360cc68d8a720bf34ff115641f81183f_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

360cc68d8a720bf34ff115641f81183f_JaffaCakes118
Size

5.9MB
MD5

360cc68d8a720bf34ff115641f81183f
SHA1

5c891d74cd0f18259c2eecb7d6746b3692cab706
SHA256

d904d3353369f5f193f5258b5e49d677fe63fc85c392c1b1a16d00b5bfdf1a23
SHA512

251633d928d706dcd15df94f866694f15ad2958e7d2049b8607d8a84389fe0f4c0a8fc62faa0fe900ef9790570a0b579605333bed35d7d1fa32d96a792e38636
SSDEEP

98304:F2BW+Dg6zdAfEZSqf6e/HP/emUtlg5c0DPMOFruaq/gfpvNqg2/03w5mvUbevwX:cg6zNZJv/emn5cIU4rvq+pNZkAwSU0w

Score

3^/10

Malware Config

Signatures

Unsigned PE 17 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/ConnectionTester.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/InetLoad.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/MoreInfo.dll
unpack002/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/InetLoad.dll
unpack005/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/nsisProcMgr.dll
unpack005/$PLUGINSDIR/timet.dll
unpack004/$PLUGINSDIR/nsisProcMgr.dll
unpack002/$PLUGINSDIR/nsisProcMgr.dll
unpack002/$PLUGINSDIR/timet.dll
unpack002/YPUBC.dll
unpack006/$PLUGINSDIR/System.dll

NSIS installer 5 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
static1/unpack001/$PLUGINSDIR/y_toolbar.exe	nsis_installer_1
static1/unpack002/$PLUGINSDIR/fudogs_setup.exe	nsis_installer_1
static1/unpack004/$PLUGINSDIR/fudogs_sub_setup.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/yset.exe	nsis_installer_1

Files

360cc68d8a720bf34ff115641f81183f_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c1d02edd28ce94e699431ce65bed28ec

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

1a:34:34:ae:60:24:e9:c5:78:59:4f:17:7b:20:1e:30
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

02/05/2007, 00:00

Not After

28/07/2008, 23:59

Subject

CN=DivX\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=DivX\, Inc.,L=San Diego,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
CreateFileA
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
CloseHandle
ExitProcess
GetWindowsDirectoryA
GetTempPathA
GetCommandLineA
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
MulDiv
ReadFile
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

EndDialog
ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
RegisterClassA
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
ShowWindow
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
wsprintfA

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ConnectionTester.dll
.dll windows:4 windows x86 arch:x86

507af696c5079bf615f35c016c8c37b2

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

htonl
inet_addr
gethostbyname
getservbyname
inet_ntoa
ntohs
gethostbyaddr
getservbyport
recv
send
closesocket
connect
ioctlsocket
htons
select
setsockopt
socket
WSASetLastError
WSAGetLastError
WSAStartup
WSACleanup

advapi32

RegSetValueExA
RegCreateKeyExA

user32

TranslateMessage
DispatchMessageW
PeekMessageW
DestroyWindow
ShowWindow
CreateDialogParamW
GetDesktopWindow
IsDialogMessageW
SendMessageW
GetDlgItem
SetWindowTextW
SetDlgItemTextW

kernel32

CompareStringA
FlushFileBuffers
ReadFile
SetStdHandle
GetOEMCP
GetACP
CompareStringW
GetCPInfo
SetFilePointer
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
SetEnvironmentVariableA
TlsAlloc
GetStringTypeW
GetStringTypeA
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
DeleteFileW
CreateFileW
CloseHandle
WriteFile
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetTimeZoneInformation
GetSystemTime
GetLocalTime
RtlUnwind
HeapAlloc
HeapFree
InterlockedDecrement
InterlockedIncrement
GetCommandLineA
GetVersion
GetCurrentThreadId
TlsSetValue
TlsFree
SetLastError
TlsGetValue
GetLastError
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
ExitProcess
WideCharToMultiByte
LCMapStringA
LCMapStringW

Exports

Exports

ConnectionTest
GetTime
HTTPDownload

Sections

.text
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text1
Size: 4KB - Virtual size: 40B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data1
Size: 4KB - Virtual size: 308B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

c4fa86e78b598d87f225e209ba30786f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
PtInRect
GetClientRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
OpenClipboard

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 994B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/y_toolbar.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/LICENSE.txt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/manifest.mf
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.rsa
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.sf
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/chrome/ytoolbar.jar
.zip
content/ytoolbar/cache/about.xul
.xml
content/ytoolbar/cache/option.xul
.xml
content/ytoolbar/cache/sethomepage.xul
.js .xml polyglot
content/ytoolbar/cache/uninstall.xul
.js .xml polyglot
content/ytoolbar/contents.rdf
content/ytoolbar/dialog.js
.js
content/ytoolbar/dialog.xul
.xml
content/ytoolbar/feedFunctions.js
.js
content/ytoolbar/fileio.js
.js
content/ytoolbar/globals.js
.js
content/ytoolbar/history.js
.js
content/ytoolbar/i18n.js
.js
content/ytoolbar/installerVariables.js
.js
content/ytoolbar/network.js
.js
content/ytoolbar/options.js
.js
content/ytoolbar/setHomepage.js
.js
content/ytoolbar/toolbarBuilder.js
.js
content/ytoolbar/trackinginterfaces.js
.js
content/ytoolbar/uninstall.js
.js
content/ytoolbar/yahoo.xml
.js .xml polyglot
content/ytoolbar/ylib.js
.js
content/ytoolbar/yprefs.js
.js
content/ytoolbar/yrss.js
.js
content/ytoolbar/ysearch-history.rdf
.xml
content/ytoolbar/ytoolbarOverlay.js
.js
content/ytoolbar/ytoolbarOverlay.xul
.js .xml polyglot
locale/de/ytoolbar/contents.rdf
locale/de/ytoolbar/ytoolbar.dtd
locale/de/ytoolbar/ytoolbar.properties
locale/en-UK/ytoolbar/contents.rdf
.xml
locale/en-UK/ytoolbar/ytoolbar.dtd
locale/en-UK/ytoolbar/ytoolbar.properties
locale/en-US/ytoolbar/contents.rdf
.xml
locale/en-US/ytoolbar/ytoolbar.dtd
locale/en-US/ytoolbar/ytoolbar.properties
locale/es/ytoolbar/contents.rdf
.xml
locale/es/ytoolbar/ytoolbar.dtd
locale/es/ytoolbar/ytoolbar.properties
locale/fr/ytoolbar/contents.rdf
locale/fr/ytoolbar/ytoolbar.dtd
locale/fr/ytoolbar/ytoolbar.properties
locale/kr/ytoolbar/contents.rdf
locale/kr/ytoolbar/ytoolbar.dtd
locale/kr/ytoolbar/ytoolbar.properties
locale/zh-HK/ytoolbar/contents.rdf
.xml
locale/zh-HK/ytoolbar/ytoolbar.dtd
locale/zh-HK/ytoolbar/ytoolbar.properties
locale/zt-TW/ytoolbar/contents.rdf
locale/zt-TW/ytoolbar/ytoolbar.dtd
locale/zt-TW/ytoolbar/ytoolbar.properties
skin/classic/ytoolbar/05c.gif
.gif
skin/classic/ytoolbar/07c.gif
.gif
skin/classic/ytoolbar/08c.gif
.gif
skin/classic/ytoolbar/11c.gif
.gif
skin/classic/ytoolbar/18c.gif
.gif
skin/classic/ytoolbar/19c.gif
.gif
skin/classic/ytoolbar/50c.gif
.gif
skin/classic/ytoolbar/52c.gif
.gif
skin/classic/ytoolbar/MY-ff-plus.gif
.gif
skin/classic/ytoolbar/chevron.gif
.gif
skin/classic/ytoolbar/contents.rdf
.xml
skin/classic/ytoolbar/ed.gif
.gif
skin/classic/ytoolbar/logo.gif
.gif
skin/classic/ytoolbar/mno2.gif
.gif
skin/classic/ytoolbar/my.gif
.gif
skin/classic/ytoolbar/new3.gif
.gif
skin/classic/ytoolbar/option.gif
.gif
skin/classic/ytoolbar/slider.gif
.gif
skin/classic/ytoolbar/tot.gif
.gif
skin/classic/ytoolbar/yahooicon.png
.png
skin/classic/ytoolbar/yma1.gif
.gif
skin/classic/ytoolbar/ytoolbar.css
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.idl
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.idl
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.idl
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooHashtable.idl
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooHashtable.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooHashtable.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/defaults/preferences/yahoo.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.rdf
.xml
$PLUGINSDIR/InetLoad.dll
.dll windows:4 windows x86 arch:x86

