6444bd167d42e786d3f5bcbf6a3048fe_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

6444bd167d42e786d3f5bcbf6a3048fe_JaffaCakes118
Size

1.7MB
MD5

6444bd167d42e786d3f5bcbf6a3048fe
SHA1

45954a5ab373041223b1d2d7835c064b642fc863
SHA256

5f0ee66d590eccc25b8c45572431f87eed03615972aec59c6793d34e74cc42f9
SHA512

babe4be7e120974331af864861140edb946efeb85f3f81bfe31c2cedc7d9ee75b07b7ecf2817086a1bd29ac408dd35026604edb1c8226f8c530fd2b0e236a9eb
SSDEEP

49152:2P1TiZ0xHPJZPezAUjv6o+Z+QqN26oJxc1OyQQpsKwQJCBTZm5v:2YZ0xvJZ+cfnrgkQpJdYBtgv

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/NSISdl.dll
unpack002/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/System.dll

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/dfxInstall-Musicmatch.exe	nsis_installer_1
static1/unpack001/dfxInstall-Musicmatch.exe	nsis_installer_2

Files

6444bd167d42e786d3f5bcbf6a3048fe_JaffaCakes118
.rar
dfxInstall-Musicmatch.exe
.exe windows:4 windows x86 arch:x86

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

27:e0:24:eb:a8:98:68:df:d2:5f:63:05:80:55:06
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

12/03/2008, 00:00

Not After

11/05/2010, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

75:e4:ed:9f:4b:04:67:43:2e:f0:81:53:7a:77:e3:74:7a:2c:c9:75
Signer

Actual PE Digest

75:e4:ed:9f:4b:04:67:43:2e:f0:81:53:7a:77:e3:74:7a:2c:c9:75

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetTickCount
CreateFileA
GetFileSize
GetModuleFileNameA
GetCurrentProcess
CopyFileA
ExitProcess
SetFileTime
GetTempPathA
GetCommandLineA
SetErrorMode
LoadLibraryA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
GetVersion
CloseHandle
lstrcmpiA
lstrcmpA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
GetModuleHandleA
LoadLibraryExA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
GetWindowsDirectoryA

user32

EndDialog
ScreenToClient
GetWindowRect
EnableMenuItem
GetSystemMenu
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClassA
TrackPopupMenu
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxIndirectA
CharPrevA
DispatchMessageA
PeekMessageA
DestroyWindow
CreateDialogParamA
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
OpenClipboard
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

CoTaskMemFree
OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 50KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/DFX/Skins/Obsidian/Obsidian.exe
.exe windows:4 windows x86 arch:x86

3f3ba99c7a17c84031710235ee2f7ba9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

d2:63:69:d7:6a:1d:ce:e5:92:2c:8c:89:18:ae:76:5e:12:45:b4:35
Signer

Actual PE Digest

d2:63:69:d7:6a:1d:ce:e5:92:2c:8c:89:18:ae:76:5e:12:45:b4:35

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
MoveFileA
lstrcatA
lstrlenA
GetShortPathNameA
SearchPathA
lstrcpyA
Sleep
RemoveDirectoryA
CopyFileA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceA
GetVersion
CreateThread
CreateProcessA
CreateFileA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
MultiByteToWideChar
GetFileAttributesA
CompareFileTime
SetFileTime
CloseHandle
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
LoadLibraryA
WaitForSingleObject
GetExitCodeProcess
lstrcpynA
GetCommandLineA
GetProcAddress
GetTickCount
GlobalFree
WriteFile
GlobalAlloc
MulDiv
SetFilePointer
ReadFile
FreeLibrary
GetPrivateProfileStringA
WritePrivateProfileStringA
ExitProcess
GetCurrentProcess

user32

SetWindowPos
ScreenToClient
EnableWindow
GetDlgItem
SetClassLongA
SetFocus
GetWindowRect
CharPrevA
GetParent
SendDlgItemMessageA
LoadBitmapA
IsWindowVisible
IsWindow
GetDlgItemTextA
FindWindowExA
SendMessageA
DefWindowProcA
DialogBoxParamA
EndDialog
FillRect
GetWindowTextA
DrawTextA
EndPaint
LoadIconA
LoadCursorA
RegisterClassA
SystemParametersInfoA
GetDesktopWindow
CreateWindowExA
SetWindowTextA
SetDlgItemTextA
CharNextA
CreateDialogParamA
DestroyWindow
PostQuitMessage
ShowWindow
SetForegroundWindow
MessageBoxA
wsprintfA
IsWindowEnabled
BeginPaint
SetTimer
SetRect
PeekMessageA
ExitWindowsEx
GetClientRect
DispatchMessageA

gdi32

SetBkMode
SetTextColor
CreateFontA
CreateSolidBrush
DeleteObject
BitBlt
CreateCompatibleDC
GetTextColor
LineTo
MoveToEx
CreatePen
GetStockObject
SetBkColor
GetNearestColor
CreateBrushIndirect
SelectObject

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

shell32

SHGetMalloc
ShellExecuteA
SHGetPathFromIDListA
SHFileOperationA
SHBrowseForFolderA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ord17

