39e497a1d4d0f313ff1a500c5c127d47_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

39e497a1d4d0f313ff1a500c5c127d47_JaffaCakes118
Size

1.4MB
MD5

39e497a1d4d0f313ff1a500c5c127d47
SHA1

23dbc04d4f957ae36b9427cf24ea06f05a61596a
SHA256

8bfab2642630187ba65ebd5f98cda29bcc5936f3825eca917e8e8a0a90b6b4a4
SHA512

6f85e1529b8e723f8afa3609d8997e0133592c85e76318b9a794bfdbc9ce686e5a4b45791de8be4d073eb851203e0e3f5743e0ffc5bc8b251325e8d0e61eff7c
SSDEEP

24576:C5Xxrqyekcpe809pBLz5aOUWn8kHixWY7LAL/96AJONN4ZcPEOGM/1PPDFju8S:GdzekcpIl3XnZGBS6bgc7dN35ja

Score

3^/10

Malware Config

Signatures

Unsigned PE 8 IoCs

Checks for missing Authenticode signature.

resource
39e497a1d4d0f313ff1a500c5c127d47_JaffaCakes118
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack001/$TEMP/wrapped.exe
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsisunz.dll

NSIS installer 4 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$TEMP/wrapped.exe	nsis_installer_1
static1/unpack001/$TEMP/wrapped.exe	nsis_installer_2

Files

39e497a1d4d0f313ff1a500c5c127d47_JaffaCakes118
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 44KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/inetc.dll
.dll windows:4 windows x86 arch:x86

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

_mbschr
_adjust_fdiv
malloc
_initterm
free
strlen
strchr
strrchr
_mbsrchr
strtoul
memset
_mbsstr
strtol

kernel32

GlobalFree
CreateThread
WaitForSingleObject
TerminateThread
GetModuleHandleA
MulDiv
lstrcpyA
GlobalAlloc
LoadLibraryA
GetProcAddress
lstrcmpiA
CreateFileA
GetFileSize
lstrlenA
WriteFile
ReadFile
lstrcmpA
lstrcpynA
lstrcatA
GetLastError
DeleteFileA
CloseHandle
SleepEx
SetFilePointer
GetTickCount

user32

MessageBoxA
GetParent
ShowWindow
SetWindowLongA
IsWindow
SetWindowTextA
SendDlgItemMessageA
GetDlgItem
PostMessageA
GetWindowTextA
SendMessageA
SetDlgItemTextA
SetWindowPos
SystemParametersInfoA
GetClientRect
GetWindowRect
SetTimer
LoadIconA
UpdateWindow
DestroyWindow
KillTimer
RedrawWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindowVisible
EnableWindow
CreateDialogParamA
FindWindowExA
wsprintfA
GetWindowLongA

wininet

HttpSendRequestA
HttpSendRequestExA
HttpQueryInfoA
FtpCreateDirectoryA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetSetFilePointer
InternetSetOptionA
InternetQueryOptionA
InternetCloseHandle
InternetErrorDlg
HttpOpenRequestA
HttpAddRequestHeadersA
HttpEndRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetWriteFile

comctl32

ord17

Exports

Exports

get
head
post
put

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMP/ie.exe
.exe windows:5 windows x86 arch:x86

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

SetFileTime
CompareFileTime
SearchPathW
GetShortPathNameW
GetFullPathNameW
MoveFileW
SetCurrentDirectoryW
GetFileAttributesW
GetLastError
CreateDirectoryW
SetFileAttributesW
Sleep
GetTickCount
CreateFileW
GetFileSize
GetModuleFileNameW
GetCurrentProcess
CopyFileW
ExitProcess
GetWindowsDirectoryW
GetTempPathW
GetCommandLineW
SetErrorMode
CloseHandle
lstrlenW
lstrcpynW
GetDiskFreeSpaceW
GlobalUnlock
GlobalLock
CreateThread
LoadLibraryW
CreateProcessW
lstrcmpiA
GetTempFileNameW
lstrcatW
GetProcAddress
LoadLibraryA
GetModuleHandleA
OpenProcess
lstrcpyW
GetVersionExW
GetSystemDirectoryW
GetVersion
lstrcpyA
RemoveDirectoryW
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GlobalFree
GetModuleHandleW
LoadLibraryExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
WideCharToMultiByte
MulDiv
lstrlenA
WriteFile
ReadFile
MultiByteToWideChar
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW
lstrcpynA

user32

ScreenToClient
GetMessagePos
CallWindowProcW
IsWindowVisible
LoadBitmapW
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
TrackPopupMenu
GetWindowRect
AppendMenuW
CreatePopupMenu
GetSystemMetrics
EndDialog
EnableMenuItem
GetSystemMenu
SetClassLongW
IsWindowEnabled
SetWindowPos
DialogBoxParamW
CheckDlgButton
CreateWindowExW
SystemParametersInfoW
RegisterClassW
SetDlgItemTextW
GetDlgItemTextW
MessageBoxIndirectW
CharNextA
CharUpperW
CharPrevW
DispatchMessageW
PeekMessageW
wsprintfA
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
LoadCursorW
SetCursor
GetWindowLongW
GetSysColor
CharNextW
GetClassInfoW
ExitWindowsEx
FindWindowExW
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
GetClientRect
FillRect
DrawTextW
EndPaint
IsWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectW
SetBkMode
SetTextColor
SelectObject

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
SHGetFileInfoW
ShellExecuteW
SHFileOperationW
SHGetSpecialFolderLocation

advapi32

RegEnumKeyW
RegOpenKeyExW
RegCloseKey
RegDeleteKeyW
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 409KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$1/$PROGRAMFILES/alotappbar/alotUninst.exe.nsis
$1/alotappbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

94a23bfe3d9b856f369fda8e8b74a802

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\appbar_1_2_2000\bin\support\band_ew.pdb