d8be1bce66a8b91950a8519f256400c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

atoi
_initterm
malloc
strcpy
__dllonexit
_onexit
calloc
_stricmp
_open
strcat
_close
_unlink
free
sprintf
memset
strstr
strtol
strlen
strncmp
strtoul
_write
time
strrchr
strchr
_adjust_fdiv
strcmp

kernel32

lstrcpynA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
GetModuleHandleA
lstrcpyA
GlobalFree
LoadLibraryA
GetProcAddress
Sleep
SleepEx
FreeLibrary
GetLastError
MulDiv
lstrlenA
GlobalAlloc

user32

GetDlgItem
SetWindowTextA
wsprintfA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
PostMessageA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
MessageBoxA
SendDlgItemMessageA
SetDlgItemTextA
SetTimer
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindow
CreateDialogParamA
FindWindowExA
GetWindowTextA
SendMessageA

wininet

InternetErrorDlg
InternetSetFilePointer
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
HttpAddRequestHeadersA
InternetSetOptionA
HttpOpenRequestA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle

comctl32

ord17

Exports

Exports

load

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MoreInfo.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetComments
GetCompanyName
GetFileDescription
GetFileVersion
GetInternalName
GetLegalCopyright
GetLegalTrademarks
GetOSUserinterfaceLanguage
GetOriginalFilename
GetPrivateBuild
GetProductName
GetProductVersion
GetSpecialBuild
GetUserDefined

Sections

CODE
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/YDefUser.dll
.dll windows:4 windows x86 arch:x86

eb9b12f933fc102c731bc4f747f068e1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcess
GetLastError
CloseHandle
ExpandEnvironmentStringsA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
ExitProcess
GetProcAddress
TerminateProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

advapi32

RegDeleteValueA
RegEnumKeyExA
RegLoadKeyA
RegOpenKeyExA
RegUnLoadKeyA
RegEnumValueA
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

CloneForAllExistingUsers
CloneForDefaultUser

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/finish.ini
$PLUGINSDIR/fudogs_setup.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 32KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/fudogs_sub_setup.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$2
.dll windows:4 windows x86 arch:x86

0b86d102054617ee3bef35af3d856f86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\souravb\FuDogs\Main\fdLoad\Release\fdLoad.pdb

Imports

wininet

InternetSetOptionW
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW

urlmon

ObtainUserAgentString

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

kernel32

DeleteCriticalSection
ExpandEnvironmentStringsW
GetModuleFileNameW
lstrcmpiW
GetTickCount
CompareStringW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
Sleep
SetEvent
CreateEventW
GetComputerNameA
Thread32Next
Thread32First
CreateToolhelp32Snapshot
ReadFile
ResetEvent
WaitForMultipleObjects
FindClose
FindFirstFileW
GetVersionExW
GetVersion
QueryDosDeviceW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WideCharToMultiByte
GetShortPathNameW
CreateDirectoryExW
GetTempPathW
lstrcatW
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
CreateProcessW
lstrcmpA
lstrcmpiA
GetProcAddress
LoadLibraryA
CreateFileA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
GetCommandLineA
lstrlenW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetSystemInfo
GetModuleHandleA
VirtualProtect
RtlUnwind
ResumeThread
ExitThread
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetLastError
GetCurrentThreadId
lstrlenA
lstrcmpW
DeleteFileW
IsBadWritePtr
MultiByteToWideChar
ReadProcessMemory
VirtualFreeEx
GetCurrentProcessId
OpenProcess
GetStringTypeA
GetStringTypeW
VirtualAllocEx
CreateSemaphoreW
WriteFile
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
WaitForSingleObject
IsBadReadPtr
CreateFileW
GetFileSize
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateThread
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LocalFree
IsDebuggerPresent
ExitProcess

user32

InsertMenuItemW
LoadMenuW
GetSubMenu
SetMenuDefaultItem
FindWindowW
DialogBoxParamW
IsWindowVisible
DestroyIcon
MoveWindow
SetForegroundWindow
IsRectEmpty
SetRect
GetWindow
SystemParametersInfoW
GetMenuStringW
GetMenuItemInfoW
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
DestroyMenu
SetWindowRgn
LoadImageW
GetSystemMetrics
GetSysColor
GetCapture
ReleaseCapture
GetCursorPos
SetCursor
DrawFocusRect
PtInRect
GetDlgCtrlID
SetCapture
IsWindowEnabled
InvalidateRect
UpdateWindow
GetClassNameW
SetRectEmpty
BeginPaint
FindWindowExW
GetWindowRect
FillRect
EndPaint
OffsetRect
ReleaseDC
GetDC
DrawTextW
CharNextW
CopyRect
SetWindowPos
GetDlgItem
EndDialog
GetParent
ShowWindow
ScreenToClient
GetClientRect
GetWindowTextLengthW
SetWindowTextW
RegisterWindowMessageW
wsprintfW
GetFocus
GetActiveWindow
GetDesktopWindow
LoadIconW
CreatePopupMenu
AppendMenuW
CallWindowProcW
GetWindowLongW
RegisterClassExW
CreateWindowExW
EnumWindows
GetWindowThreadProcessId
DefWindowProcW
SetActiveWindow
SetFocus
GetWindowTextW
LoadCursorW
GetClassInfoExW
DestroyWindow
IsWindow
RegisterWindowMessageA
SetWindowLongW
PostThreadMessageW
SetDlgItemTextW
PostMessageW
SetWindowsHookExW
SetTimer
MessageBoxW
KillTimer
PeekMessageW
UnhookWindowsHookEx
CallNextHookEx
SendMessageW
EnableWindow
PostQuitMessage
UnregisterClassA
MapWindowPoints