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/DFX/Skins/Obsidian/all_off.bmp
$COMMONFILES/DFX/Skins/Obsidian/headphone_on.bmp
$COMMONFILES/DFX/Skins/Obsidian/master.bmp
$COMMONFILES/DFX/Skins/Obsidian/music1_on.bmp
$COMMONFILES/DFX/Skins/Obsidian/music2_on.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_0.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_1.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_10.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_2.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_3.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_4.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_5.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_6.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_7.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_8.bmp
$COMMONFILES/DFX/Skins/Obsidian/number_9.bmp
$COMMONFILES/DFX/Skins/Obsidian/section_off.bmp
$COMMONFILES/DFX/Skins/Obsidian/skin_definition.txt
$COMMONFILES/DFX/Skins/Obsidian/skin_info.txt
$COMMONFILES/DFX/Skins/Obsidian/slider.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_1.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_10.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_11.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_12.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_13.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_14.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_15.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_16.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_17.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_18.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_19.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_2.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_20.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_3.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_4.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_5.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_6.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_7.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_8.bmp
$COMMONFILES/DFX/Skins/Obsidian/spectrum_1_9.bmp
$COMMONFILES/DFX/Skins/Obsidian/speech_on.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/Obsidian_mini.exe
.exe windows:4 windows x86 arch:x86

3f3ba99c7a17c84031710235ee2f7ba9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

c8:31:b0:3e:b3:6d:ab:d2:f7:c3:aa:93:bf:2d:1e:2f:db:3c:ff:9d
Signer

Actual PE Digest

c8:31:b0:3e:b3:6d:ab:d2:f7:c3:aa:93:bf:2d:1e:2f:db:3c:ff:9d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
MoveFileA
lstrcatA
lstrlenA
GetShortPathNameA
SearchPathA
lstrcpyA
Sleep
RemoveDirectoryA
CopyFileA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceA
GetVersion
CreateThread
CreateProcessA
CreateFileA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
MultiByteToWideChar
GetFileAttributesA
CompareFileTime
SetFileTime
CloseHandle
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
LoadLibraryA
WaitForSingleObject
GetExitCodeProcess
lstrcpynA
GetCommandLineA
GetProcAddress
GetTickCount
GlobalFree
WriteFile
GlobalAlloc
MulDiv
SetFilePointer
ReadFile
FreeLibrary
GetPrivateProfileStringA
WritePrivateProfileStringA
ExitProcess
GetCurrentProcess

user32

SetWindowPos
ScreenToClient
EnableWindow
GetDlgItem
SetClassLongA
SetFocus
GetWindowRect
CharPrevA
GetParent
SendDlgItemMessageA
LoadBitmapA
IsWindowVisible
IsWindow
GetDlgItemTextA
FindWindowExA
SendMessageA
DefWindowProcA
DialogBoxParamA
EndDialog
FillRect
GetWindowTextA
DrawTextA
EndPaint
LoadIconA
LoadCursorA
RegisterClassA
SystemParametersInfoA
GetDesktopWindow
CreateWindowExA
SetWindowTextA
SetDlgItemTextA
CharNextA
CreateDialogParamA
DestroyWindow
PostQuitMessage
ShowWindow
SetForegroundWindow
MessageBoxA
wsprintfA
IsWindowEnabled
BeginPaint
SetTimer
SetRect
PeekMessageA
ExitWindowsEx
GetClientRect
DispatchMessageA

gdi32

SetBkMode
SetTextColor
CreateFontA
CreateSolidBrush
DeleteObject
BitBlt
CreateCompatibleDC
GetTextColor
LineTo
MoveToEx
CreatePen
GetStockObject
SetBkColor
GetNearestColor
CreateBrushIndirect
SelectObject

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

shell32

SHGetMalloc
ShellExecuteA
SHGetPathFromIDListA
SHFileOperationA
SHBrowseForFolderA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ord17

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/DFX/Skins/Obsidian_mini/all_off.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/headphone_on.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/master.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/music1_on.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/music2_on.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/skin_definition.txt
$COMMONFILES/DFX/Skins/Obsidian_mini/skin_info.txt
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_1.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_10.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_11.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_12.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_13.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_14.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_15.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_16.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_17.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_18.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_19.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_2.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_20.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_3.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_4.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_5.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_6.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_7.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_8.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/spectrum_1_9.bmp
$COMMONFILES/DFX/Skins/Obsidian_mini/speech_on.bmp
$COMMONFILES/DFX/Skins/SoundFX/SoundFX.exe
.exe windows:4 windows x86 arch:x86

3f3ba99c7a17c84031710235ee2f7ba9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

73:bf:eb:dd:c9:80:cd:58:d1:cd:7c:fe:24:5b:4b:4b:ce:3c:05:1b
Signer

Actual PE Digest

73:bf:eb:dd:c9:80:cd:58:d1:cd:7c:fe:24:5b:4b:4b:ce:3c:05:1b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetFullPathNameA
MoveFileA
lstrcatA
lstrlenA
GetShortPathNameA
SearchPathA
lstrcpyA
Sleep
RemoveDirectoryA
CopyFileA
GetFileSize
GetModuleFileNameA
GetModuleHandleA
SetFileAttributesA
GetTempPathA
GetTempFileNameA
GetDiskFreeSpaceA
GetVersion
CreateThread
CreateProcessA
CreateFileA
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetWindowsDirectoryA
CreateDirectoryA
GetSystemDirectoryA
MultiByteToWideChar
GetFileAttributesA
CompareFileTime
SetFileTime
CloseHandle
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
lstrcmpiA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
LoadLibraryA
WaitForSingleObject
GetExitCodeProcess
lstrcpynA
GetCommandLineA
GetProcAddress
GetTickCount
GlobalFree
WriteFile
GlobalAlloc
MulDiv
SetFilePointer
ReadFile
FreeLibrary
GetPrivateProfileStringA
WritePrivateProfileStringA
ExitProcess
GetCurrentProcess