Imports

uxtheme

SetWindowTheme

kernel32

DeleteCriticalSection
lstrcmpiW
LoadLibraryExW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
LockResource
FindResourceExW
LoadLibraryA
InterlockedExchange
OpenMutexW
GetTempFileNameW
DeleteFileW
CopyFileW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
WriteFile
WideCharToMultiByte
CreateFileW
SetEndOfFile
SetFileAttributesW
InitializeCriticalSection
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
ResumeThread
TerminateThread
ResetEvent
SetCurrentDirectoryW
GetSystemTimeAsFileTime
LocalFree
FormatMessageW
GetModuleFileNameA
GetFileAttributesExW
GetLongPathNameW
GetExitCodeProcess
CreateProcessW
TerminateProcess
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrlenA
GetCurrentDirectoryW
FindNextFileW
CreateDirectoryW
GetProcessHeap
InitializeCriticalSectionAndSpinCount
HeapReAlloc
HeapAlloc
HeapFree
SignalObjectAndWait
lstrcpynW
SystemTimeToFileTime
GetSystemTime
DuplicateHandle
VirtualProtect
VirtualQuery
Thread32Next
Thread32First
SuspendThread
OpenThread
DecodePointer
EncodePointer
ExitThread
CreateThread
RtlUnwind
VirtualAlloc
GetSystemInfo
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
HeapDestroy
GetStdHandle
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
CompareStringW
SetEnvironmentVariableA
CreateMutexW
WaitForMultipleObjects
ReleaseMutex
CreateEventW
SetEvent
OpenProcess
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
WaitForSingleObject
GetExitCodeThread
VirtualFreeEx
CloseHandle
GetCurrentProcessId
Sleep
lstrlenW
FreeLibrary
GetCurrentThreadId
OutputDebugStringA
GetModuleFileNameW
SetLastError
GetLastError
LoadLibraryW
InterlockedDecrement
InterlockedIncrement
GetCurrentProcess
FlushInstructionCache
GetTickCount
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetVersion
GetFileAttributesW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
HeapSize
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
LocalAlloc

user32

SetClassLongW
DrawTextW
MonitorFromPoint
EndDialog
SendNotifyMessageW
UpdateWindow
WindowFromPoint
wsprintfW
FrameRect
GetUpdateRect
CreatePopupMenu
AppendMenuW
InsertMenuW
SetMenuItemInfoW
TrackPopupMenu
SetDlgItemTextW
CheckDlgButton
CheckRadioButton
GetDlgItemTextW
IsDlgButtonChecked
SendDlgItemMessageW
GetWindowDC
DrawTextExW
UnregisterClassW
GetSystemMetrics
GetTopWindow
IntersectRect
GetActiveWindow
IsIconic
RegisterClipboardFormatW
GetMenuState
GetSystemMenu
ModifyMenuW
GetSysColorBrush
GetMenuItemRect
DeleteMenu
DestroyMenu
CopyRect
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenuItemInfoW
CopyImage
DialogBoxParamW
KillTimer
SetTimer
CharLowerW
CharUpperW
SendMessageTimeoutW
SystemParametersInfoW
EnumChildWindows
GetAncestor
EnumWindows
OffsetRect
MsgWaitForMultipleObjects
CallNextHookEx
SetWindowsHookExW
UnhookWindowsHookEx
BroadcastSystemMessageW
LoadImageW
DestroyCursor
DestroyIcon
GetCursorPos
SetCursor
GetCursor
SetWindowRgn
PtInRect
TrackMouseEvent
IsWindowEnabled
DialogBoxIndirectParamW
CreateDialogIndirectParamW
IsWindowVisible
MessageBoxW
GetWindowTextLengthW
CreateAcceleratorTableW
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
UnregisterClassA
GetClassNameW
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
GetSysColor
IsChild
GetDlgItem
CharNextW
SetForegroundWindow
EnableWindow
SetActiveWindow
GetParent
GetWindow
GetWindowRect
MonitorFromWindow
GetMonitorInfoW
GetClientRect
MapWindowPoints
SetWindowPos
ShowWindow
MsgWaitForMultipleObjectsEx
IsWindowUnicode
GetMessageA
DispatchMessageA
RegisterWindowMessageW
PostThreadMessageW
GetWindowThreadProcessId
CallWindowProcW
LoadStringW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetWindowTextW
GetKeyState
SetWindowTextW
GetFocus
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
LoadCursorW
IsWindow
SendMessageW
PostMessageW
SetWindowLongW
GetWindowPlacement

gdi32

DeleteDC
DeleteObject
GetTextMetricsW
IntersectClipRect
SetBkMode
GetPixel
DPtoLP
CreateBitmap
GetMapMode
SetMapMode
GetDIBColorTable
MoveToEx
LineTo
CreateFontIndirectW
SetBkColor
ExtTextOutW
GetTextExtentPoint32W
CreatePen
RoundRect
SetTextColor
CreateFontW
FrameRgn
SetDIBColorTable
CreateRoundRectRgn
CreatePolygonRgn
CreateRectRgn
CombineRgn
CreateDIBSection
SetStretchBltMode
StretchBlt
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetMalloc
ord165
ShellExecuteExW
SHGetSpecialFolderPathW
SHFileOperationW
SHFileOperationA
ord92
SHGetDesktopFolder

ole32

CoGetInterfaceAndReleaseStream
OleDuplicateData
CoInitialize
RegisterDragDrop
ReleaseStgMedium
DoDragDrop
StringFromCLSID
OleInitialize
CreateStreamOnHGlobal
CoMarshalInterThreadInterfaceInStream
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SafeArrayDestroy
SafeArrayPutElement
VariantClear
VariantCopy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayAccessData
GetErrorInfo
SafeArrayCreateVector
SafeArrayUnaccessData
OleCreateFontIndirect
LoadTypeLi
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
SysAllocString
SysAllocStringLen
VarBstrCmp
SysStringLen
VarUI4FromStr
SysFreeString
VariantCopyInd
VariantChangeType
DispCallFunc
VariantInit

shlwapi

SHGetValueW
UrlIsW
PathCreateFromUrlW
SHRegWriteUSValueW
SHRegCreateUSKeyW
PathIsRelativeW
UrlUnescapeW
PathAppendW
PathFileExistsW
PathFindFileNameW
SHDeleteValueW
StrRetToStrW
UrlEscapeW
PathIsURLW
SHCopyKeyW
UrlGetPartW
PathFindExtensionW
StrCmpIW
SHDeleteKeyW
UrlCanonicalizeW

msimg32

TransparentBlt
AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 808KB - Virtual size: 808KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alothelper.dll
.dll regsvr32 windows:5 windows x86 arch:x86

aabfd7aec29f8b9640c3b9f085a45859

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\appbar_1_2_2000\ALOTHelper\Release\ALOTHelper.pdb

