SetLayeredWindowAttributes
DrawTextW
UnregisterClassW
CopyRect
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
SetCapture
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
SetWindowPos
MoveWindow
CharNextW
GetSysColor
GetWindow
GetClassInfoExW
RegisterClassExW
DefWindowProcW
CallWindowProcW
DestroyWindow
PostMessageW
GetKeyState
ShowWindow
GetParent
IsChild
SendMessageW
GetWindowLongW
SetWindowLongW
RegisterWindowMessageW
IsWindow
PostThreadMessageW
GetMonitorInfoW
MonitorFromPoint
SendNotifyMessageW
LoadImageW
ReplyMessage
InSendMessage
FrameRect
SetWindowRgn
GetWindowDC
TrackMouseEvent
MonitorFromRect
RegisterClassW
wsprintfW
CopyImage
PtInRect
KillTimer
SetTimer
GetSystemMetrics
UnregisterClassA
RedrawWindow

gdi32

CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
GetDeviceCaps
BitBlt
SetDIBitsToDevice
CreatePatternBrush
CreateRectRgn
CreateRoundRectRgn
StretchBlt
ExtTextOutW
RoundRect
SetPixel
CreateFontW
CreateDIBSection
CreatePen
MoveToEx
LineTo
GetTextExtentPoint32W
SetDIBColorTable
SetTextColor
SetBkMode
GetStockObject
CreateSolidBrush
GetObjectW
DeleteDC

advapi32

RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW

shell32

ShellExecuteExW
ord92
ord165

ole32

OleUninitialize
StringFromGUID2
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
CoInitializeEx
CoUninitialize
CoTaskMemFree
CoTaskMemRealloc
OleLockRunning

oleaut32

VariantChangeType
SysAllocStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
VariantCopyInd
VariantCopy
SafeArrayUnaccessData
SafeArrayAccessData
VarUI4FromStr
SafeArrayCreateVector
SafeArrayDestroy
VarBstrCmp
SysStringLen
DispCallFunc
VariantClear
VariantInit
OleCreateFontIndirect

shlwapi

PathFileExistsW
PathAppendW
SHGetValueW
UrlIsW
PathCreateFromUrlW
PathIsRelativeW
UrlGetPartW

msimg32

TransparentBlt

gdiplus

GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipCloneImage
GdipDrawImageI
GdipDisposeImage
GdipDeleteGraphics
GdipAlloc
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFile
GdipGetImagePalette
GdipGetImagePaletteSize
GdipFree