user32

SetWindowPos
ScreenToClient
EnableWindow
GetDlgItem
SetClassLongA
SetFocus
GetWindowRect
CharPrevA
GetParent
SendDlgItemMessageA
LoadBitmapA
IsWindowVisible
IsWindow
GetDlgItemTextA
FindWindowExA
SendMessageA
DefWindowProcA
DialogBoxParamA
EndDialog
FillRect
GetWindowTextA
DrawTextA
EndPaint
LoadIconA
LoadCursorA
RegisterClassA
SystemParametersInfoA
GetDesktopWindow
CreateWindowExA
SetWindowTextA
SetDlgItemTextA
CharNextA
CreateDialogParamA
DestroyWindow
PostQuitMessage
ShowWindow
SetForegroundWindow
MessageBoxA
wsprintfA
IsWindowEnabled
BeginPaint
SetTimer
SetRect
PeekMessageA
ExitWindowsEx
GetClientRect
DispatchMessageA

gdi32

SetBkMode
SetTextColor
CreateFontA
CreateSolidBrush
DeleteObject
BitBlt
CreateCompatibleDC
GetTextColor
LineTo
MoveToEx
CreatePen
GetStockObject
SetBkColor
GetNearestColor
CreateBrushIndirect
SelectObject

advapi32

RegCloseKey
RegDeleteKeyA
RegOpenKeyExA
RegDeleteValueA
RegEnumValueA
RegCreateKeyA
RegSetValueExA
RegQueryValueExA
RegEnumKeyA

shell32

SHGetMalloc
ShellExecuteA
SHGetPathFromIDListA
SHFileOperationA
SHBrowseForFolderA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

comctl32

ord17

Sections

.text
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$COMMONFILES/DFX/Skins/SoundFX/all_off.bmp
$COMMONFILES/DFX/Skins/SoundFX/headphone_on.bmp
$COMMONFILES/DFX/Skins/SoundFX/master.bmp
$COMMONFILES/DFX/Skins/SoundFX/music1_on.bmp
$COMMONFILES/DFX/Skins/SoundFX/music2_on.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_0.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_1.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_10.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_2.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_3.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_4.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_5.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_6.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_7.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_8.bmp
$COMMONFILES/DFX/Skins/SoundFX/number_9.bmp
$COMMONFILES/DFX/Skins/SoundFX/section_off.bmp
$COMMONFILES/DFX/Skins/SoundFX/skin_definition.txt
$COMMONFILES/DFX/Skins/SoundFX/skin_info.txt
$COMMONFILES/DFX/Skins/SoundFX/slider.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_1.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_10.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_11.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_12.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_13.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_14.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_15.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_16.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_17.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_18.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_19.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_2.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_20.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_3.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_4.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_5.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_6.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_7.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_8.bmp
$COMMONFILES/DFX/Skins/SoundFX/spectrum_1_9.bmp
$COMMONFILES/DFX/Skins/SoundFX/speech_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/all_off.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/headphone_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/master.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/music1_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/music2_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/no_audio.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_0.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/number_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/section_off.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/skin_definition.txt
$COMMONFILES/DFX/Skins/default_Musicmatch/slider.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_1_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_2_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_3_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_4_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/spectrum_5_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch/speech_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/all_off.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/headphone_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/master.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/music1_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/music2_on.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/no_audio.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/skin_definition.txt
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_1_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_2_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_3_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_4_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_1.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_10.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_11.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_12.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_13.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_14.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_15.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_16.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_17.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_18.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_19.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_2.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_20.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_3.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_4.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_5.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_6.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_7.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_8.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/spectrum_5_9.bmp
$COMMONFILES/DFX/Skins/default_Musicmatch_mini/speech_on.bmp
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/NSISdl.dll
.dll windows:4 windows x86 arch:x86

9cce555dd3ff1b6c7dc92d64c794c51a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WaitForSingleObject
lstrcpynA
lstrlenA
lstrcatA
GlobalAlloc
GlobalFree
CloseHandle
GetTickCount
DeleteFileA
Sleep
WriteFile
CreateFileA
lstrcmpiA
lstrcpyA
MulDiv
CreateThread

user32

CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
SetWindowTextA
SendMessageA
wsprintfA
SetDlgItemTextA

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

ws2_32

gethostbyname
inet_addr
ioctlsocket
htons
socket
closesocket
shutdown
connect
__WSAFDIsSet
select
recv
WSAGetLastError
send
WSACleanup
WSAStartup

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 812B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/alot-logo-topImage-nullsoft.bmp
$PLUGINSDIR/alot_toolbar_bundled.exe
.exe windows:4 windows x86 arch:x86

5f40af6c51f6ff16f3d02b357d588ce4

Code Sign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

70:ba:e4:1d:10:d9:29:34:b6:38:ca:7b:03:cc:ba:bf
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

29/01/1996, 00:00

Not After

01/08/2028, 23:59

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

10:27:94:66:33:d2:29:f3:ec:cc:f0:56:1c:80:75
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