gdi32

GetTextExtentPoint32W
CreateFontW
LineTo
MoveToEx
GetObjectW
DeleteObject
SelectObject
DeleteDC
BitBlt
CreatePolygonRgn
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
SetBkMode
SetTextColor
CreateSolidBrush
SetBkColor
FillRgn
FrameRgn
CreateRectRgn
CombineRgn
CreateRoundRectRgn
CreatePen
CreateCompatibleBitmap

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteKeyW
RegQueryValueExW
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptDeriveKey
CryptEncrypt
CryptReleaseContext
CryptDecrypt
RegEnumKeyExW

shell32

Shell_NotifyIconW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation
ShellExecuteW

ole32

CoTaskMemFree
CLSIDFromString
GetRunningObjectTable
CreateBindCtx
CoUninitialize
CoInitialize
CoCreateInstance
OleRun

oleaut32

SysAllocString
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantInit
VariantChangeType
VariantClear
GetErrorInfo

shlwapi

UrlEscapeW
StrRChrA
StrCmpNW

comctl32

_TrackMouseEvent

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCreateSolidFill
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateFromHDC
GdipFillRectangleI
GdipDrawImageRectRectI
GdipCloneBrush
GdipCloneImage
GdipGetImageType
GdipLoadImageFromFile

psapi

GetProcessImageFileNameW

Exports

Exports

fn1
fn2
fn3
fn4

Sections

.text
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FuDogLo
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InetLoad.dll
.dll windows:4 windows x86 arch:x86

d8be1bce66a8b91950a8519f256400c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

atoi
_initterm
malloc
strcpy
__dllonexit
_onexit
calloc
_stricmp
_open
strcat
_close
_unlink
free
sprintf
memset
strstr
strtol
strlen
strncmp
strtoul
_write
time
strrchr
strchr
_adjust_fdiv
strcmp

kernel32

lstrcpynA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
GetModuleHandleA
lstrcpyA
GlobalFree
LoadLibraryA
GetProcAddress
Sleep
SleepEx
FreeLibrary
GetLastError
MulDiv
lstrlenA
GlobalAlloc

user32

GetDlgItem
SetWindowTextA
wsprintfA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
PostMessageA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
MessageBoxA
SendDlgItemMessageA
SetDlgItemTextA
SetTimer
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindow
CreateDialogParamA
FindWindowExA
GetWindowTextA
SendMessageA

wininet

InternetErrorDlg
InternetSetFilePointer
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
HttpAddRequestHeadersA
InternetSetOptionA
HttpOpenRequestA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle

comctl32

ord17

Exports

Exports

load

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisProcMgr.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProc
_KillProc
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/timet.dll
.dll windows:4 windows x86 arch:x86

651bc9f5d0db795bf404d577647568d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetSystemTimeAsFileTime
lstrcpynA

user32

wsprintfA

Exports

Exports

TimeNow

Sections

.text
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Content/logoUS.png
.png
Content/resourceDE.bin
Content/resourcePH.bin
Content/resourceTW.bin
Content/resourceUS.bin
Content/resourceVN.bin
SearchProtection.exe
.exe windows:4 windows x86 arch:x86

ddd81a2c4db4daa349e5ff0b58ee136c

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Documents and Settings\souravb\FuDogs\Main\SearchDefender_Exe\Release\SearchProtection.pdb

Imports

kernel32

Sleep
GetSystemTime
DeleteCriticalSection
GetVersionExW
lstrcpynA
lstrcpynW
FindClose
FindFirstFileW
InitializeCriticalSection
LoadLibraryA
InterlockedIncrement
lstrcmpiW
LoadLibraryExW
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
FreeLibrary
MultiByteToWideChar
ReleaseSemaphore
CloseHandle
CreateSemaphoreW
GetCommandLineW
SetLastError
GetLastError
LocalFree
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
LoadLibraryW
GetStringTypeW
GetStringTypeA
lstrlenW
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
WideCharToMultiByte
LCMapStringA
GetOEMCP
GetCPInfo
ExitProcess
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
RtlUnwind
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
lstrcmpW
GetCurrentThreadId
InterlockedDecrement
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetComputerNameA
ExpandEnvironmentStringsW
OutputDebugStringA
GetModuleFileNameW
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA

user32

MoveWindow
GetWindowRect
ScreenToClient
GetDlgItem
SetWindowPos
UnregisterClassA
PostMessageW
GetClassNameW
InvalidateRect
GetClientRect
SendMessageW
SetWindowTextW
SetWindowLongW
GetWindowLongW
RegisterClassExW
SetForegroundWindow
CreateAcceleratorTableW
GetFocus
ShowWindow
SetTimer
KillTimer
GetWindow
DestroyAcceleratorTable
GetDesktopWindow
FillRect
ReleaseCapture
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
ReleaseDC
GetDC
ClientToScreen
GetSysColor
wsprintfW
LoadImageW
DestroyWindow
LoadCursorW
GetWindowTextLengthW
GetWindowTextW
GetMessageW
TranslateMessage
DispatchMessageW
LoadMenuW
GetClassInfoExW
UnregisterClassW
CharNextW
RegisterWindowMessageA
RegisterWindowMessageW
FindWindowW
PeekMessageW
PtInRect
MessageBeep
TrackPopupMenuEx
DestroyMenu
GetMenuItemCount
LoadStringA
PostQuitMessage
SetFocus
LoadStringW
SetMenuDefaultItem
GetMenuItemInfoW
SetMenuItemInfoW
MapWindowPoints
RemoveMenu
AppendMenuW
CreatePopupMenu
CallWindowProcW
TranslateAcceleratorW
DestroyIcon
EndPaint
BeginPaint
DefWindowProcW
CreateWindowExW
EnumWindows
DrawTextW
IsWindow

gdi32

GetStockObject
GetObjectW
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
GetDeviceCaps
CreateSolidBrush
DeleteObject
DeleteDC
GetTextExtentPoint32W

advapi32

RegEnumKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegQueryInfoKeyW
RegSetValueExW

ole32

CoCreateInstance
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemRealloc
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CoTaskMemFree

oleaut32

LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SysStringByteLen
VarUI4FromStr
SysAllocStringLen
SysStringLen
VariantClear
VariantInit
SysFreeString
SysAllocString

gdiplus

GdiplusStartup
GdiplusShutdown

Sections

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
fdLoad.dll
.dll windows:4 windows x86 arch:x86