Imports

shlwapi

SHGetValueW

kernel32

EncodePointer
lstrcpyW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
lstrlenW
GetCurrentDirectoryW
SetCurrentDirectoryW
LoadLibraryW
GetLastError
SetLastError
GetModuleFileNameW
OutputDebugStringA
FreeLibrary
lstrcatW
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
EnterCriticalSection
LeaveCriticalSection
WriteFile
HeapSize
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
RaiseException
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter

user32

DestroyWindow
PostMessageW
GetClassInfoW
IsWindow
GetWindowLongW
SetWindowLongW
DefWindowProcW
ShowWindow
GetParent
CreateWindowExW
RegisterClassW
GetClientRect

oleaut32

VariantInit
SysAllocString
SysFreeString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotservice.exe
.exe windows:5 windows x86 arch:x86

94a74fb69d6a5ba57837b07c11e5b02c

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

urlmon

CoInternetCompareUrl
URLDownloadToFileW
ObtainUserAgentString

wtsapi32

WTSUnRegisterSessionNotification
WTSQuerySessionInformationW
WTSQueryUserToken
WTSSendMessageW
WTSRegisterSessionNotification
WTSFreeMemory

userenv

LoadUserProfileW
CreateEnvironmentBlock
DestroyEnvironmentBlock
UnloadUserProfile

shlwapi

SHGetValueW
PathAppendW

wininet

InternetConnectW
HttpOpenRequestW
InternetGetLastResponseInfoW
HttpSendRequestW
InternetCloseHandle
InternetCrackUrlW
InternetOpenUrlW
InternetOpenW
InternetAttemptConnect
HttpAddRequestHeadersW
HttpQueryInfoW
InternetReadFile

psapi

GetModuleBaseNameW
EnumProcessModules
EnumProcesses

kernel32

CompareStringW
WriteConsoleW
SetEnvironmentVariableA
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetCurrentProcessId
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
QueryPerformanceCounter
GetStartupInfoW
GetFileType
SetHandleCount
GetLastError
SetLastError
lstrcpyW
lstrlenW
WaitForSingleObject
WaitForMultipleObjects
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InitializeCriticalSection
DeleteCriticalSection
GetLocalTime
GetModuleFileNameW
SetEvent
Process32NextW
CloseHandle
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
ExitThread
GetTickCount
CreateProcessW
WTSGetActiveConsoleSessionId
GetCurrentThreadId
CopyFileW
MultiByteToWideChar
FreeLibrary
GetProcAddress
LoadLibraryW
TerminateThread
GetExitCodeThread
DeleteFileW
OpenEventW
UnregisterWaitEx
RegisterWaitForSingleObject
ResetEvent
CreateEventW
GetVersionExA
GetVersionExW
CreateDirectoryW
FindClose
FindFirstFileW
WideCharToMultiByte
InterlockedIncrement
InterlockedDecrement
OpenMutexW
CreateMutexW
ReleaseMutex
GetProcessHeap
HeapSize
HeapReAlloc
lstrcmpiW
lstrcmpW
HeapAlloc
HeapFree
lstrlenA
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
ResumeThread
CreateThread
EncodePointer
DecodePointer
GetEnvironmentStringsW
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
HeapCreate
InitializeCriticalSectionAndSpinCount
ExitProcess
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
GetTimeZoneInformation
GetStdHandle
FreeEnvironmentStringsW
VirtualProtect

user32

GetWindowLongW
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
MsgWaitForMultipleObjects
CreateWindowExW
RegisterClassExW
DefWindowProcW
WaitForInputIdle
DestroyWindow
GetClassInfoExW
SetWindowLongW
wsprintfW
CallWindowProcW
LoadCursorW
UnregisterClassA

advapi32

DuplicateTokenEx
RegSetValueExW
RegCloseKey
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
CreateProcessAsUserW
SetServiceStatus
StartServiceW
ControlService
OpenServiceW
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
ChangeServiceConfig2W
RegCreateKeyExW

shell32

ord92
ord165

ole32

CoTaskMemFree
CLSIDFromString
CoCreateInstance
CLSIDFromProgID
CoUninitialize
CoInitializeEx

oleaut32

SafeArrayDestroy
VariantChangeType
VariantClear
VarBstrCmp
SysStringLen
VariantInit
SafeArrayCreateVector
SafeArrayAccessData
SysFreeString
SysAllocString
SysAllocStringLen
SafeArrayUnaccessData

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotsettings.exe
.exe windows:5 windows x86 arch:x86

ba8e0ea689ca147fe801b09814f69ea1

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\appbar_1_2_2000\bin\support\ALOTSettings.pdb

Imports

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules

kernel32

LCMapStringW
Sleep
RtlUnwind
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
WaitForSingleObject
CreateRemoteThread
OpenProcess
WideCharToMultiByte
VirtualFreeEx
TerminateProcess
lstrlenW
GetLastError
SetLastError
GetProcAddress
VirtualAllocEx
GetExitCodeThread
CloseHandle
WriteProcessMemory
GetProcessHeap
HeapAlloc
HeapSize
MultiByteToWideChar
RaiseException
HeapFree
HeapReAlloc
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
GetSystemTimeAsFileTime
GetModuleHandleA
VirtualProtect
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetStartupInfoW
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
EncodePointer
IsProcessorFeaturePresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
FreeEnvironmentStringsW
GetEnvironmentStringsW

user32

SendMessageTimeoutW
SetWindowLongW
GetWindowLongW
PostMessageW
RegisterWindowMessageW
SetParent
SendMessageW

advapi32

RegCreateKeyExW
RegSetValueExW

shlwapi

SHDeleteKeyW

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/alotwidgets.exe
.exe windows:5 windows x86 arch:x86