21/06/2007, 00:00

Not After

21/06/2010, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_Destroy
InitCommonControls

gdi32

CreateBrushIndirect
CreateFontIndirectA
DeleteObject
GetDeviceCaps
SelectObject
SetBkColor
SetBkMode
SetTextColor

kernel32

CloseHandle
CompareFileTime
CopyFileA
CreateDirectoryA
CreateFileA
CreateProcessA
CreateThread
DeleteFileA
ExitProcess
ExpandEnvironmentStringsA
FindClose
FindFirstFileA
FindNextFileA
FreeLibrary
GetCommandLineA
GetCurrentProcess
GetDiskFreeSpaceA
GetExitCodeProcess
GetFileAttributesA
GetFileSize
GetFullPathNameA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetPrivateProfileStringA
GetProcAddress
GetShortPathNameA
GetSystemDirectoryA
GetTempFileNameA
GetTempPathA
GetTickCount
GetWindowsDirectoryA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
LoadLibraryA
LoadLibraryExA
MoveFileA
MulDiv
MultiByteToWideChar
ReadFile
RemoveDirectoryA
SearchPathA
SetCurrentDirectoryA
SetErrorMode
SetFileAttributesA
SetFilePointer
SetFileTime
Sleep
WaitForSingleObject
WriteFile
WritePrivateProfileStringA
lstrcatA
lstrcmpA
lstrcmpiA
lstrcpynA
lstrlenA

ole32

CoCreateInstance
CoTaskMemFree
OleInitialize
OleUninitialize

shell32

SHBrowseForFolderA
SHFileOperationA
SHGetFileInfoA
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

user32

AppendMenuA
BeginPaint
CallWindowProcA
CharNextA
CharPrevA
CheckDlgButton
CloseClipboard
CreateDialogParamA
CreatePopupMenu
CreateWindowExA
DefWindowProcA
DestroyWindow
DialogBoxParamA
DispatchMessageA
DrawTextA
EmptyClipboard
EnableMenuItem
EnableWindow
EndDialog
EndPaint
ExitWindowsEx
FillRect
FindWindowExA
GetClassInfoA
GetClientRect
GetDC
GetDlgItem
GetDlgItemTextA
GetMessagePos
GetSysColor
GetSystemMenu
GetSystemMetrics
GetWindowLongA
GetWindowRect
InvalidateRect
IsWindow
IsWindowEnabled
IsWindowVisible
LoadBitmapA
LoadCursorA
LoadImageA
MessageBoxIndirectA
OpenClipboard
PeekMessageA
PostQuitMessage
RegisterClassA
ScreenToClient
SendMessageA
SendMessageTimeoutA
SetClassLongA
SetClipboardData
SetCursor
SetDlgItemTextA
SetForegroundWindow
SetTimer
SetWindowLongA
SetWindowPos
SetWindowTextA
ShowWindow
SystemParametersInfoA
TrackPopupMenu
wsprintfA

version

GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 107KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: 1024B - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$0/Resources/Button_0/images/alot_icon_35x16.bmp
$0/Resources/Button_1/images/alot_search_24x16.bmp
$0/Resources/Button_2/images/default_210_default_233_alot_music_musicsearch.bmp
$0/Resources/Button_3/images/active_default_439_alot_music_news_24x16.bmp
$0/Resources/Button_3/images/default_439_alot_music_news_24x16.bmp
$0/Resources/Button_4/images/default_220_alot_music_freemusic.bmp
$0/Resources/Button_5/images/default_215_alot_music_freeradio.bmp
$0/Resources/Button_6/images/default_426_alot_dfx.bmp
$0/Resources/Shared/images/$PROGRAMFILES/alot/alotUninst.exe.nsis
$0/Resources/Shared/images/alot_brand.png
.png
$0/toolbar.xml
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

7458f96eb10904198d988c72ce690084

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

comdlg32

CommDlgExtendedError
GetOpenFileNameA
GetSaveFileNameA

gdi32

CombineRgn
CreateCompatibleDC
CreateRectRgn
DeleteObject
GetDIBits
GetObjectA
SelectObject
SetTextColor

kernel32

GetCurrentDirectoryA
GetModuleHandleA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
MultiByteToWideChar
SetCurrentDirectoryA
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA

ole32

CoTaskMemFree

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

user32

CallWindowProcA
CharNextA
CloseClipboard
CreateDialogParamA
CreateWindowExA
DestroyIcon
DestroyWindow
DispatchMessageA
DrawFocusRect
DrawTextA
EnableMenuItem
EnableWindow
GetClientRect
GetClipboardData
GetDlgCtrlID
GetDlgItem
GetMessageA
GetSystemMenu
GetWindowLongA
GetWindowRect
GetWindowTextA
IsDialogMessageA
LoadCursorA
LoadIconA
LoadImageA
MapDialogRect
MapWindowPoints
MessageBoxA
OpenClipboard
PostMessageA
PtInRect
SendMessageA
SetCursor
SetWindowLongA
SetWindowPos
SetWindowRgn
SetWindowTextA
ShowWindow
TranslateMessage
wsprintfA

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.bss
Size: - Virtual size: 16KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 892B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 494B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/closeie.ini
$PLUGINSDIR/eula.ini
$PLUGINSDIR/modern-header.bmp
$PROGRAMFILES/alot/bin/ALOTSettings.exe
.exe windows:4 windows x86 arch:x86