Sections

.text
Size: 404KB - Virtual size: 404KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/resources/App_1007/images/1d14fe3350fef6b2cc0a4aa18ac5b0db.png
.png
$1/resources/App_1107/images/86de41db71de2e6b4360cd8d4f0eba7f.png
.png
$1/resources/App_2254/images/8cffb8b3ba4df43dea939ac6952b3f2f.png
.png
$1/resources/App_3562/images/d5aed714f2ab2d7fd8fd3f0b12d30a11.png
.png
$1/resources/App_4629/images/7b2fdf9965fe4ff9b4ccddc50297c066.png
.png
$1/resources/App_5809/images/dea85611eacb320a29fe17b8907b7e05.png
.png
$1/resources/shared/domains.dat
.xml
$1/resources/shared/images/DesktopAlertClose.png
.png
$1/resources/shared/images/PageAlertBkgnd.png
.png
$1/resources/shared/images/PageAlertButton.png
.png
$1/resources/shared/images/PageAlertButtonHot.png
.png
$1/resources/shared/images/PageAlertClose.png
.png
$1/resources/shared/images/PageAlertCloseHot.png
.png
$1/resources/shared/images/add-app-hover.png
.png
$1/resources/shared/images/add-app.png
.png
$1/resources/shared/images/alot-logo-100x51.png
.png
$1/resources/shared/images/alot-logo-13x13.png
.png
$1/resources/shared/images/alot-logo-16x16.png
.png
$1/resources/shared/images/alot-logo-65x34-hover.png
.png
$1/resources/shared/images/alot-logo-65x34.png
.png
$1/resources/shared/images/alot-logo-95x55.png
.png
$1/resources/shared/images/check.png
.png
$1/resources/shared/images/cog-hover.png
.png
$1/resources/shared/images/cog.png
.png
$1/resources/shared/images/desktopAlertAttrBkgnd.png
.png
$1/resources/shared/images/desktopAlertCloseHot.png
.png
$1/resources/shared/images/desktopAlertImage.png
.png
$1/resources/shared/images/desktopAlertImageBkgnd.png
.png
$1/resources/shared/images/desktopAlertTextBkgnd.png
.png
$1/resources/shared/images/error-icon.jpg
.jpg
$1/resources/shared/images/favicon.ico
$1/resources/shared/images/loading.bmp
$1/resources/shared/images/magnifying-glass.png
.png
$1/resources/shared/images/search-button-hover.png
.png
$1/resources/shared/images/search-button.png
.png
$1/resources/shared/images/theme/blue/appbar-bg.png
.png
$1/resources/shared/images/theme/blue/divider.png
.png
$1/resources/shared/images/theme/blue/page/bg.png
.png
$1/resources/shared/images/theme/blue/page/left/hover.png
.png
$1/resources/shared/images/theme/blue/page/left/normal.png
.png
$1/resources/shared/images/theme/blue/page/left/not-available.png
.png
$1/resources/shared/images/theme/blue/page/right/hover.png
.png
$1/resources/shared/images/theme/blue/page/right/normal.png
.png
$1/resources/shared/images/theme/blue/page/right/not-available.png
.png
$1/resources/shared/images/theme/blue/slider.png
.png
$1/resources/shared/images/theme/blue/swatch.png
.png
$1/resources/shared/images/theme/green/appbar-bg.png
.png
$1/resources/shared/images/theme/green/divider.png
.png
$1/resources/shared/images/theme/green/page/bg.png
.png
$1/resources/shared/images/theme/green/page/left/hover.png
.png
$1/resources/shared/images/theme/green/page/left/normal.png
.png
$1/resources/shared/images/theme/green/page/left/not-available.png
.png
$1/resources/shared/images/theme/green/page/right/hover.png
.png
$1/resources/shared/images/theme/green/page/right/normal.png
.png
$1/resources/shared/images/theme/green/page/right/not-available.png
.png
$1/resources/shared/images/theme/green/slider.png
.png
$1/resources/shared/images/theme/green/swatch.png
.png
$1/resources/shared/images/theme/orange/appbar-bg.png
.png
$1/resources/shared/images/theme/orange/divider.png
.png
$1/resources/shared/images/theme/orange/page/bg.png
.png
$1/resources/shared/images/theme/orange/page/left/hover.png
.png
$1/resources/shared/images/theme/orange/page/left/normal.png
.png
$1/resources/shared/images/theme/orange/page/left/not-available.png
.png
$1/resources/shared/images/theme/orange/page/right/hover.png
.png
$1/resources/shared/images/theme/orange/page/right/normal.png
.png
$1/resources/shared/images/theme/orange/page/right/not-available.png
.png
$1/resources/shared/images/theme/orange/slider.png
.png
$1/resources/shared/images/theme/orange/swatch.png
.png
$1/resources/shared/images/theme/palette-hover.png
.png
$1/resources/shared/images/theme/palette.png
.png
$1/resources/shared/images/theme/pink/appbar-bg.png
.png
$1/resources/shared/images/theme/pink/divider.png
.png
$1/resources/shared/images/theme/pink/page/bg.png
.png
$1/resources/shared/images/theme/pink/page/left/hover.png
.png
$1/resources/shared/images/theme/pink/page/left/normal.png
.png
$1/resources/shared/images/theme/pink/page/left/not-available.png
.png
$1/resources/shared/images/theme/pink/page/right/hover.png
.png
$1/resources/shared/images/theme/pink/page/right/normal.png
.png
$1/resources/shared/images/theme/pink/page/right/not-available.png
.png
$1/resources/shared/images/theme/pink/slider.png
.png
$1/resources/shared/images/theme/pink/swatch.png
.png
$1/resources/shared/images/theme/standard/appbar-bg.png
.png
$1/resources/shared/images/theme/standard/divider.png
.png
$1/resources/shared/images/theme/standard/page/bg.png
.png
$1/resources/shared/images/theme/standard/page/left/hover.png
.png
$1/resources/shared/images/theme/standard/page/left/normal.png
.png
$1/resources/shared/images/theme/standard/page/left/not-available.png
.png
$1/resources/shared/images/theme/standard/page/right/hover.png
.png
$1/resources/shared/images/theme/standard/page/right/normal.png
.png
$1/resources/shared/images/theme/standard/page/right/not-available.png
.png
$1/resources/shared/images/theme/standard/slider.png
.png
$1/resources/shared/images/theme/standardClassic/appbar-bg.png
.png
$1/resources/shared/images/theme/standardClassic/divider.png
.png
$1/resources/shared/images/theme/standardClassic/page/bg.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/slider.png
.png
$1/resources/shared/images/theme/standardWin7/appbar-bg.png
.png
$1/resources/shared/images/theme/standardWin7/divider.png
.png
$1/resources/shared/images/theme/standardWin7/page/bg.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/slider.png
.png
$1/resources/shared/images/widget/caption-bg.bmp
$1/resources/shared/images/widget/close-hover.bmp
$1/resources/shared/images/widget/close.bmp
$1/resources/shared/images/widget/configure-hover.bmp
$1/resources/shared/images/widget/configure.bmp
$1/resources/shared/images/widget/refresh-hover.bmp
$1/resources/shared/images/widget/refresh.bmp
$1/service.xml
.xml
$1/toolbar.xml
.xml
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/closeie.ini
$PLUGINSDIR/eula.html
.html
$PLUGINSDIR/eula.ini
$PLUGINSDIR/installagent.exe
.exe windows:5 windows x86 arch:x86