0b86d102054617ee3bef35af3d856f86

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Documents and Settings\souravb\FuDogs\Main\fdLoad\Release\fdLoad.pdb

Imports

wininet

InternetSetOptionW
InternetOpenW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
InternetCrackUrlW

urlmon

ObtainUserAgentString

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

kernel32

DeleteCriticalSection
ExpandEnvironmentStringsW
GetModuleFileNameW
lstrcmpiW
GetTickCount
CompareStringW
lstrcpyW
InterlockedIncrement
InterlockedDecrement
Sleep
SetEvent
CreateEventW
GetComputerNameA
Thread32Next
Thread32First
CreateToolhelp32Snapshot
ReadFile
ResetEvent
WaitForMultipleObjects
FindClose
FindFirstFileW
GetVersionExW
GetVersion
QueryDosDeviceW
FreeLibrary
LoadLibraryExW
GetModuleHandleW
WideCharToMultiByte
GetShortPathNameW
CreateDirectoryExW
GetTempPathW
lstrcatW
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
CreateProcessW
lstrcmpA
lstrcmpiA
GetProcAddress
LoadLibraryA
CreateFileA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
HeapCreate
GetCommandLineA
lstrlenW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
VirtualQuery
GetSystemInfo
GetModuleHandleA
VirtualProtect
RtlUnwind
ResumeThread
ExitThread
GetSystemTimeAsFileTime
HeapSize
HeapReAlloc
HeapDestroy
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetStdHandle
GetModuleFileNameA
GetCPInfo
GetOEMCP
LCMapStringA
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
InitializeCriticalSection
SetLastError
GetCurrentThreadId
lstrlenA
lstrcmpW
DeleteFileW
IsBadWritePtr
MultiByteToWideChar
ReadProcessMemory
VirtualFreeEx
GetCurrentProcessId
OpenProcess
GetStringTypeA
GetStringTypeW
VirtualAllocEx
CreateSemaphoreW
WriteFile
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
WaitForSingleObject
IsBadReadPtr
CreateFileW
GetFileSize
CloseHandle
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateThread
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
LocalFree
IsDebuggerPresent
ExitProcess

user32

InsertMenuItemW
LoadMenuW
GetSubMenu
SetMenuDefaultItem
FindWindowW
DialogBoxParamW
IsWindowVisible
DestroyIcon
MoveWindow
SetForegroundWindow
IsRectEmpty
SetRect
GetWindow
SystemParametersInfoW
GetMenuStringW
GetMenuItemInfoW
GetMenuItemCount
GetMenuItemID
TrackPopupMenu
DestroyMenu
SetWindowRgn
LoadImageW
GetSystemMetrics
GetSysColor
GetCapture
ReleaseCapture
GetCursorPos
SetCursor
DrawFocusRect
PtInRect
GetDlgCtrlID
SetCapture
IsWindowEnabled
InvalidateRect
UpdateWindow
GetClassNameW
SetRectEmpty
BeginPaint
FindWindowExW
GetWindowRect
FillRect
EndPaint
OffsetRect
ReleaseDC
GetDC
DrawTextW
CharNextW
CopyRect
SetWindowPos
GetDlgItem
EndDialog
GetParent
ShowWindow
ScreenToClient
GetClientRect
GetWindowTextLengthW
SetWindowTextW
RegisterWindowMessageW
wsprintfW
GetFocus
GetActiveWindow
GetDesktopWindow
LoadIconW
CreatePopupMenu
AppendMenuW
CallWindowProcW
GetWindowLongW
RegisterClassExW
CreateWindowExW
EnumWindows
GetWindowThreadProcessId
DefWindowProcW
SetActiveWindow
SetFocus
GetWindowTextW
LoadCursorW
GetClassInfoExW
DestroyWindow
IsWindow
RegisterWindowMessageA
SetWindowLongW
PostThreadMessageW
SetDlgItemTextW
PostMessageW
SetWindowsHookExW
SetTimer
MessageBoxW
KillTimer
PeekMessageW
UnhookWindowsHookEx
CallNextHookEx
SendMessageW
EnableWindow
PostQuitMessage
UnregisterClassA
MapWindowPoints

gdi32

GetTextExtentPoint32W
CreateFontW
LineTo
MoveToEx
GetObjectW
DeleteObject
SelectObject
DeleteDC
BitBlt
CreatePolygonRgn
CreateCompatibleDC
CreateFontIndirectW
GetStockObject
SetBkMode
SetTextColor
CreateSolidBrush
SetBkColor
FillRgn
FrameRgn
CreateRectRgn
CombineRgn
CreateRoundRectRgn
CreatePen
CreateCompatibleBitmap

advapi32

RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
RegDeleteKeyW
RegQueryValueExW
CryptAcquireContextW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDestroyKey
CryptDeriveKey
CryptEncrypt
CryptReleaseContext
CryptDecrypt
RegEnumKeyExW

shell32

Shell_NotifyIconW
SHGetMalloc
SHGetPathFromIDListW
ShellExecuteExW
SHGetSpecialFolderLocation
ShellExecuteW

ole32

CoTaskMemFree
CLSIDFromString
GetRunningObjectTable
CreateBindCtx
CoUninitialize
CoInitialize
CoCreateInstance
OleRun

oleaut32

SysAllocString
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantInit
VariantChangeType
VariantClear
GetErrorInfo

shlwapi

UrlEscapeW
StrRChrA
StrCmpNW

comctl32

_TrackMouseEvent

gdiplus

GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCreateSolidFill
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipDeleteBrush
GdipCreateFromHDC
GdipFillRectangleI
GdipDrawImageRectRectI
GdipCloneBrush
GdipCloneImage
GdipGetImageType
GdipLoadImageFromFile

psapi

GetProcessImageFileNameW

Exports

Exports

fn1
fn2
fn3
fn4

Sections

.text
Size: 269KB - Virtual size: 268KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.FuDogLo
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
uninst_ysp.exe.nsis
$PLUGINSDIR/nsisProcMgr.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProc
_KillProc
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisProcMgr.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProc
_KillProc
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/privacy.ini
$PLUGINSDIR/timet.dll
.dll windows:4 windows x86 arch:x86