24b813560079797c410aa1f2f2fe76c4

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:27:94:66:33:d2:29:f3:ec:cc:f0:56:1c:80:75
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

21/06/2007, 00:00

Not After

21/06/2010, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocaleInfoA
GetVersionExW
GetACP
InterlockedExchange
GetThreadLocale
GetProcessHeap
HeapAlloc
DeleteCriticalSection
HeapFree
HeapReAlloc
lstrcmpW
lstrcmpiW
InterlockedIncrement
InterlockedDecrement
GetOEMCP
GetStringTypeW
InitializeCriticalSection
MultiByteToWideChar
lstrlenW
GetStringTypeA
GetCPInfo
LoadLibraryA
GetVersionExA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetModuleHandleA
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
GetProcAddress
TerminateProcess
GetCurrentProcess
HeapSize
GetLastError
WriteFile
GetStdHandle
GetModuleFileNameA
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
RtlUnwind
LCMapStringA
WideCharToMultiByte
LCMapStringW

advapi32

RegCreateKeyExW
RegSetValueExW

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PROGRAMFILES/alot/bin/alot.dll
.dll regsvr32 windows:4 windows x86 arch:x86

ac2a71a8a74fc4d486e81c2a5aa685b6

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

10:27:94:66:33:d2:29:f3:ec:cc:f0:56:1c:80:75
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

21/06/2007, 00:00

Not After

21/06/2010, 23:59

Subject

CN=Alot.com,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Alot.com,L=New York,ST=New York,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\Projects\Alot\ALOT_build\alot\bin\support\band.pdb

Imports

kernel32

GetSystemTimeAsFileTime
WriteFile
GetCurrentProcessId
SetEndOfFile
ReadFile
SetFilePointer
GetFileSize
WaitForMultipleObjects
UnmapViewOfFile
MapViewOfFile
FindClose
GetVersionExA
GetSystemDefaultLangID
ResumeThread
SetThreadPriority
GetExitCodeThread
SetEvent
LocalFree
GetModuleFileNameA
GetExitCodeProcess
GlobalAlloc
TerminateProcess
HeapReAlloc
SystemTimeToFileTime
GetSystemTime
ResetEvent
RtlUnwind
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
ExitThread
CreateThread
GetCommandLineA
HeapDestroy
HeapCreate
FileTimeToLocalFileTime
IsBadWritePtr
ExitProcess
HeapSize
SetUnhandledExceptionFilter
TlsAlloc
TlsFree
TlsSetValue
TlsGetValue
GetTimeZoneInformation
UnhandledExceptionFilter
GetTimeFormatA
GetDateFormatA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
IsBadReadPtr
IsBadCodePtr
GetOEMCP
LCMapStringA
GetStringTypeA
QueryPerformanceCounter
SetStdHandle
CompareStringA
SetEnvironmentVariableA
FlushFileBuffers
GetWindowsDirectoryA
GetSystemDirectoryA
FileTimeToSystemTime
lstrcpyA
lstrlenA
WaitForSingleObject
Sleep
MulDiv
DisableThreadLibraryCalls
GlobalLock
GlobalUnlock
LoadLibraryA
TerminateThread
GetTickCount
ReleaseMutex
CloseHandle
LoadResource
SizeofResource
FreeLibrary
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
HeapAlloc
GetProcessHeap
HeapFree
GetCurrentProcess
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
GetCurrentThreadId
InterlockedIncrement
OutputDebugStringA
SetLastError
GetLastError
InterlockedDecrement
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersion
VirtualFree
GetModuleHandleA
LocalAlloc

advapi32

RegCloseKey

user32

CopyImage
GetSysColor
TrackPopupMenu
GetCursorPos
ClientToScreen
GetDC
ReleaseDC
FillRect
DestroyMenu
CreatePopupMenu
WaitMessage
InSendMessage
EnumThreadWindows
DestroyCursor
DestroyIcon
TranslateMessage
MsgWaitForMultipleObjects
EqualRect
GetDlgItem
DestroyWindow
GetWindowThreadProcessId
InvalidateRect
GetFocus
IsWindow
RedrawWindow
CopyRect
GetParent
MoveWindow
SetFocus
SetActiveWindow
EnumWindows
GetWindow
SetCapture
ScreenToClient
ReleaseCapture
ShowWindow
EndPaint
KillTimer
GetSysColorBrush
GetClientRect
GetWindowDC
GetWindowPlacement
IsChild
DestroyAcceleratorTable
SetForegroundWindow
IsWindowEnabled
PostQuitMessage
DrawCaption
DrawFrameControl
CallNextHookEx
UnhookWindowsHookEx
SetWindowRgn
BeginPaint
SetTimer
EndDialog
ValidateRect
GetKeyState
InvalidateRgn
GetDesktopWindow
OffsetRect
PtInRect
GetSystemMenu
GetActiveWindow
SetCursor
MapWindowPoints
WaitForInputIdle
IsDlgButtonChecked
CheckRadioButton
CheckDlgButton
BringWindowToTop
GetWindowRect
SetWindowPos
IsWindowVisible
EnumChildWindows
ReplyMessage
GetComboBoxInfo