d3d41a59186427c400b2b65382f4e8bb

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\InstallHelper\bin\support\installagent.pdb

Imports

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses

kernel32

HeapReAlloc
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
MultiByteToWideChar
lstrlenW
HeapSize
lstrcmpiW
InitializeCriticalSection
OpenProcess
Sleep
LeaveCriticalSection
FlushFileBuffers
GetLastError
SetLastError
EnterCriticalSection
DeleteCriticalSection
CloseHandle
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
CreateFileW
LoadLibraryW
TerminateProcess
HeapSetInformation
GetProcAddress
GetModuleHandleW
EncodePointer
DecodePointer
GetCommandLineW
WriteConsoleW
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
RaiseException
InitializeCriticalSectionAndSpinCount
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
WideCharToMultiByte
LCMapStringW
GetStringTypeW

user32

GetWindowThreadProcessId
SendMessageTimeoutW
EnumWindows
GetClassNameW
IsWindow

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

shlwapi

SHGetValueW

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/installhelper.dll
.dll windows:5 windows x86 arch:x86

4ecaabace3696c90ea24c944e6e872e8

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\InstallHelper\Release\installhelper.pdb

Imports

wtsapi32

WTSSendMessageW
WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW

shell32

ShellExecuteW
SHFileOperationW
ord92
ord165

userenv

UnloadUserProfile
CreateEnvironmentBlock
DestroyEnvironmentBlock
LoadUserProfileW

psapi

GetModuleBaseNameW
GetProcessImageFileNameW
EnumProcesses
EnumProcessModules

kernel32

TerminateProcess
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryW
CreateDirectoryW
GetModuleFileNameW
CopyFileW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileW
DeleteFileW
WTSGetActiveConsoleSessionId
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
ProcessIdToSessionId
InitializeCriticalSection
OpenMutexW
CreateMutexW
ReleaseMutex
FindNextFileW
HeapSize
HeapReAlloc
lstrcmpiW
MultiByteToWideChar
lstrlenA
ReadFile
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapCreate
HeapDestroy
GetStdHandle
WideCharToMultiByte
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
FindFirstFileW
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
FindClose
GetLongPathNameW
GetVersionExW
GetVersionExA
lstrcpyW
lstrcmpW
LocalFree
GetTickCount
GetProcessHeap
HeapAlloc
Sleep
HeapFree
GetCurrentProcessId
SetLastError
GetLastError
GetCurrentProcess
OpenProcess
CreateProcessW
CloseHandle
lstrlenW
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
GetFileSize

user32

SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
CharNextW
GetSysColor
DefWindowProcW
UnregisterClassW
GetWindowLongW
SetWindowTextW
GetClientRect
CreateWindowExW
IsChild
LoadCursorW
GetClassInfoExW
SetWindowPos
SetWindowLongW
DestroyWindow
EnumWindows
IsWindow
SendMessageTimeoutW
GetParent
GetDlgItem
ReleaseCapture
FillRect
CallWindowProcW
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
SetFocus
GetClassNameW
UnregisterClassA
FindWindowW
GetWindowThreadProcessId
GetWindowTextW
MsgWaitForMultipleObjects
GetMessageW
TranslateMessage
GetWindow
GetFocus
SendMessageW
RegisterClassExW
CreateAcceleratorTableW
DispatchMessageW
PeekMessageW
RegisterWindowMessageW
wsprintfW
GetWindowTextLengthW
WaitForInputIdle