50e451d8abc6a3e252a7fa7dae9ba015

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\appbar_1_2_2000\WidgetBox\Release\WidgetBox.pdb

Imports

urlmon

CoInternetCompareUrl
ObtainUserAgentString
IsValidURL
URLDownloadToFileW

oleacc

AccessibleObjectFromWindow
AccessibleChildren

wininet

InternetOpenW
InternetCreateUrlW
InternetCrackUrlW
InternetOpenUrlW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle

psapi

GetModuleBaseNameW
EnumProcesses
EnumProcessModules

ws2_32

WSAGetLastError
gethostbyname

kernel32

TlsGetValue
TlsSetValue
TlsFree
GetCPInfo
TlsAlloc
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetCommandLineW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetFileAttributesW
GetVersion
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentProcess
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
OpenMutexW
GetLastError
WaitForSingleObject
CreateMutexW
SetLastError
lstrlenW
CloseHandle
ReleaseMutex
LoadLibraryW
GetModuleFileNameW
OutputDebugStringA
GetCurrentThreadId
ExitProcess
lstrcmpW
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
WideCharToMultiByte
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
CreateDirectoryW
DeleteFileW
ResetEvent
CreateEventW
UnmapViewOfFile
MapViewOfFile
GetACP
CreateFileMappingW
Sleep
WriteFile
CreateFileW
MultiByteToWideChar
TerminateThread
MoveFileW
FreeLibrary
lstrlenA
FindClose
FindFirstFileW
GetFileSize
SetFilePointer
ReadFile
SetEndOfFile
SetFileAttributesW
GetExitCodeProcess
GetTickCount
GetVersionExA
GetVersionExW
GetSystemDefaultLangID
LocalFree
FormatMessageW
GetSystemTimeAsFileTime
GetLongPathNameW
TerminateProcess
OpenProcess
GetCurrentDirectoryW
SetCurrentDirectoryW
SetEvent
lstrcmpiW
WaitForMultipleObjects
LoadLibraryA
InterlockedExchange
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
SizeofResource
LoadResource
FindResourceW
GetProcessHeap
HeapSize
HeapReAlloc
HeapAlloc
HeapFree
GetOEMCP
IsValidCodePage
HeapCreate
GetStdHandle
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
InterlockedCompareExchange
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
QueryPerformanceCounter
InterlockedPopEntrySList
RtlUnwind
EncodePointer
DecodePointer
VirtualProtect
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleW
FlushFileBuffers
GetCurrentProcessId

user32

AttachThreadInput
AllowSetForegroundWindow
BringWindowToTop
SetForegroundWindow
SystemParametersInfoW
EnumWindows
MsgWaitForMultipleObjects
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetWindowThreadProcessId
BroadcastSystemMessageW
GetWindowPlacement
IsWindowVisible
GetWindowRect
IsIconic
FindWindowExW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
GetFocus
SetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
GetForegroundWindow
GetClassNameW
GetDlgItem
CopyRect
FrameRect
SetWindowRgn
GetWindowDC
TrackMouseEvent
MonitorFromRect
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
GetClientRect
MoveWindow
CharNextW
GetSysColor
GetWindow
GetKeyState
ShowWindow
GetParent
IsChild
SendMessageW
RegisterWindowMessageW
PostThreadMessageW
CallWindowProcW
GetWindowLongW
DefWindowProcW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
DestroyWindow
LoadCursorW
IsWindow
PostMessageW
SetWindowLongW
GetSystemMetrics
FindWindowW
GetClassInfoW
GetCursorPos
SetLayeredWindowAttributes
UnregisterClassA
UnregisterClassW
RegisterClassW
CopyImage
PtInRect
KillTimer
SetTimer
DrawTextW
InSendMessage
ReplyMessage
LoadImageW
SendNotifyMessageW
MonitorFromPoint
ReleaseCapture
GetMonitorInfoW
SetWindowPos

gdi32

BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
CreateSolidBrush
GetDeviceCaps
SetDIBitsToDevice
CreatePatternBrush
CreateRectRgn
CreateRoundRectRgn
StretchBlt
ExtTextOutW
RoundRect
SetPixel
CreateFontW
CreateDIBSection
CreatePen
MoveToEx
LineTo
GetTextExtentPoint32W
DeleteDC
SetDIBColorTable
SetTextColor
SetBkMode
GetStockObject
GetObjectW

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegOpenKeyExW
RegDeleteKeyW

shell32

ord165
ord92
ShellExecuteExW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleUninitialize
StringFromGUID2

oleaut32

DispCallFunc
VariantChangeType
VariantCopyInd
SysStringLen
VarBstrCmp
SysFreeString
SysAllocStringLen
VariantInit
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
OleCreateFontIndirect
SafeArrayUnaccessData
SafeArrayAccessData
VarUI4FromStr
SafeArrayCreateVector
SafeArrayDestroy
SysAllocString
VariantCopy
VariantClear
SysAllocStringByteLen

shlwapi

PathIsRelativeW
PathCreateFromUrlW
UrlIsW
SHGetValueW
PathAppendW
PathFileExistsW
UrlGetPartW