651bc9f5d0db795bf404d577647568d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetSystemTimeAsFileTime
lstrcpynA

user32

wsprintfA

Exports

Exports

TimeNow

Sections

.text
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/toolbar.bmp
$PLUGINSDIR/welcome.ini
$PROGRAM_FILES/Yahoo!/Common/$PROGRAM_FILES/Yahoo!/Common/unyt.exe.nsis
$_31_/Data/dlg_atb.html
.html .js polyglot
$_31_/Data/dlg_catb.html
.html .js polyglot
$_31_/Data/dlg_cnf.html
.html .js polyglot
$_31_/Data/dlg_cotb.html
.html .js polyglot
$_31_/Data/dlg_ctb.html
.html .js polyglot
$_31_/Data/dlg_fantip.html
.html .js polyglot
$_31_/Data/dlg_fantipg.html
.html .js polyglot
$_31_/Data/dlg_fintip.html
.html .js polyglot
$_31_/Data/dlg_fintipg.html
.html .js polyglot
$_31_/Data/dlg_grptip.html
.html .js polyglot
$_31_/Data/dlg_grptipg.html
.html .js polyglot
$_31_/Data/dlg_logtip.html
.html .js polyglot
$_31_/Data/dlg_mailatip.html
.html .js polyglot
$_31_/Data/dlg_mailtip.html
.html .js polyglot
$_31_/Data/dlg_map.html
.html
$_31_/Data/dlg_mlbtip.html
.html .js polyglot
$_31_/Data/dlg_mlbtipg.html
.html .js polyglot
$_31_/Data/dlg_msgratip.html
.html .js polyglot
$_31_/Data/dlg_msgrtip.html
.html .js polyglot
$_31_/Data/dlg_nbatip.html
.html
$_31_/Data/dlg_nbatipg.html
.html
$_31_/Data/dlg_newstip.html
.html .js polyglot
$_31_/Data/dlg_newstipg.html
.html .js polyglot
$_31_/Data/dlg_nfltip.html
.html
$_31_/Data/dlg_nfltipg.html
.html
$_31_/Data/dlg_opt.html
.html .js polyglot
$_31_/Data/dlg_pub.html
.html .js polyglot
$_31_/Data/dlg_srchtip.html
.html .js polyglot
$_31_/Data/dlg_upg.html
.html .js polyglot
$_31_/Data/dlg_wp.html
.html .js polyglot
YMERemote.dll
.dll regsvr32 windows:4 windows x86 arch:x86

60fc59d11639941018b6f0547a2767a1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YMERemote\Release\YMERemote.pdb

Imports

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_DrawEx

kernel32

LockResource
LoadLibraryA
GetProcAddress
GetVersionExA
WaitForSingleObject
WaitForMultipleObjects
GetACP
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
Sleep
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetFileAttributesA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapReAlloc
GetLocaleInfoA
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetCurrentProcess
GetCurrentProcessId
lstrcpynA
CloseHandle
CreateMutexA
OpenEventA
SetThreadLocale
GetThreadLocale
GetCurrentThreadId
SetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameA
MultiByteToWideChar
RaiseException
WideCharToMultiByte
lstrlenW
lstrlenA
InterlockedDecrement
GetLastError
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
ReleaseMutex
InterlockedIncrement
FlushInstructionCache

user32

GetClientRect
DestroyWindow
IsWindow
CreateWindowExA
CharNextA
SetWindowPos
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
EndDialog
RemovePropA
SetWindowRgn
SetPropA
GetWindowRect
LoadStringA
GetDlgItem
DialogBoxParamA
GetPropA
GetClassNameA
GetWindowThreadProcessId
EnumThreadWindows
FindWindowA
InsertMenuItemA
GetMenuItemCount
AppendMenuA
DestroyMenu
TrackPopupMenu
ClientToScreen
CreatePopupMenu
MessageBoxA
GetDlgCtrlID
MapWindowPoints
SetForegroundWindow
ShowWindow
IsZoomed
DrawTextW
TrackMouseEvent
GetCursorPos
ScrollDC
FrameRect
FillRect
UnionRect
EndPaint
BeginPaint
KillTimer
SetTimer
RegisterWindowMessageA
PtInRect
IntersectRect
LoadImageA
LoadCursorA
GetClassInfoExA
RegisterClassExA
PostMessageA
LoadBitmapA
InvalidateRect
InflateRect
DrawTextA
ReleaseDC
GetDC
OffsetRect
CallWindowProcA
DefWindowProcA
GetWindowLongA
SetWindowLongA
SendMessageA
SendMessageTimeoutA
GetParent
UnregisterClassA

gdi32

ExtCreateRegion
CreateFontIndirectA
CreateCompatibleBitmap
SelectClipRgn
CombineRgn
CreateRectRgn
LineTo
MoveToEx
GetClipBox
GetStockObject
SetBkColor
SetTextColor
CreatePen
CreateSolidBrush
BitBlt
DeleteDC
CreateCompatibleDC
DeleteObject
GetObjectA
SelectObject
SetBkMode

advapi32

RegDeleteValueA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

shell32

ShellExecuteA

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID

oleaut32

LoadTypeLi
RegisterTypeLi
SysAllocStringLen
VariantClear
VariantInit
LoadRegTypeLi
SysStringLen
DispCallFunc
SysAllocString
SysFreeString
VarUI4FromStr
UnRegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YPUBC.dll
.dll regsvr32 windows:4 windows x86 arch:x86

f063b20f8606a0032283d06ba86aaa26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Development\Visualstudio\YBrowser_v34\src\Ypub\RelCompanion\YPUBC.pdb

Imports

kernel32

MulDiv
lstrcpynA
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
Sleep
GetCurrentThreadId
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
GetTickCount
IsBadWritePtr
IsBadReadPtr
HeapFree
CreateMutexA
CloseHandle
ReleaseMutex
WaitForSingleObject
QueryPerformanceCounter
UnmapViewOfFile
GetSystemTime
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetDateFormatA
InterlockedCompareExchange
lstrcpyA
lstrcatA
GlobalAlloc
ReadFile
SetStdHandle
SetFilePointer
IsBadCodePtr
LoadLibraryA
GetStringTypeW
GetStringTypeA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
TerminateProcess
LCMapStringW
LCMapStringA
GetProcAddress
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
VirtualFree
HeapCreate
GetCommandLineA
InterlockedExchange
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
lstrcmpiA
lstrlenA
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FlushFileBuffers
RtlUnwind
ExitProcess
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
HeapDestroy

user32

PtInRect
UnionRect
CharNextA
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
ReleaseDC
GetDC
UnregisterClassA
SetWindowLongA
DefWindowProcA
RegisterWindowMessageA
SetWindowsHookExA
UnhookWindowsHookEx
GetClassNameA
GetPropA
PostMessageA
CallNextHookEx
MessageBeep
RegisterClassExA
GetClassInfoExA
LoadCursorA
CreateWindowExA
wsprintfA
GetParent
SetFocus
ShowWindow
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
InvalidateRect
IsWindow
DestroyWindow
GetKeyState
CallWindowProcA
GetWindowLongA

gdi32

CreateDCA
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
GetDeviceCaps
CreateMetaFileA
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutA

advapi32

RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CoCreateInstance
CreateOleAdviseHolder
StringFromGUID2
OleSaveToStream
WriteClassStm
OleLoadFromStream