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC

advapi32

DeleteService
OpenSCManagerW
StartServiceW
QueryServiceStatusEx
ControlService
OpenServiceW
EnumDependentServicesW
RegDeleteValueW
RegQueryValueExW
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
DuplicateTokenEx
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
CreateProcessAsUserW
SetSecurityInfo
DeleteAce
GetAce
GetAclInformation
GetSecurityInfo
RegCloseKey
CloseServiceHandle

ole32

CoGetClassObject
CLSIDFromProgID
StringFromGUID2
CoCreateInstance
CLSIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoInitialize
CoTaskMemFree
OleLockRunning

oleaut32

SafeArrayDestroy
VariantChangeType
VarBstrCmp
SysFreeString
VariantClear
VariantInit
SysAllocString
SysStringLen
SysAllocStringLen
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector

shlwapi

PathFindFileNameW
PathIsURLW
UrlCreateFromPathW
SHGetValueW
SHDeleteKeyW
SHDeleteValueW
PathAppendW
PathIsRelativeW
PathCreateFromUrlW
UrlIsW
PathFileExistsW
UrlEscapeW

Exports

Exports

BackupProduct
HtmlCreate
HtmlDestroy
HtmlDisplay
IEAddSearchProvider
IEApprove
IEDisapprove
IEGetDefaultSearchProvider
IEGetMajorVersion
IELaunch
IERemoveSearchProvider
IESetDefaultSearchProvider
IEShowToolbar
IEShowToolbarExW
IEUnblockExtension
InstallProduct
InstallService
RegUserDeleteKey
RegUserReadDWORD
RegUserReadString
RegUserWriteDWORD
RegUserWriteString
RegisterProduct
RemoveBackups
RestoreProduct
RunService
StopService
TerminateProductProcesses
UninstallService
UnregisterProduct
UpdateUser
WinGetKnownFolderPath

Sections

.text
Size: 165KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$TEMP/4890_alotappbarinstaller_enus7flv_ff.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisunz.dll
.dll windows:4 windows x86 arch:x86

0f92772da9c737d2bac38919e9863980

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
lstrcpyA
lstrcmpA
lstrcmpiA
GlobalFree
lstrcpynA
GlobalAlloc
lstrcatA
lstrlenA
GetVersion
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
CreateFileA
WriteFile
ReadFile
CloseHandle
SetFilePointer

user32

MessageBoxA
DispatchMessageA
TranslateMessage
PeekMessageA
CharPrevA
wsprintfA
SendMessageA
GetDlgItem
FindWindowExA