gdi32

SelectObject
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DPtoLP
SetBkColor
SetMapMode
GetMapMode
CreateBitmap
GetPixel
CreateSolidBrush
GetDIBColorTable
GetDeviceCaps
CombineRgn
GetStockObject
CreateRectRgn
SetDIBColorTable
CreateDIBSection
SetDIBitsToDevice
CreateDIBitmap
StretchDIBits
PatBlt
StretchBlt
CreatePatternBrush
CreateRectRgnIndirect
SetBkMode
SetTextColor
Ellipse
DeleteObject
DeleteDC

shell32

SHGetSpecialFolderLocation
SHGetDesktopFolder
SHFileOperationA
ord92
ord165
SHGetMalloc

wininet

FindNextUrlCacheEntryW
DeleteUrlCacheEntryW
FindCloseUrlCache
FindFirstUrlCacheEntryW
InternetCrackUrlW
InternetReadFile
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetGetLastResponseInfoW
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetAttemptConnect
CommitUrlCacheEntryW
UnlockUrlCacheEntryFileW
CreateUrlCacheEntryW
InternetGetCookieW
HttpQueryInfoW

urlmon

IsValidURL
URLDownloadToFileW

oleacc

ObjectFromLresult

ole32

CLSIDFromString
StringFromGUID2
OleLockRunning
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoInitializeEx
CoUninitialize
ReleaseStgMedium
RegisterDragDrop
CoCreateInstance
StringFromCLSID
OleUninitialize
CLSIDFromProgID
CreateStreamOnHGlobal
OleSetContainedObject
OleCreate
OleInitialize
CoGetClassObject

oleaut32

DispCallFunc
VariantChangeType
VariantCopyInd
VarUI4FromStr
SysAllocStringLen
VariantCopy
SafeArrayAccessData
SysAllocStringByteLen
SafeArrayDestroy
SafeArrayPutElement
SysStringLen
VariantClear
SafeArrayUnaccessData
SysStringByteLen
VarBstrCmp
SafeArrayGetVartype
SafeArrayCopy
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantInit
SafeArrayCreateVector
SysAllocString
GetErrorInfo
SysFreeString

shlwapi

SHDeleteKeyW
UrlCanonicalizeW
PathFindFileNameW
SHGetValueW
UrlUnescapeW
SHRegCreateUSKeyW
SHDeleteValueW
UrlGetPartW
StrRetToStrW
SHEnumValueW
SHCopyKeyW
PathIsURLW
SHRegWriteUSValueW

msimg32

AlphaBlend
TransparentBlt

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
_GetSystemOptionsDirectory@8
_GetUserOptionsDirectory@8
_LaunchIEInProtectedMode@4
_createActionButton@4
_createBrowserSearch@4
_createCommunicator@4
_createConfigurator@4
_createErrorSearch@4
_createRssTicker@4
_createTimerManager@4
_createToolbarSearch@4
_createUpdater@4
_createWidget@4

Sections

.text
Size: 513KB - Virtual size: 512KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/alot_toolbar_page_IO.ini
$PLUGINSDIR/ask_email_page_IO.ini
$PLUGINSDIR/dfx-logo-nsis-TopImage.bmp
$PLUGINSDIR/dfx_offer_toolbar_small.bmp
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-header.bmp
$PLUGINSDIR/modern-wizard.bmp
$_0_/Plugins/dsp/dsp_dfx.dll
.dll windows:4 windows x86 arch:x86

725a5f5058b5cc4dd7f534b8e7a651b0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:11:ae:57:1a:7d:5b:49:42:f2:ef:20:ee:96:96:42:21:3a:0f:74
Signer

Actual PE Digest

77:11:ae:57:1a:7d:5b:49:42:f2:ef:20:ee:96:96:42:21:3a:0f:74

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

ExpandEnvironmentStringsA
CompareStringW
CompareStringA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetTickCount
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
CreateThread
CreateProcessA
GetTempFileNameA
CreateDirectoryW
GetVersionExA
CopyFileW
GetSystemInfo
GetCurrentDirectoryA
GetCurrentDirectoryW
lstrcmpA
lstrcmpW
RemoveDirectoryW
FindNextFileW
FindFirstFileW
SetCurrentDirectoryA
SetCurrentDirectoryW
SetFileTime
CloseHandle
GetFileTime
CompareFileTime
GetSystemTime
GetTimeZoneInformation
FileTimeToSystemTime
LockResource
SizeofResource
LoadResource
FindResourceA
GetLastError
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
AreFileApisANSI
Sleep
ReadFile
SetFilePointer
WriteFile
SetEndOfFile
FlushFileBuffers
GetFileSize
UnlockFile
LockFile
CreateFileA
CreateFileW
GetFileAttributesA
DeleteFileA
GetFileAttributesW
DeleteFileW
LoadLibraryA
LoadLibraryW
FormatMessageA
GetProcAddress
FreeLibrary
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
DeleteCriticalSection
InterlockedIncrement
InitializeCriticalSection
LockFileEx
GetTempPathW
GetFullPathNameA
GetFullPathNameW
GetSystemDirectoryA
GetCommandLineA
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
RtlUnwind
FileTimeToLocalFileTime
GetDriveTypeW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetDriveTypeA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
InterlockedDecrement
RaiseException
ExitProcess
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
VirtualAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
LCMapStringA
LCMapStringW
GetConsoleCP
GetConsoleMode
GetLocaleInfoA