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysFreeString
SysStringLen
VarBstrCmp
VariantInit
VariantClear
SysAllocStringLen
SysStringByteLen
VariantChangeType
VarUI4FromStr
SysAllocStringByteLen
LoadRegTypeLi
LoadTypeLi
OleCreatePropertyFrame

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTAntiSpy.dll
.dll regsvr32 windows:4 windows x86 arch:x86

b9926d7ffd0efba81ed49dd7de4fdb2d

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:45:1f:8f:5c:64:a3:d4:37:dd:09:2d:d4:9d:83:65
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/08/2005, 00:00

Not After

21/08/2006, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\Yahoo\depot\toolbar\Main\ytie\plugins\YTAntiSpy\ATL30 Release\YTAntiSpy.pdb

Imports

msvcrt

_adjust_fdiv
_initterm
??3@YAXPAX@Z
_purecall
realloc
memcmp
_wtoi
toupper
tolower
wcscspn
_wcsnicmp
memmove
wcsstr
_mbsnbcmp
strcat
malloc
wcslen
memcpy
free
atoi
strchr
memset
strlen
strcspn
strncmp
??2@YAPAXI@Z
strncpy
strcmp
strcpy
strrchr

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

kernel32

CloseHandle
GetShortPathNameA
LoadLibraryExA
GetLastError
FindResourceA
SizeofResource
DisableThreadLibraryCalls
lstrcatA
lstrcpyA
HeapDestroy
lstrcpynA
IsDBCSLeadByte
lstrcmpiA
InterlockedIncrement
CreateThread
Sleep
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
WideCharToMultiByte
lstrcmpA
CreateFileA
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
LoadResource
InterlockedDecrement
lstrlenA

user32

GetDesktopWindow
CharNextA
LoadStringA
SetForegroundWindow
SetWindowPos
FindWindowA

advapi32

RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA

shell32

ShellExecuteExA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTBM.dll
.dll regsvr32 windows:4 windows x86 arch:x86

387e62e2fbfe685904999456824c2bdc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTBM\Release\YTBM.pdb

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetCrackUrlA
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetQueryOptionA
HttpSendRequestA
InternetConnectA
InternetOpenA
HttpOpenRequestA

urlmon

ObtainUserAgentString

kernel32

GetFileSize
ReadFile
CloseHandle
RaiseException
InterlockedIncrement
GetVersionExA
MultiByteToWideChar
lstrlenA
GetACP
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
IsDBCSLeadByte
lstrcmpiA
SizeofResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetLastError
GetModuleFileNameA
LeaveCriticalSection
WriteFile
SetFilePointer
ReleaseMutex
GetCurrentProcess
LocalAlloc
CreateFileA
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
CreateEventA
CreateThread
SetThreadPriority
GetExitCodeThread
GetCurrentThreadId
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
Sleep
GetComputerNameA
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcAddress
LoadLibraryA
FreeLibrary
InterlockedDecrement
LoadResource
WideCharToMultiByte
lstrlenW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
LocalFree
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
InterlockedExchange
GetLocaleInfoA
GetFileAttributesA
DeleteFileA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery

user32

CharNextA
UnregisterClassA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects

gdi32

DeleteObject

advapi32

RegCreateKeyExA
GetUserNameA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CLSIDFromString
CoInitialize
CoInitializeEx

oleaut32

VarUI4FromStr
SysAllocStringLen
VariantClear
VariantInit
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysStringLen

shlwapi

StrStrIW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTMsgr.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5fdd7a2fa0538db5d8fc3db799e8a758

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTMsgr\Release\YTMsgr.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
RaiseException
DeleteCriticalSection
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetACP
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
IsDBCSLeadByte
SizeofResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
GetTickCount
CreateMutexA
WaitForMultipleObjects
WaitForSingleObject
GetComputerNameA
FreeLibrary
LockResource
SetEvent
GetCurrentThreadId
Sleep
CreateThread
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
RtlUnwind
GetStartupInfoA
GetFileType
SetHandleCount
GetStdHandle
GetModuleFileNameA
FindResourceExA
GetExitCodeThread
LoadResource
CreateFileA
GetCurrentProcess
GetLastError
LocalAlloc
LocalFree
CloseHandle
GetVersionExA
ReleaseMutex
InterlockedDecrement
InterlockedIncrement
SetThreadPriority
WriteFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
ExitProcess
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedExchange
GetLocaleInfoA
GetFileAttributesA
HeapFree
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetProcessHeap
GetCPInfo

user32

UnregisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects
PostMessageA
EnumChildWindows
IsWindow
GetClassNameA
IsWindowVisible
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
IsIconic
ShowWindow
LoadStringA
CharNextA
FindWindowA
PeekMessageA

gdi32

DeleteObject

advapi32

RegCreateKeyExA
GetUserNameA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegCloseKey

ole32

CoUninitialize
CoInitializeEx
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoCreateGuid

oleaut32

VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
VariantCopy
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringLen
VariantInit

shlwapi

StrStrIW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTabBar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

43a74f471c917b4f8b795e72305cff53

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTabBar\Release\YTabBar.pdb

Imports

comctl32

ImageList_Draw
ImageList_SetImageCount
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_Remove

wininet

InternetCrackUrlA

kernel32

SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
lstrlenW
GetModuleFileNameA
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
GetACP
lstrcpynA
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
GetCurrentProcess
FlushInstructionCache
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
Sleep
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
VirtualAlloc
lstrcmpiA
IsDBCSLeadByte
ReleaseMutex
GetVersionExA
LoadLibraryA
FreeLibrary
MultiByteToWideChar
lstrlenA
GetProcAddress
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
SetLastError
GetLastError
RaiseException
CloseHandle
CreateFileA
InterlockedDecrement
InterlockedIncrement
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetLocaleInfoA
InterlockedExchange

user32

CharNextA
CreateWindowExA
SendMessageA
DestroyIcon
LoadIconA
IsWindow
PostMessageA
CopyRect
GetSystemMetrics
InsertMenuItemA
CreatePopupMenu
DrawTextW
TrackMouseEvent
InvalidateRect
PtInRect
GetCursorPos
GetSysColor
GetSysColorBrush
FillRect
DrawTextA
TrackPopupMenu
ScreenToClient
ReleaseDC
GetClientRect
MapWindowPoints
GetDC
DestroyMenu
SystemParametersInfoA
IsWindowUnicode
LoadCursorA
MoveWindow
GetClassNameA
CallNextHookEx
GetAsyncKeyState
IsWindowEnabled
IsIconic
SetForegroundWindow
SetWindowPos
ShowWindow
IsWindowVisible
DestroyWindow
GetParent
UnhookWindowsHookEx
SetWindowsHookExA
GetClassInfoExA
RegisterClassExA
UnregisterClassA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
CallWindowProcA
DefWindowProcA
GetWindowLongA
SetWindowLongA
GetWindowRect
IsZoomed

gdi32

SetBkColor
RoundRect
CreatePen
SetTextColor
SetBkMode
DeleteDC
BitBlt
CreateCompatibleDC
CreateFontIndirectA
GetObjectA
SelectObject
CreateCompatibleBitmap
DeleteObject

advapi32

RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantClear
DispCallFunc
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringByteLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inyt.exe
.exe windows:4 windows x86 arch:x86