Exports

Exports

Unzip
UnzipToLog
UnzipToStack
extract_RunDLL

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 706B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_8_/4890_alotappbarinstaller_enus7flv.xpi
.zip
META-INF/manifest.mf
META-INF/zigbert.rsa
META-INF/zigbert.sf
chrome.manifest
chrome/alottb.jar
.zip .js polyglot
content/alottb-aAlotCustom.js
.js
content/alottb-aAlotCustomButton.js
.js
content/alottb-aAlotSitepass.js
.js
content/alottb-aAlotToolbar.js
.js
content/alottb-aAlotWidget.js
.js
content/alottb-aAlotWidgetAppBand.js
.js
content/alottb-aAlotWidgetBrowser.js
.js
content/alottb-aAlotWidgetButton.js
.js
content/alottb-aAlotWidgetFileHelper.js
.js
content/alottb-aAlotWidgetRegistryHelper.js
.js
content/alottb-aAlotWidgetTabHelper.js
.js
content/alottb-aAlotWidgetWebSnapshots.js
.js
content/alottb-aAlotWidgetWindow.js
.js
content/alottb-action.js
.js
content/alottb-appbar.js
.js
content/alottb-error.js
.js
content/alottb-history.js
.js
content/alottb-lib.js
.js
content/alottb-macWinFix.js
.js
content/alottb-macWinFix.xul
.xml
content/alottb-main.js
.js
content/alottb-options-dialog-pi.xul
.xml
content/alottb-options-dialog.xul
.xml
content/alottb-options.js
.js
content/alottb-overlay.xul
.xml
content/alottb-pref.js
content/alottb-search-defend.js
.js
content/alottb-third-party-dialog.xul
.js .xml polyglot
content/alottb-toolbar.js
.js
content/alottb-webshots.js
.js
content/alottb-widget.js
.js
content/alottb-widgetWin.js
.js
content/config/cache/1d14fe3350fef6b2cc0a4aa18ac5b0db.png
.png
content/config/cache/7b2fdf9965fe4ff9b4ccddc50297c066.png
.png
content/config/cache/86de41db71de2e6b4360cd8d4f0eba7f.png
.png
content/config/cache/8cffb8b3ba4df43dea939ac6952b3f2f.png
.png
content/config/cache/add-app-hover.png
.png
content/config/cache/add-app.png
.png
content/config/cache/alot-logo-13x13.png
.png
content/config/cache/alot-logo-16x16.png
.png
content/config/cache/alot-logo-65x34-hover.png
.png
content/config/cache/alot-logo-65x34.png
.png
content/config/cache/alot-logo-95x55.png
.png
content/config/cache/cog-hover.png
.png
content/config/cache/cog.png
.png
content/config/cache/d5aed714f2ab2d7fd8fd3f0b12d30a11.png
.png
content/config/cache/dea85611eacb320a29fe17b8907b7e05.png
.png
content/config/cache/discover.png
.png
content/config/cache/error-icon.jpg
.jpg
content/config/cache/favicon.ico
content/config/cache/loading.bmp
content/config/cache/magnifying-glass.png
.png
content/config/cache/search-button-hover.png
.png
content/config/cache/search-button.png
.png
content/config/cache/theme/blue/appbar-bg.png
.png
content/config/cache/theme/blue/divider.png
.png
content/config/cache/theme/blue/page/bg.png
.png
content/config/cache/theme/blue/page/left/hover.png
.png
content/config/cache/theme/blue/page/left/normal.png
.png
content/config/cache/theme/blue/page/left/not-available.png
.png
content/config/cache/theme/blue/page/right/hover.png
.png
content/config/cache/theme/blue/page/right/normal.png
.png
content/config/cache/theme/blue/page/right/not-available.png
.png
content/config/cache/theme/blue/slider.png
.png
content/config/cache/theme/blue/swatch.png
.png
content/config/cache/theme/green/appbar-bg.png
.png
content/config/cache/theme/green/divider.png
.png
content/config/cache/theme/green/page/bg.png
.png
content/config/cache/theme/green/page/left/hover.png
.png
content/config/cache/theme/green/page/left/normal.png
.png
content/config/cache/theme/green/page/left/not-available.png
.png
content/config/cache/theme/green/page/right/hover.png
.png
content/config/cache/theme/green/page/right/normal.png
.png
content/config/cache/theme/green/page/right/not-available.png
.png
content/config/cache/theme/green/slider.png
.png
content/config/cache/theme/green/swatch.png
.png
content/config/cache/theme/orange/appbar-bg.png
.png
content/config/cache/theme/orange/divider.png
.png
content/config/cache/theme/orange/page/bg.png
.png
content/config/cache/theme/orange/page/left/hover.png
.png
content/config/cache/theme/orange/page/left/normal.png
.png
content/config/cache/theme/orange/page/left/not-available.png
.png
content/config/cache/theme/orange/page/right/hover.png
.png
content/config/cache/theme/orange/page/right/normal.png
.png
content/config/cache/theme/orange/page/right/not-available.png
.png
content/config/cache/theme/orange/slider.png