user32

SendDlgItemMessageA
SendMessageA
ShowWindow
GetClientRect
wsprintfA
GetDC
SetRect
ReleaseDC
GetAsyncKeyState
SetCursor
LoadCursorA
RegisterWindowMessageA
GetSystemMetrics
DestroyWindow
BringWindowToTop
SetWindowTextA
GetDlgItem
EndDialog
GetWindowLongA
SetWindowLongA
CreateDialogParamA
LoadStringA
LoadImageA
SetWindowPlacement
GetWindowPlacement
SetWindowRgn
SetForegroundWindow
CreateWindowExA
AdjustWindowRect
RegisterClassExA
UpdateWindow
IsWindowVisible
IsIconic
SetTimer
KillTimer
FindWindowA
MoveWindow
GetWindowRect
PostMessageA
InvalidateRect
SetWindowPos
ReleaseCapture
SetCapture
EnableMenuItem
DefWindowProcA
MessageBoxA
GetWindowTextA
IsDlgButtonChecked
EnableWindow
CheckDlgButton
SetMenuItemInfoA
AppendMenuA
CreatePopupMenu
DestroyMenu
TrackPopupMenu
GetDlgItemTextA
SetDlgItemTextA
EndPaint
BeginPaint
GetDesktopWindow

wininet

InternetGetConnectedState
InternetOpenUrlA
InternetReadFile
InternetSetStatusCallback
InternetOpenA
InternetCloseHandle

winmm

mmioOpenA
mmioClose
mmioWrite
mmioAdvance
mmioSetInfo
mmioCreateChunk
mmioGetInfo
mmioDescend
mmioRead
mmioAscend
PlaySoundA
mmioSeek

comctl32

InitCommonControlsEx

gdi32

CreateCompatibleBitmap
SetTextColor
SetBkMode
SetTextAlign
CreateFontA
ExtTextOutA
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreatePolygonRgn
DeleteObject
GetObjectA

comdlg32

GetSaveFileNameA
GetOpenFileNameA

advapi32

RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey

shell32

ShellExecuteA
SHGetSpecialFolderPathA
Shell_NotifyIconA

Exports

Exports

DeleteDsp
NewDsp

Sections

.text
Size: 668KB - Virtual size: 666KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Musicmatch/Apps/ActivatePlugin.exe
.exe windows:4 windows x86 arch:x86

bc0a79a6af24243e0c14193168e6140b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

cb:db:84:a9:44:b3:61:87:a0:5d:35:f6:54:07:91:dc:76:24:73:81
Signer

Actual PE Digest

cb:db:84:a9:44:b3:61:87:a0:5d:35:f6:54:07:91:dc:76:24:73:81

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

user32

FindWindowA
PostMessageA

kernel32

GetCurrentProcessId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
SetUnhandledExceptionFilter
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
LoadLibraryA
InitializeCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
VirtualAlloc
HeapReAlloc
RtlUnwind
HeapSize
MultiByteToWideChar
GetLocaleInfoA
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW

Sections

.text
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Musicmatch/Apps/record_date.exe
.exe windows:4 windows x86 arch:x86

782ac45b0e928f15b29e4d9de81d1b35

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

14:41:e5:35:ba:da:a4:70:a3:a9:41:a7:5b:6c:ec:6e:59:8e:62:3b
Signer

Actual PE Digest

14:41:e5:35:ba:da:a4:70:a3:a9:41:a7:5b:6c:ec:6e:59:8e:62:3b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

SHGetSpecialFolderPathA

kernel32

TlsFree
SetEnvironmentVariableA
CreateDirectoryW
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetTimeZoneInformation
FileTimeToSystemTime
CreateFileA
CreateFileW
GetSystemTimeAsFileTime
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
FindClose
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
Sleep
RtlUnwind
GetFullPathNameW
GetCurrentDirectoryA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
VirtualAlloc
HeapSize
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSection
SetStdHandle
FlushFileBuffers
ReadFile
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW

Sections

.text
Size: 60KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Musicmatch/Apps/record_email.exe
.exe windows:4 windows x86 arch:x86

e4112144ee8684f3a7078e07eb94079f

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

50:0d:0c:5d:cf:4f:74:62:82:93:a0:74:ef:49:af:ba:6f:55:0b:5d
Signer

Actual PE Digest

50:0d:0c:5d:cf:4f:74:62:82:93:a0:74:ef:49:af:ba:6f:55:0b:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\code32\Mains\Install\All\record_email\mtstaticrt\record_email.pdb

Imports

shell32

SHGetSpecialFolderPathA

kernel32

InterlockedIncrement
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
CreateDirectoryW
CloseHandle
GetTimeZoneInformation
FileTimeToSystemTime
CreateFileA
CreateFileW
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
GetLastError
HeapReAlloc
FindClose
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileW
DeleteFileW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapSize
Sleep
RtlUnwind
GetFullPathNameW
GetCurrentDirectoryA
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadLibraryA
InitializeCriticalSection
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
SetStdHandle
FlushFileBuffers
ReadFile
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW

Sections

.text
Size: 64KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Musicmatch/Apps/registryCleanUsers.exe
.exe windows:4 windows x86 arch:x86

64c6789880f85a17fb622e339d332680

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/05/2007, 00:00

Not After

11/05/2008, 23:59

Subject

CN=Power Technology,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=www.fxsound.com,O=Power Technology,L=Brisbane,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ee:30:e6:eb:c8:f3:94:b9:27:29:07:97:da:db:4e:ae:0e:93:b7:95
Signer