1ee0c47671c74b65bc79dddfdfface52

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\inyt\Release\inyt.pdb

Imports

setupapi

SetupIterateCabinetA

kernel32

CreateThread
CreateEventA
InterlockedIncrement
GetCommandLineA
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
lstrlenA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
SetEvent
GetVersionExA
GetProcAddress
LoadLibraryA
DebugBreak
OutputDebugStringA
MoveFileExA
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetShortPathNameA
CreateFileA
GetWindowsDirectoryA
SetEndOfFile
DeleteFileA
CopyFileA
Sleep
FindNextFileA
FindFirstFileA
RemoveDirectoryA
ReleaseMutex
GetCurrentProcess
LockResource
LoadResource
FindResourceExA
CreateMutexA
WaitForMultipleObjects
lstrcmpA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
RaiseException
InterlockedDecrement
WaitForSingleObject
CloseHandle
LoadLibraryExA
GetLastError
FreeLibrary
FindClose
GetConsoleCP
FlushFileBuffers
WriteConsoleW
GetEnvironmentStrings
GetConsoleOutputCP
WriteConsoleA
FreeEnvironmentStringsA
RtlUnwind
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
GetStringTypeW
GetStringTypeA
ExitProcess
HeapSize
LCMapStringW
SetStdHandle
GetConsoleMode
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetFileAttributesA
GetProcessHeap
GetStartupInfoA
HeapReAlloc
GetCPInfo
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA

user32

MsgWaitForMultipleObjects
CharUpperA
CharNextA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
UnregisterClassA
PeekMessageA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

shlwapi

StrStrIA

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inyt.exe.manifest
.xml
pubmod.dll
.dll regsvr32 windows:4 windows x86 arch:x86

00b621b6342f7ef7fc3bfa73a2cdeddc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\PopupBlocker\Release\pubmod.pdb

Imports

wininet

InternetCrackUrlA

kernel32

LeaveCriticalSection
GetCurrentThreadId
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpA
GetCurrentProcess
FlushInstructionCache
MulDiv
SetLastError
LoadLibraryA
GetProcAddress
GetVersionExA
CreateMutexA
CloseHandle
WaitForSingleObject
WaitForMultipleObjects
GetACP
ReleaseMutex
LocalAlloc
LocalFree
CreateFileA
FindResourceExA
GetFileSize
ReadFile
WriteFile
FindResourceW
GetCurrentProcessId
GlobalHandle
GlobalFree
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
lstrlenW
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetStdHandle
HeapCreate
HeapDestroy
ExitProcess
HeapSize
Sleep
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetLastError
WideCharToMultiByte
GetConsoleCP
MultiByteToWideChar
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
LoadResource
FindResourceA
RaiseException
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryExA
SizeofResource
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetConsoleMode

user32

IsWindowVisible
SetTimer
KillTimer
GetKeyState
GetWindowRect
MapWindowPoints
GetSystemMetrics
ShowWindow
SetPropA
GetPropA
AnimateWindow
DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
OffsetRect
UnregisterClassA
RemovePropA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
DestroyWindow
SendMessageA
SetWindowLongA
DestroyAcceleratorTable
DefWindowProcA
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
SetFocus
CallWindowProcA
IsWindow
GetDlgItem
GetWindowLongA
RedrawWindow
GetClassNameA
GetParent
CreateAcceleratorTableA
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateWindowExA
MapDialogRect
GetWindow
SetWindowPos
SetWindowContextHelpId
PostMessageA
CharNextA
FindWindowExA

gdi32

GetObjectA
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
BitBlt
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize

oleaut32

VariantClear
SysStringLen
SysFreeString
VarUI4FromStr
VarBstrCmp
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
OleCreateFontIndirect
SysAllocStringLen
SysAllocString
VariantInit
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
UnRegisterTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
yt.dll
.dll regsvr32 windows:4 windows x86 arch:x86

494bcbc11fbe3a40f24dbdc81bd35d6f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\Release\yt.pdb

Imports

wininet

InternetCrackUrlA
UnlockUrlCacheEntryStream
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetGetCookieA
InternetSetCookieA
RetrieveUrlCacheEntryStreamA
GetUrlCacheEntryInfoA
ReadUrlCacheEntryStream

wsock32

gethostbyname

comctl32

ImageList_Create
ImageList_Destroy
ImageList_AddMasked

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates
ImageGetCertificateHeader

winmm

PlaySoundA

urlmon

FindMimeFromData
ObtainUserAgentString

msimg32

AlphaBlend

iphlpapi

GetAdaptersInfo

netapi32

Netbios

kernel32

MultiByteToWideChar
GetCurrentThreadId
GlobalAlloc
GlobalLock
GetModuleFileNameA
CreateProcessA
LoadLibraryExA
FindResourceA
GlobalUnlock
EnterCriticalSection
lstrcmpA
GetCurrentProcess
FlushInstructionCache
MulDiv
LeaveCriticalSection
ReleaseMutex
IsDBCSLeadByte
lstrcmpiA
SizeofResource
InitializeCriticalSection
DeleteCriticalSection
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
SetEvent
GetACP
lstrcpynA
CreateEventA
CreateThread
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsFree
GetThreadLocale
SetThreadLocale
GetComputerNameA
GetCurrentProcessId
GetTickCount
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
WriteFile
IsBadStringPtrA
TlsGetValue
TlsSetValue
Sleep
lstrlenA
GetVersionExA
LocalAlloc
LocalFree
CreateDirectoryA
SetFilePointer
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalDeleteAtom
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFree
FindResourceW
GlobalHandle
GetExitCodeProcess
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetFileAttributesExA
GetSystemTimeAsFileTime
CompareFileTime
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
CopyFileA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
GetFileAttributesA
WinExec
InterlockedExchange
GetLocaleInfoA
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
SetLastError
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetProcAddress
LoadLibraryA
FreeLibrary
LockResource
LoadResource
FindResourceExA
WideCharToMultiByte
lstrlenW
InterlockedDecrement
RaiseException
InterlockedIncrement
GetStdHandle
HeapSize
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
VirtualProtect
GetSystemInfo
VirtualQuery
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetOEMCP
HeapDestroy
HeapCreate
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CompareStringA
CompareStringW
GetShortPathNameA