msimg32

TransparentBlt

gdiplus

GdipAlloc
GdipFree
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup

Sections

.text
Size: 424KB - Virtual size: 424KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 125KB - Virtual size: 125KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$1/resources/App_1007/images/1d14fe3350fef6b2cc0a4aa18ac5b0db.png
.png
$1/resources/App_117011/images/0b8ecbe372a5175cbe0643c28c1a236a.png
.png
$1/resources/App_2254/images/8cffb8b3ba4df43dea939ac6952b3f2f.png
.png
$1/resources/App_3562/images/d5aed714f2ab2d7fd8fd3f0b12d30a11.png
.png
$1/resources/App_43911/images/018148d9866994114ac9caeb5325ccae.png
.png
$1/resources/App_4629/images/7b2fdf9965fe4ff9b4ccddc50297c066.png
.png
$1/resources/App_5809/images/dea85611eacb320a29fe17b8907b7e05.png
.png
$1/resources/App_5862/images/31b7f2c3bcbce9030f42ad480a938327.png
.png
$1/resources/App_91011/images/4abec59effe5e1b1faed16b1b38bf35a.png
.png
$1/resources/shared/domains.dat
.xml
$1/resources/shared/images/DesktopAlertClose.png
.png
$1/resources/shared/images/PageAlertBkgnd.png
.png
$1/resources/shared/images/PageAlertButton.png
.png
$1/resources/shared/images/PageAlertButtonHot.png
.png
$1/resources/shared/images/PageAlertClose.png
.png
$1/resources/shared/images/PageAlertCloseHot.png
.png
$1/resources/shared/images/add-app-hover.png
.png
$1/resources/shared/images/add-app.png
.png
$1/resources/shared/images/alot-logo-100x51.png
.png
$1/resources/shared/images/alot-logo-13x13.png
.png
$1/resources/shared/images/alot-logo-16x16.png
.png
$1/resources/shared/images/alot-logo-65x34-hover.png
.png
$1/resources/shared/images/alot-logo-65x34.png
.png
$1/resources/shared/images/alot-logo-95x55.png
.png
$1/resources/shared/images/check.png
.png
$1/resources/shared/images/cog-hover.png
.png
$1/resources/shared/images/cog.png
.png
$1/resources/shared/images/desktopAlertAttrBkgnd.png
.png
$1/resources/shared/images/desktopAlertCloseHot.png
.png
$1/resources/shared/images/desktopAlertImage.png
.png
$1/resources/shared/images/desktopAlertImageBkgnd.png
.png
$1/resources/shared/images/desktopAlertTextBkgnd.png
.png
$1/resources/shared/images/error-icon.jpg
.jpg
$1/resources/shared/images/favicon.ico
$1/resources/shared/images/loading.bmp
$1/resources/shared/images/magnifying-glass.png
.png
$1/resources/shared/images/search-button-hover.png
.png
$1/resources/shared/images/search-button.png
.png
$1/resources/shared/images/theme/standard/appbar-bg.png
.png
$1/resources/shared/images/theme/standard/divider.png
.png
$1/resources/shared/images/theme/standard/page/bg.png
.png
$1/resources/shared/images/theme/standard/page/left/hover.png
.png
$1/resources/shared/images/theme/standard/page/left/normal.png
.png
$1/resources/shared/images/theme/standard/page/left/not-available.png
.png
$1/resources/shared/images/theme/standard/page/right/hover.png
.png
$1/resources/shared/images/theme/standard/page/right/normal.png
.png
$1/resources/shared/images/theme/standard/page/right/not-available.png
.png
$1/resources/shared/images/theme/standard/slider.png
.png
$1/resources/shared/images/theme/standardClassic/appbar-bg.png
.png
$1/resources/shared/images/theme/standardClassic/divider.png
.png
$1/resources/shared/images/theme/standardClassic/page/bg.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/hover.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/normal.png
.png
$1/resources/shared/images/theme/standardClassic/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardClassic/slider.png
.png
$1/resources/shared/images/theme/standardWin7/appbar-bg.png
.png
$1/resources/shared/images/theme/standardWin7/divider.png
.png
$1/resources/shared/images/theme/standardWin7/page/bg.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/left/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/hover.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/normal.png
.png
$1/resources/shared/images/theme/standardWin7/page/right/not-available.png
.png
$1/resources/shared/images/theme/standardWin7/slider.png
.png
$1/resources/shared/images/widget/caption-bg.bmp
$1/resources/shared/images/widget/close-hover.bmp
$1/resources/shared/images/widget/close.bmp
$1/resources/shared/images/widget/configure-hover.bmp
$1/resources/shared/images/widget/configure.bmp
$1/resources/shared/images/widget/refresh-hover.bmp
$1/resources/shared/images/widget/refresh.bmp
$1/service.xml
.xml
$1/toolbar.xml
.xml
$PLUGINSDIR/InstallOptions.dll
.dll windows:5 windows x86 arch:x86

cd90e33ffbc335413a25300c682c83df

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
GetModuleHandleW
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
SetCurrentDirectoryW
GetPrivateProfileIntW
GetPrivateProfileStringW
lstrcatW
WritePrivateProfileStringW
lstrcpynW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc

user32

OpenClipboard
DestroyIcon
LoadCursorW
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
SetWindowLongW
GetClientRect
SetWindowRgn
LoadIconW
LoadImageW
CreateWindowExW
MapDialogRect
GetClipboardData
GetWindowRect
CreateDialogParamW
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
SetCursor
DrawTextW
GetWindowLongW
DrawFocusRect
CallWindowProcW
PostMessageW
wsprintfW
CharNextW
MessageBoxW
CloseClipboard
GetDlgCtrlID
MapWindowPoints
SetWindowPos
PtInRect
GetWindowTextW
SetWindowTextW
SendMessageW
DestroyWindow

gdi32

SelectObject
CreateRectRgn
GetObjectW
CombineRgn
DeleteObject
CreateCompatibleDC
GetDIBits
SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteW
SHGetDesktopFolder

comdlg32

GetOpenFileNameW
CommDlgExtendedError
GetSaveFileNameW

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:5 windows x86 arch:x86

6c41c5e4d44f55745b925cc4e42b7fab

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyW
lstrcpynW
GetProcAddress
WideCharToMultiByte
lstrcatW
LoadLibraryW
GetModuleHandleW
MultiByteToWideChar
VirtualAlloc
VirtualProtect
lstrlenW
FreeLibrary

user32

wsprintfW

ole32

CLSIDFromString
StringFromGUID2

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 899B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 574B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/closeie.ini
$PLUGINSDIR/eula.html
.html
$PLUGINSDIR/eula.ini
$PLUGINSDIR/installagent.exe
.exe windows:5 windows x86 arch:x86

17dbb3c2e33b680c05b1a90cb7e81be0

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\LOCALPROJECTS\installhelper\bin\support\installagent.pdb