Actual PE Digest

ee:30:e6:eb:c8:f3:94:b9:27:29:07:97:da:db:4e:ae:0e:93:b7:95

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumKeyA
RegOpenKeyExA
RegDeleteKeyA
RegEnumKeyExA

kernel32

HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleA
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetCommandLineA
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
CreateFileA
CloseHandle
FlushFileBuffers
lstrlenA
GetSystemTimeAsFileTime

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Musicmatch/Help/DFX Manual.chm
.chm
Musicmatch/Icons/Help_16_16.ico
Musicmatch/Icons/dfx_16_16.ico
Musicmatch/Icons/dfx_32_32.ico
Musicmatch/Presets/Factsoft/1.fac
Musicmatch/Presets/Factsoft/10.fac
Musicmatch/Presets/Factsoft/11.fac
Musicmatch/Presets/Factsoft/12.fac
Musicmatch/Presets/Factsoft/13.fac
Musicmatch/Presets/Factsoft/14.fac
Musicmatch/Presets/Factsoft/15.fac
Musicmatch/Presets/Factsoft/16.fac
Musicmatch/Presets/Factsoft/17.fac
Musicmatch/Presets/Factsoft/18.fac
Musicmatch/Presets/Factsoft/19.fac
Musicmatch/Presets/Factsoft/2.fac
Musicmatch/Presets/Factsoft/20.fac
Musicmatch/Presets/Factsoft/21.fac
Musicmatch/Presets/Factsoft/22.fac
Musicmatch/Presets/Factsoft/23.fac
Musicmatch/Presets/Factsoft/24.fac
Musicmatch/Presets/Factsoft/25.fac
Musicmatch/Presets/Factsoft/26.fac
Musicmatch/Presets/Factsoft/27.fac
Musicmatch/Presets/Factsoft/28.fac
Musicmatch/Presets/Factsoft/29.fac
Musicmatch/Presets/Factsoft/3.fac
Musicmatch/Presets/Factsoft/30.fac
Musicmatch/Presets/Factsoft/31.fac
Musicmatch/Presets/Factsoft/32.fac
Musicmatch/Presets/Factsoft/33.fac
Musicmatch/Presets/Factsoft/34.fac
Musicmatch/Presets/Factsoft/35.fac
Musicmatch/Presets/Factsoft/36.fac
Musicmatch/Presets/Factsoft/37.fac
Musicmatch/Presets/Factsoft/38.fac
Musicmatch/Presets/Factsoft/39.fac
Musicmatch/Presets/Factsoft/4.fac
Musicmatch/Presets/Factsoft/5.fac
Musicmatch/Presets/Factsoft/6.fac
Musicmatch/Presets/Factsoft/7.fac
Musicmatch/Presets/Factsoft/8.fac
Musicmatch/Presets/Factsoft/9.fac
Musicmatch/Splash/splash_main.bmp
Musicmatch/Splash/splash_skin_definition.txt
uninstall_Musicmatch.exe.nsis
新云软件.url
.url

Sharing

General

Malware Config

Signatures

Files

099c0646ea7282d232219f8807883be0

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

27:e0:24:eb:a8:98:68:df:d2:5f:63:05:80:55:06Certificate

Extended Key Usages

Key Usages

75:e4:ed:9f:4b:04:67:43:2e:f0:81:53:7a:77:e3:74:7a:2c:c9:75Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

Sections

.text Size: 22KB - Virtual size: 22KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 1024B - Virtual size: 107KB

.ndata Size: - Virtual size: 52KB

.rsrc Size: 50KB - Virtual size: 49KB

3f3ba99c7a17c84031710235ee2f7ba9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19Certificate

Extended Key Usages

Key Usages

d2:63:69:d7:6a:1d:ce:e5:92:2c:8c:89:18:ae:76:5e:12:45:b4:35Signer

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

version

comctl32

Sections

.text Size: 24KB - Virtual size: 24KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 2KB - Virtual size: 99KB

.rsrc Size: 3KB - Virtual size: 3KB

3f3ba99c7a17c84031710235ee2f7ba9

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

27:e0:24:eb:a8:98:68:df:d2:5f:63:05:80:55:06
Certificate

75:e4:ed:9f:4b:04:67:43:2e:f0:81:53:7a:77:e3:74:7a:2c:c9:75
Signer

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 107KB

.ndata
Size: - Virtual size: 52KB

.rsrc
Size: 50KB - Virtual size: 49KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

d2:63:69:d7:6a:1d:ce:e5:92:2c:8c:89:18:ae:76:5e:12:45:b4:35
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 99KB

.rsrc
Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

c8:31:b0:3e:b3:6d:ab:d2:f7:c3:aa:93:bf:2d:1e:2f:db:3c:ff:9d
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 99KB

.rsrc
Size: 3KB - Virtual size: 3KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

67:c5:02:b4:b0:01:04:dc:bb:fe:09:31:d4:b1:19
Certificate

73:bf:eb:dd:c9:80:cd:58:d1:cd:7c:fe:24:5b:4b:4b:ce:3c:05:1b
Signer

.text
Size: 24KB - Virtual size: 24KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 2KB - Virtual size: 99KB

.rsrc
Size: 3KB - Virtual size: 3KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B