user32

SetMenuItemInfoA
GetSysColorBrush
EqualRect
InflateRect
TrackPopupMenu
DialogBoxIndirectParamW
DialogBoxIndirectParamA
CreateDialogParamW
CreateDialogParamA
EnableWindow
IsIconic
EndDialog
EnumWindows
EnumThreadWindows
MessageBoxIndirectA
CreateDialogIndirectParamA
DrawEdge
TrackPopupMenuEx
IsRectEmpty
GetDlgCtrlID
CopyRect
SendMessageW
AnimateWindow
RegisterClipboardFormatA
DeleteMenu
GetWindowDC
FrameRect
SetCursor
GetCapture
GetDCEx
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RemoveMenu
IsWindowVisible
VkKeyScanA
GetAsyncKeyState
GetCursorPos
SetTimer
PtInRect
WindowFromPoint
GetPropA
EnumChildWindows
UnregisterClassA
MessageBoxA
CallNextHookEx
GetWindowRect
UnhookWindowsHookEx
SetWindowsHookExA
MsgWaitForMultipleObjects
GetKeyState
GetMessageA
PeekMessageA
DestroyWindow
SendMessageA
SetWindowLongA
DestroyAcceleratorTable
DefWindowProcA
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
IsChild
GetFocus
SetFocus
CallWindowProcA
IsWindow
GetDlgItem
GetWindowLongA
DrawFrameControl
GetSystemMetrics
GetMenuItemInfoA
GetMenuItemCount
InsertMenuItemA
CreatePopupMenu
DestroyMenu
mouse_event
TrackMouseEvent
SetWindowRgn
OffsetRect
SetActiveWindow
MapWindowPoints
SendMessageCallbackA
FindWindowA
CreateIconFromResource
CreateIconFromResourceEx
CopyIcon
LoadBitmapA
DrawIconEx
SetParent
IntersectRect
ValidateRect
GetUpdateRect
IsWindowEnabled
CallWindowProcW
GetWindowLongW
SetWindowLongW
IsWindowUnicode
RemovePropA
LoadImageA
GetActiveWindow
KillTimer
ShowWindow
SendMessageTimeoutA
RedrawWindow
GetParent
CreateAcceleratorTableA
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
RegisterClassExA
MapDialogRect
GetWindow
SetWindowPos
SetWindowContextHelpId
LoadStringA
PostMessageA
CharLowerA
GetWindowThreadProcessId
FindWindowExA
GetClassNameA
CreateWindowExA
CharNextA
ReleaseDC
GetDC
DestroyIcon
DrawTextA
SetPropA
TranslateMessage
SystemParametersInfoA
DispatchMessageA

advapi32

RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCreateKeyA
GetUserNameA
RegNotifyChangeKeyValue

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoCreateInstance
OleUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemRealloc
CoInitializeEx
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
OleDraw
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
OleInitialize

shell32

ShellExecuteA
ShellExecuteExA
SHFileOperationA

oleaut32

UnRegisterTypeLi
SysAllocStringLen
VariantClear
VariantInit
VariantChangeType
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetElement
VariantCopy
SafeArrayPutElement
SafeArrayCreate
OleLoadPicture
VarBstrCat
VarBstrCmp
SysAllocStringByteLen
OleCreateFontIndirect
RegisterTypeLi
DispCallFunc
VarUI4FromStr
SysStringLen
SysAllocString
SysStringByteLen
LoadTypeLi
LoadRegTypeLi
SysFreeString

shlwapi

StrTrimA
StrTrimW
StrStrIA
StrStrIW

gdi32

MoveToEx
LineTo
GetBkColor
DeleteObject
GetObjectType
CreateBrushIndirect
SelectObject
CreatePen
Rectangle
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
GetObjectA
GetTextColor
SetDIBits
GetStockObject
GetDeviceCaps
GetDIBits
CombineRgn
CreateSolidBrush
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCA
CreateFontIndirectA
TextOutA
SetTextAlign
GetTextMetricsA
EnumFontFamiliesExA
TranslateCharsetInfo
CreateBitmap
SetBkColor
SetTextColor
SetStretchBltMode
StretchBlt
CreateDIBSection
GetPixel
CreateRectRgn
SetBkMode

Exports

Exports

DllCanUnloadNow
DllCommand
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 574KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/yset.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/YDefUser.dll
.dll windows:4 windows x86 arch:x86

eb9b12f933fc102c731bc4f747f068e1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcess
GetLastError
CloseHandle
ExpandEnvironmentStringsA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
ExitProcess
GetProcAddress
TerminateProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

advapi32

RegDeleteValueA
RegEnumKeyExA
RegLoadKeyA
RegOpenKeyExA
RegUnLoadKeyA
RegEnumValueA
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

CloneForAllExistingUsers
CloneForDefaultUser

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c1d02edd28ce94e699431ce65bed28ec

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

1a:34:34:ae:60:24:e9:c5:78:59:4f:17:7b:20:1e:30Certificate

Extended Key Usages

Key Usages

Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 108KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 36KB - Virtual size: 36KB

507af696c5079bf615f35c016c8c37b2

Headers

File Characteristics

Imports

ws2_32

advapi32

user32

kernel32

Exports

Exports

Sections

.text Size: 44KB - Virtual size: 43KB

.text1 Size: 4KB - Virtual size: 40B

.rdata Size: 8KB - Virtual size: 6KB

.data Size: 12KB - Virtual size: 17KB

.data1 Size: 4KB - Virtual size: 308B

.rsrc Size: 8KB - Virtual size: 5KB

.reloc Size: 8KB - Virtual size: 4KB

c4fa86e78b598d87f225e209ba30786f

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 9KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 994B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

1a:34:34:ae:60:24:e9:c5:78:59:4f:17:7b:20:1e:30
Certificate

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 108KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 36KB - Virtual size: 36KB

.text
Size: 44KB - Virtual size: 43KB

.text1
Size: 4KB - Virtual size: 40B

.rdata
Size: 8KB - Virtual size: 6KB

.data
Size: 12KB - Virtual size: 17KB

.data1
Size: 4KB - Virtual size: 308B

.rsrc
Size: 8KB - Virtual size: 5KB

.reloc
Size: 8KB - Virtual size: 4KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 9KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 994B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 109KB

.ndata
Size: - Virtual size: 76KB

.rsrc
Size: 29KB - Virtual size: 29KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 3KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 6KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 1KB