Imports

psapi

GetProcessImageFileNameW
EnumProcessModules
EnumProcesses
GetModuleBaseNameW

wininet

InternetGetLastResponseInfoW
InternetCloseHandle
InternetOpenUrlW
InternetOpenW

urlmon

URLDownloadToFileW
ObtainUserAgentString

kernel32

GetFileType
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
CreateFileW
HeapReAlloc
lstrlenA
HeapAlloc
InterlockedIncrement
InterlockedDecrement
HeapFree
GetProcessHeap
MultiByteToWideChar
lstrlenW
HeapSize
lstrcmpiW
FindFirstFileW
CreateProcessW
GetStartupInfoW
InitializeCriticalSection
OpenProcess
Sleep
LeaveCriticalSection
TerminateProcess
GetLastError
SetLastError
EnterCriticalSection
FindClose
DeleteCriticalSection
CloseHandle
GetCurrentProcessId
LoadLibraryW
QueryPerformanceCounter
GetTickCount
WaitForSingleObject
WriteConsoleW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
LCMapStringW
WideCharToMultiByte
RtlUnwind
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
HeapCreate
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentThreadId
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
RaiseException
InitializeCriticalSectionAndSpinCount
GetSystemTimeAsFileTime

user32

IsWindow
SendMessageTimeoutW
GetClassNameW
EnumWindows
GetWindowThreadProcessId

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW

ole32

CoUninitialize
CoInitialize
CoCreateGuid

shlwapi

PathAppendW
SHGetValueW
PathFindFileNameW

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/installhelper.dll
.dll windows:5 windows x86 arch:x86

c0ebac76e4e78df8b8b418556aa60715

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

01/05/2012, 00:00

Not After

31/12/2012, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Not Before

14/06/2010, 00:00

Not After

20/06/2013, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

21/05/2009, 00:00

Not After

20/05/2019, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\LOCALPROJECTS\installhelper\Release\installhelper.pdb

Imports

wtsapi32

WTSQueryUserToken
WTSFreeMemory
WTSQuerySessionInformationW
WTSSendMessageW

shell32

ord165
ShellExecuteW
SHFileOperationW
ord92

userenv

CreateEnvironmentBlock
LoadUserProfileW
UnloadUserProfile
DestroyEnvironmentBlock

psapi

EnumProcesses
EnumProcessModules
GetModuleBaseNameW
GetProcessImageFileNameW

urlmon

IsValidURL
URLDownloadToFileW
ObtainUserAgentString

wininet

InternetOpenW
InternetOpenUrlW
InternetGetLastResponseInfoW
InternetCloseHandle

kernel32

lstrcmpW
GetVersionExA
GetVersionExW
GetLongPathNameW
FindClose
FindFirstFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
TerminateProcess
WaitForSingleObject
InterlockedIncrement
InterlockedDecrement
FreeLibrary
GetProcAddress
LoadLibraryW
CreateDirectoryW
GetModuleFileNameW
CopyFileW
GetTempPathW
RaiseException
EnterCriticalSection
LeaveCriticalSection
FlushInstructionCache
GetCurrentDirectoryW
SetCurrentDirectoryW
MoveFileW
DeleteFileW
WTSGetActiveConsoleSessionId
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
MulDiv
GlobalUnlock
GlobalLock
GlobalAlloc
ProcessIdToSessionId
GetLocalTime
InitializeCriticalSection
OpenMutexW
CreateMutexW
ReleaseMutex
LocalFree
HeapSize
HeapReAlloc
lstrcmpiW
MultiByteToWideChar
lstrlenA
ReadFile
GetFileSize
CreateFileW
SetFileAttributesW
GetFileAttributesW
WriteFile
SetEndOfFile
SetFilePointer
RtlUnwind
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
VirtualProtect
VirtualAlloc
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineA
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringW
HeapCreate
HeapDestroy
GetStdHandle
WideCharToMultiByte
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetStdHandle
FlushFileBuffers
WriteConsoleW
GetTickCount
GetProcessHeap
HeapAlloc
Sleep
HeapFree
GetCurrentProcessId
SetLastError
GetLastError
GetCurrentProcess
OpenProcess
CreateProcessW
CloseHandle
lstrlenW
InterlockedCompareExchange
InterlockedPushEntrySList
VirtualFree
InterlockedPopEntrySList
FindNextFileW

user32

SetWindowLongW
DestroyWindow
EnumWindows
IsWindow
GetDesktopWindow
SetWindowPos
WaitForInputIdle
FindWindowW
GetWindowThreadProcessId
UnregisterClassA
GetClassInfoExW
LoadCursorW
RegisterClassExW
CreateWindowExW
DestroyAcceleratorTable
GetClientRect
GetWindowLongW
UnregisterClassW
DefWindowProcW
MsgWaitForMultipleObjects
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
SendMessageW
GetFocus
GetWindow
SetFocus
GetClassNameW
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetDlgItem
GetParent
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC
GetDC
ScreenToClient
ClientToScreen
MoveWindow
CharNextW
SendMessageTimeoutW
GetSysColor

gdi32

GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject

advapi32

RegOpenKeyExW
QueryServiceStatusEx
CloseServiceHandle
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteValueW
RegQueryValueExW
CreateServiceW
ChangeServiceConfig2W
ChangeServiceConfigW
RegCloseKey
GetSecurityInfo
GetAclInformation
GetAce
DeleteAce
SetSecurityInfo
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyExW
ControlService
StartServiceW
OpenSCManagerW
DeleteService
EnumDependentServicesW
OpenServiceW
GetTokenInformation
OpenProcessToken
DuplicateTokenEx

ole32

CoCreateInstance
StringFromGUID2
OleLockRunning
CoGetClassObject
CoTaskMemFree
CoInitialize
CoUninitialize
OleUninitialize
CLSIDFromProgID
CLSIDFromString
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize

oleaut32

OleCreateFontIndirect
SysStringLen
SysAllocString
VariantInit
VariantClear
SysFreeString
LoadRegTypeLi
LoadTypeLi
SysAllocStringByteLen
SysStringByteLen
DispCallFunc
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VarBstrCmp
VariantChangeType
SafeArrayDestroy
SysAllocStringLen

shlwapi

PathFindFileNameW
PathIsURLW
UrlCreateFromPathW
UrlEscapeW
PathAppendW
PathFileExistsW
UrlIsW
PathCreateFromUrlW
PathIsRelativeW
SHDeleteValueW
SHDeleteKeyW
SHGetValueW

Exports

Exports

BackupProduct
DownloadAndRun
HtmlCreate
HtmlDestroy
HtmlDisplay
IEAddSearchProvider
IEApprove
IEDisapprove
IEGetDefaultSearchProvider
IEGetMajorVersion
IELaunch
IERemoveSearchProvider
IESetDefaultSearchProvider
IEShowToolbar
IEShowToolbarExW
IEUnblockExtension
InstallProduct
InstallService
Notify
RegUserDeleteKey
RegUserReadDWORD
RegUserReadString
RegUserWriteDWORD
RegUserWriteString
RegisterProduct
RemoveBackups
RestoreProduct
RunService
StopService
TerminateProductProcesses
UninstallService
UnregisterProduct
UpdateUser
WinGetKnownFolderPath

Sections

.text
Size: 180KB - Virtual size: 180KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-header.bmp
$TEMP/wrapped.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
GetLastError
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/nsisunz.dll
.dll windows:4 windows x86 arch:x86

0f92772da9c737d2bac38919e9863980

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
InitializeCriticalSection
CreateDirectoryA
lstrcpyA
lstrcmpA
lstrcmpiA
GlobalFree
lstrcpynA
GlobalAlloc
lstrcatA
lstrlenA
GetVersion
LeaveCriticalSection
EnterCriticalSection
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetLastError
CreateFileA
WriteFile
ReadFile
CloseHandle
SetFilePointer

user32

MessageBoxA
DispatchMessageA
TranslateMessage
PeekMessageA
CharPrevA
wsprintfA
SendMessageA
GetDlgItem
FindWindowExA

Exports

Exports

Unzip
UnzipToLog
UnzipToStack
extract_RunDLL

Sections

.text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 706B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$_8_/raw.xpi
.zip
META-INF/manifest.mf
META-INF/zigbert.rsa
META-INF/zigbert.sf
chrome.manifest
chrome/alottb.jar
.zip .js polyglot
content/alottb-aAlotCustom.js
.js
content/alottb-aAlotCustomButton.js
.js
content/alottb-aAlotSitepass.js
.js
content/alottb-aAlotToolbar.js
.js
content/alottb-aAlotWidget.js
.js
content/alottb-aAlotWidgetAppBand.js
.js
content/alottb-aAlotWidgetBrowser.js
.js
content/alottb-aAlotWidgetButton.js
.js
content/alottb-aAlotWidgetFileHelper.js
.js
content/alottb-aAlotWidgetRegistryHelper.js
.js
content/alottb-aAlotWidgetTabHelper.js
.js
content/alottb-aAlotWidgetWebSnapshots.js
.js
content/alottb-aAlotWidgetWindow.js
.js
content/alottb-action.js
.js
content/alottb-appbar.js
.js
content/alottb-error.js
.js
content/alottb-history.js
.js
content/alottb-lib.js
.js
content/alottb-macWinFix.js
.js
content/alottb-macWinFix.xul
.xml
content/alottb-main.js
.js
content/alottb-options-dialog-pi.xul
.xml
content/alottb-options-dialog.xul
.xml
content/alottb-options.js
.js
content/alottb-overlay.xul
.xml
content/alottb-pref.js
content/alottb-search-defend.js
.js
content/alottb-third-party-dialog.xul
.js .xml polyglot
content/alottb-toolbar.js
.js
content/alottb-webshots.js
.js
content/alottb-widget.js
.js
content/alottb-widgetWin.js
.js
content/config/cache/018148d9866994114ac9caeb5325ccae.png
.png
content/config/cache/0b8ecbe372a5175cbe0643c28c1a236a.png
.png
content/config/cache/1d14fe3350fef6b2cc0a4aa18ac5b0db.png
.png
content/config/cache/31b7f2c3bcbce9030f42ad480a938327.png
.png
content/config/cache/4abec59effe5e1b1faed16b1b38bf35a.png
.png
content/config/cache/7b2fdf9965fe4ff9b4ccddc50297c066.png
.png
content/config/cache/8cffb8b3ba4df43dea939ac6952b3f2f.png
.png
content/config/cache/add-app-hover.png
.png
content/config/cache/add-app.png
.png
content/config/cache/alot-logo-13x13.png
.png
content/config/cache/alot-logo-16x16.png
.png
content/config/cache/alot-logo-65x34-hover.png
.png
content/config/cache/alot-logo-65x34.png
.png
content/config/cache/alot-logo-95x55.png
.png
content/config/cache/cog-hover.png
.png
content/config/cache/cog.png
.png
content/config/cache/d5aed714f2ab2d7fd8fd3f0b12d30a11.png
.png
content/config/cache/dea85611eacb320a29fe17b8907b7e05.png
.png
content/config/cache/discover.png
.png
content/config/cache/error-icon.jpg
.jpg
content/config/cache/favicon.ico
content/config/cache/loading.bmp
content/config/cache/magnifying-glass.png
.png
content/config/cache/search-button-hover.png
.png
content/config/cache/search-button.png
.png
content/config/cache/theme/blue/appbar-bg.png
.png
content/config/cache/theme/blue/divider.png
.png
content/config/cache/theme/blue/page/bg.png
.png
content/config/cache/theme/blue/page/left/hover.png
.png
content/config/cache/theme/blue/page/left/normal.png
.png
content/config/cache/theme/blue/page/left/not-available.png
.png
content/config/cache/theme/blue/page/right/hover.png
.png
content/config/cache/theme/blue/page/right/normal.png
.png
content/config/cache/theme/blue/page/right/not-available.png
.png
content/config/cache/theme/blue/slider.png
.png
content/config/cache/theme/blue/swatch.png
.png
content/config/cache/theme/green/appbar-bg.png
.png
content/config/cache/theme/green/divider.png
.png
content/config/cache/theme/green/page/bg.png
.png
content/config/cache/theme/green/page/left/hover.png
.png
content/config/cache/theme/green/page/left/normal.png
.png
content/config/cache/theme/green/page/left/not-available.png
.png
content/config/cache/theme/green/page/right/hover.png
.png
content/config/cache/theme/green/page/right/normal.png
.png
content/config/cache/theme/green/page/right/not-available.png
.png
content/config/cache/theme/green/slider.png
.png
content/config/cache/theme/green/swatch.png
.png
content/config/cache/theme/orange/appbar-bg.png
.png
content/config/cache/theme/orange/divider.png
.png
content/config/cache/theme/orange/page/bg.png
.png
content/config/cache/theme/orange/page/left/hover.png
.png
content/config/cache/theme/orange/page/left/normal.png
.png
content/config/cache/theme/orange/page/left/not-available.png
.png
content/config/cache/theme/orange/page/right/hover.png
.png
content/config/cache/theme/orange/page/right/normal.png
.png
content/config/cache/theme/orange/page/right/not-available.png
.png
content/config/cache/theme/orange/slider.png
.png
content/config/cache/theme/orange/swatch.png
.png
content/config/cache/theme/palette-hover.png
.png
content/config/cache/theme/palette.png
.png
content/config/cache/theme/pink/appbar-bg.png
.png
content/config/cache/theme/pink/divider.png
.png
content/config/cache/theme/pink/page/bg.png
.png
content/config/cache/theme/pink/page/left/hover.png
.png
content/config/cache/theme/pink/page/left/normal.png
.png
content/config/cache/theme/pink/page/left/not-available.png
.png
content/config/cache/theme/pink/page/right/hover.png
.png
content/config/cache/theme/pink/page/right/normal.png
.png
content/config/cache/theme/pink/page/right/not-available.png
.png
content/config/cache/theme/pink/slider.png
.png
content/config/cache/theme/pink/swatch.png
.png
content/config/cache/theme/standard/appbar-bg.png
.png
content/config/cache/theme/standard/divider.png
.png
content/config/cache/theme/standard/page/bg.png
.png
content/config/cache/theme/standard/page/left/hover.png
.png
content/config/cache/theme/standard/page/left/normal.png
.png
content/config/cache/theme/standard/page/left/not-available.png
.png
content/config/cache/theme/standard/page/right/hover.png
.png
content/config/cache/theme/standard/page/right/normal.png
.png
content/config/cache/theme/standard/page/right/not-available.png
.png
content/config/cache/theme/standard/slider.png
.png
content/config/cache/widget/caption-bg.bmp
content/config/cache/widget/close-hover.bmp
content/config/cache/widget/close.bmp
content/config/cache/widget/configure-hover.bmp
content/config/cache/widget/configure.bmp
content/config/cache/widget/refresh-hover.bmp
content/config/cache/widget/refresh.bmp
content/config/config.tmpl.xml
.xml
content/io.js
.js
content/plugin/alot.png
.png
content/plugin/alot.xml
content/service/buttons.js
.js
content/service/config-xml.js
.js
content/service/heartbeat.js
.js
content/service/history.js
.js
content/service/metrics.js
.js
content/service/update.js
.js
content/service/xul-transforms.js
.js
content/xsl/apps.xsl
.xml
content/xsl/browserSearch.xsl
.xml
content/xsl/coreButtons.xsl
.xml
content/xsl/lib.xsl
.xml
content/xsl/options-dialog.xsl
.xml
content/xsl/pi-dialog.xsl
.xml
content/xsl/search-defend-dialog.xsl
.xml
content/xsl/single-button.xsl
.xml
content/xsl/toolbar-base.xsl
.xml
content/xsl/webShotsButton.xsl
.xml
content/xsl/widgetError.xsl
.js
content/xsl/widgetWindow.xsl
.xml
skin/alot-o.png
.png
skin/alot32.png
.png
skin/alottb-overlay.css
skin/alottb-widgetWin.css
skin/app_bkgrd.png
.png
skin/button_back.png
.png
skin/check.png
.png
skin/logo.png
.png
skin/options.css
components/aAboutAlotError.js
.js
components/aAlotCustom.js
.js
components/aAlotCustomButton.js
.js
components/aAlotSitepass.js
.js
components/aAlotToolbar.js
.js
components/aAlotWidget.js
.js
components/aAlotWidgetAppBand.js
.js
components/aAlotWidgetBrowser.js
.js
components/aAlotWidgetButton.js
.js
components/aAlotWidgetFileHelper.js
.js
components/aAlotWidgetRegistryHelper.js
.js
components/aAlotWidgetTabHelper.js
.js
components/aAlotWidgetWebSnapshots.js
.js
components/aAlotWidgetWindow.js
.js
components/aIAlotCustom.xpt
components/aIAlotCustomButton.xpt
components/aIAlotSitepass.xpt
components/aIAlotWidget.xpt
components/aIAlotWidgetAppBand.xpt
components/aIAlotWidgetBrowser.xpt
components/aIAlotWidgetButton.xpt
components/aIAlotWidgetFileHelper.xpt
components/aIAlotWidgetRegistryHelper.xpt
components/aIAlotWidgetTabHelper.xpt
components/aIAlotWidgetWebSnapshots.xpt
components/aIAlotWidgetWindow.xpt
defaults/preferences/alottb.js
install.rdf
.xml

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 44KB

.rsrc Size: 2KB - Virtual size: 2KB

2017f2acbdaa42ab3e4adeb8b4c37e7b

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 100B

.reloc Size: 1024B - Virtual size: 520B

5bdcdde5acd7b395f3f3d19ebbb8c6cd

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

wininet

comctl32

Exports

Exports

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

b729b61eb1515fcf7b3e511e4e66258b

Code Sign

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:edCertificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98Certificate

Extended Key Usages

Key Usages

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5cCertificate

Extended Key Usages

Key Usages

Signer

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 44KB

.rsrc
Size: 2KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 100B

.reloc
Size: 1024B - Virtual size: 520B

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 25KB - Virtual size: 24KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 409KB

.ndata
Size: - Virtual size: 1.0MB

.rsrc
Size: 28KB - Virtual size: 27KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate

.text
Size: 808KB - Virtual size: 808KB

.rdata
Size: 169KB - Virtual size: 168KB

.data
Size: 32KB - Virtual size: 64KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 66KB - Virtual size: 65KB

79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

0e:be:00:40:f9:55:8f:86:56:9f:54:28:6e:f6:53:98
Certificate

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c
Certificate