.png
content/config/cache/theme/orange/swatch.png
.png
content/config/cache/theme/palette-hover.png
.png
content/config/cache/theme/palette.png
.png
content/config/cache/theme/pink/appbar-bg.png
.png
content/config/cache/theme/pink/divider.png
.png
content/config/cache/theme/pink/page/bg.png
.png
content/config/cache/theme/pink/page/left/hover.png
.png
content/config/cache/theme/pink/page/left/normal.png
.png
content/config/cache/theme/pink/page/left/not-available.png
.png
content/config/cache/theme/pink/page/right/hover.png
.png
content/config/cache/theme/pink/page/right/normal.png
.png
content/config/cache/theme/pink/page/right/not-available.png
.png
content/config/cache/theme/pink/slider.png
.png
content/config/cache/theme/pink/swatch.png
.png
content/config/cache/theme/standard/appbar-bg.png
.png
content/config/cache/theme/standard/divider.png
.png
content/config/cache/theme/standard/page/bg.png
.png
content/config/cache/theme/standard/page/left/hover.png
.png
content/config/cache/theme/standard/page/left/normal.png
.png
content/config/cache/theme/standard/page/left/not-available.png
.png
content/config/cache/theme/standard/page/right/hover.png
.png
content/config/cache/theme/standard/page/right/normal.png
.png
content/config/cache/theme/standard/page/right/not-available.png
.png
content/config/cache/theme/standard/slider.png
.png
content/config/cache/widget/caption-bg.bmp
content/config/cache/widget/close-hover.bmp
content/config/cache/widget/close.bmp
content/config/cache/widget/configure-hover.bmp
content/config/cache/widget/configure.bmp
content/config/cache/widget/refresh-hover.bmp
content/config/cache/widget/refresh.bmp
content/config/config.tmpl.xml
.xml
content/io.js
.js
content/plugin/alot.png
.png
content/plugin/alot.xml
content/service/buttons.js
.js
content/service/config-xml.js
.js
content/service/heartbeat.js
.js
content/service/history.js
.js
content/service/metrics.js
.js
content/service/update.js
.js
content/service/xul-transforms.js
.js
content/xsl/apps.xsl
.xml
content/xsl/browserSearch.xsl
.xml
content/xsl/coreButtons.xsl
.xml
content/xsl/lib.xsl
.xml
content/xsl/options-dialog.xsl
.xml
content/xsl/pi-dialog.xsl
.xml
content/xsl/search-defend-dialog.xsl
.xml
content/xsl/single-button.xsl
.xml
content/xsl/toolbar-base.xsl
.xml
content/xsl/webShotsButton.xsl
.xml
content/xsl/widgetError.xsl
.js
content/xsl/widgetWindow.xsl
.xml
skin/alot-o.png
.png
skin/alot32.png
.png
skin/alottb-overlay.css
skin/alottb-widgetWin.css
skin/app_bkgrd.png
.png
skin/button_back.png
.png
skin/check.png
.png
skin/logo.png
.png
skin/options.css
components/aAboutAlotError.js
.js
components/aAlotCustom.js
.js
components/aAlotCustomButton.js
.js
components/aAlotSitepass.js
.js
components/aAlotToolbar.js
.js
components/aAlotWidget.js
.js
components/aAlotWidgetAppBand.js
.js
components/aAlotWidgetBrowser.js
.js
components/aAlotWidgetButton.js
.js
components/aAlotWidgetFileHelper.js
.js
components/aAlotWidgetRegistryHelper.js
.js
components/aAlotWidgetTabHelper.js
.js
components/aAlotWidgetWebSnapshots.js
.js
components/aAlotWidgetWindow.js
.js
components/aIAlotCustom.xpt
components/aIAlotCustomButton.xpt
components/aIAlotSitepass.xpt
components/aIAlotWidget.xpt
components/aIAlotWidgetAppBand.xpt
components/aIAlotWidgetBrowser.xpt
components/aIAlotWidgetButton.xpt
components/aIAlotWidgetFileHelper.xpt
components/aIAlotWidgetRegistryHelper.xpt
components/aIAlotWidgetTabHelper.xpt
components/aIAlotWidgetWebSnapshots.xpt
components/aIAlotWidgetWindow.xpt
defaults/preferences/alottb.js
install.rdf
.xml

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 2KB - Virtual size: 2KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

4e:78:b2:50:0b:11:2a:0a:92:80:65:dc:e6:b0:d5:de:00:df:25:edSigner

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 2KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

4e:78:b2:50:0b:11:2a:0a:92:80:65:dc:e6:b0:d5:de:00:df:25:ed
Signer

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 980KB

.rsrc
Size: 28KB - Virtual size: 27KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 30KB - Virtual size: 29KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 6KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 5KB - Virtual size: 4KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate