73a899b304bdd5ba49d41941793e8e08_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

73a899b304bdd5ba49d41941793e8e08_JaffaCakes118
Size

2.7MB
MD5

73a899b304bdd5ba49d41941793e8e08
SHA1

a37bb80ff6581be970bd2af3dc80a1f2cc2345fb
SHA256

db095ed9c0740d273fd252bb0a810fe27d775867056fe91b1dd8363c82e2ba3e
SHA512

c69512cc3da9f7c150907e7f5d8f3d478768437867dc71c8b78823ec8509c8cf53b1c0a50fe1e109e444d7ba03b97351ed419151928b26da29efe73e1ae87c7d
SSDEEP

49152:LOFyYGQdbJZvuUtocd/VCyGZniTZCJWKbr1e8sJvYCJyHzn5H:LOXPbzumocdwZnCe1epvY2yF

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
static1/unpack001/Uninst.exe	upx
static1/unpack001/mpgtx.exe	upx

Unsigned PE 36 IoCs

Checks for missing Authenticode signature.

resource
73a899b304bdd5ba49d41941793e8e08_JaffaCakes118
unpack001/$PLUGINSDIR/ExecDos.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$TEMPImages/register.exe
unpack001/$TEMPImages/register_y.exe
unpack002/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/InetLoad.dll
unpack003/$PLUGINSDIR/InstallOptions.dll
unpack003/$PLUGINSDIR/MoreInfo.dll
unpack003/$PLUGINSDIR/System.dll
unpack003/$PLUGINSDIR/nsisProcMgr.dll
unpack003/$PLUGINSDIR/timet.dll
unpack003/YPUBC.dll
unpack001/AsyncOps.dll
unpack001/AxInterop.WMPLib.dll
unpack001/Bass.Net.dll
unpack001/FLVmovie.DLL
unpack001/Interop.QuartzTypeLib.dll
unpack001/Interop.WMPLib.dll
unpack001/IrisSkin2.dll
unpack001/Translator.dll
unpack001/Uninst.exe
unpack005/$PLUGINSDIR/Processes.dll
unpack005/out.upx
unpack001/VideoEditorMaster.exe
unpack001/asfbin.exe
unpack001/asfcut.exe
unpack001/bass.dll
unpack001/bass_fx.dll
unpack001/basswma.dll
unpack001/mpgtx.exe
unpack006/out.upx
unpack001/out.upx
unpack001/tools/register.exe
unpack001/tools/register_y.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
static1/unpack001/$TEMPImages/ydetect.exe	nsis_installer_1
static1/unpack001/$TEMPImages/ytb_7.0.9.0_1.5.1_pub_uber_setup_.exe	nsis_installer_1

Files

73a899b304bdd5ba49d41941793e8e08_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/ExecDos.dll
.dll windows:4 windows x86 arch:x86

2dfc6a992d004b736e85c64219a88b4a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
TerminateProcess
Sleep
lstrcatA
lstrcmpiA
ReadFile
GetExitCodeProcess
PeekNamedPipe
CreateFileA
FlushFileBuffers
WriteFile
lstrlenA
CloseHandle
CreateProcessA
DuplicateHandle
GetCurrentProcess
CreatePipe
GlobalAlloc
lstrcpynA
GetExitCodeThread
WaitForSingleObject
lstrcpyA
CreateThread

user32

wsprintfA
GetClassNameA
GetDlgItem
FindWindowExA
SendMessageA

Exports

Exports

exec
isdone
wait

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 266B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileIntA
GlobalLock
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
GlobalUnlock
GlobalAlloc

user32

MapWindowPoints
GetDlgCtrlID
CloseClipboard
GetClipboardData
OpenClipboard
PtInRect
SetWindowRgn
LoadIconA
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableMenuItem
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetClientRect

gdi32

SetTextColor
CreateCompatibleDC
GetObjectA
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
SelectObject

shell32

SHBrowseForFolderA
SHGetDesktopFolder
SHGetPathFromIDListA
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
GlobalSize
lstrcpyA
lstrcpynA
FreeLibrary
lstrcatA
GetProcAddress
LoadLibraryA
GetModuleHandleA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 496B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioC.ini
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$TEMPImages/ioC.ini
$TEMPImages/register.exe
.exe windows:4 windows x86 arch:x86

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

kernel32

SetHandleCount
SetStdHandle
ReadFile
LoadLibraryA
MultiByteToWideChar
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapSize
WideCharToMultiByte
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$TEMPImages/register_y.exe
.exe windows:4 windows x86 arch:x86

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

kernel32

SetHandleCount
SetStdHandle
ReadFile
LoadLibraryA
MultiByteToWideChar
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapSize
WideCharToMultiByte
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$TEMPImages/si1setup-SI1PRT1-silent.exe
.exe windows:4 windows x86 arch:x86

21607682c19f7802c7d98afd746dbe9e

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:b6:9a:dc:01:d0:04:73:92:e2:97:77:b3:ed:38:c5
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

27/07/2007, 00:00

Not After

26/07/2009, 23:59

Subject

CN=SearchInOneStep.com,OU=SearchInOneStep,O=SearchInOneStep.com,L=El Segundo,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\Develop\Newnet\Projects\vista\vclient_stable_2008-2-28\src\carrier\Release\carrier.pdb

Imports

shlwapi

wnsprintfA
PathGetArgsA
PathStripPathA
PathAppendA

kernel32

GetTempFileNameA
lstrcpynA
lstrcpyA
lstrcmpA
lstrcatA
CloseHandle
CreateDirectoryA
CreateProcessA
CreateToolhelp32Snapshot
DeleteFileA
ExitProcess
FindClose
FindFirstFileA
FindNextFileA
FindResourceA
GetCommandLineA
GetModuleFileNameA
GetModuleHandleA
GetTempPathA
LoadResource
LockResource
OpenProcess
Process32First
Process32Next
RemoveDirectoryA
SizeofResource
Sleep
WaitForSingleObject
_lclose
_lcreat
_lwrite

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 368KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$TEMPImages/ydetect.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 40KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$TEMPImages/ytb_7.0.9.0_1.5.1_pub_uber_setup_.exe
.exe windows:4 windows x86 arch:x86

18bc6fa81e19f21156316b1ae696ed6b

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CloseHandle
SetFileTime
CompareFileTime
SearchPathA
GetShortPathNameA
GetFullPathNameA
MoveFileA
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
CreateDirectoryA
SetFileAttributesA
Sleep
GetFileSize
GetModuleFileNameA
GetTickCount
GetCurrentProcess
lstrcmpiA
ExitProcess
GetCommandLineA
GetWindowsDirectoryA
GetTempPathA
lstrcpynA
GetDiskFreeSpaceA
GlobalUnlock
GlobalLock
CreateThread
CreateProcessA
RemoveDirectoryA
CreateFileA
GetTempFileNameA
lstrlenA
lstrcatA
GetSystemDirectoryA
lstrcmpA
GetEnvironmentVariableA
ExpandEnvironmentStringsA
GlobalFree
GlobalAlloc
WaitForSingleObject
GetExitCodeProcess
SetErrorMode
GetModuleHandleA
LoadLibraryA
GetProcAddress
FreeLibrary
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
WriteFile
ReadFile
MulDiv
SetFilePointer
FindClose
FindNextFileA
FindFirstFileA
DeleteFileA
CopyFileA

user32

ScreenToClient
GetWindowRect
SetClassLongA
IsWindowEnabled
SetWindowPos
GetSysColor
GetWindowLongA
SetCursor
LoadCursorA
CheckDlgButton
GetMessagePos
LoadBitmapA
CallWindowProcA
IsWindowVisible
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
EndDialog
AppendMenuA
CreatePopupMenu
GetSystemMetrics
SetDlgItemTextA
GetDlgItemTextA
MessageBoxA
CharPrevA
DispatchMessageA
PeekMessageA
CreateDialogParamA
DestroyWindow
SetTimer
SetWindowTextA
PostQuitMessage
SetForegroundWindow
wsprintfA
SendMessageTimeoutA
FindWindowExA
RegisterClassA
SystemParametersInfoA
CreateWindowExA
GetClassInfoA
DialogBoxParamA
CharNextA
TrackPopupMenu
ExitWindowsEx
IsWindow
GetDlgItem
SetWindowLongA
LoadImageA
GetDC
EnableWindow
InvalidateRect
SendMessageA
DefWindowProcA
BeginPaint
GetClientRect
FillRect
DrawTextA
EndPaint
ShowWindow

gdi32

SetBkColor
GetDeviceCaps
DeleteObject
CreateBrushIndirect
CreateFontIndirectA
SetBkMode
SetTextColor
SelectObject

shell32

SHGetMalloc
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ShellExecuteA
SHFileOperationA
SHGetSpecialFolderLocation

advapi32

RegQueryValueExA
RegSetValueExA
RegEnumKeyA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegDeleteValueA
RegCloseKey
RegCreateKeyExA

comctl32

ImageList_AddMasked
ImageList_Destroy
ord17
ImageList_Create

ole32

OleInitialize
OleUninitialize
CoCreateInstance

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 76KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/LICENSE.txt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/manifest.mf
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.rsa
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.sf
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/chrome/ytoolbar.jar
.zip
content/ytoolbar/JScript.js
content/ytoolbar/cache/about.xul
.xml
content/ytoolbar/cache/option.xul
.xml
content/ytoolbar/cache/sethp.xul
.js .xml polyglot
content/ytoolbar/cache/uninstall.xul
.js .xml polyglot
content/ytoolbar/contents.rdf
content/ytoolbar/dialog.js
.js
content/ytoolbar/dialog.xul
.xml
content/ytoolbar/dropmaker.xml
.js .xml polyglot
content/ytoolbar/feedFunctions.js
.js
content/ytoolbar/fileio.js
.js
content/ytoolbar/globals.js
.js
content/ytoolbar/history.js
.js
content/ytoolbar/i18n.js
.js
content/ytoolbar/installerVariables.js
.js
content/ytoolbar/network.js
.js
content/ytoolbar/options.js
.js
content/ytoolbar/setHomepage.js
.js
content/ytoolbar/toolbarBuilder.js
.js
content/ytoolbar/trackinginterfaces.js
.js
content/ytoolbar/uninstall.js
.js
content/ytoolbar/yahoo.xml
.js .xml polyglot
content/ytoolbar/ylib.js
.js
content/ytoolbar/yprefs.js
.js
content/ytoolbar/yrss.js
.js
content/ytoolbar/ysearch-history.rdf
.xml
content/ytoolbar/ytoolbarOverlay.js
.js
content/ytoolbar/ytoolbarOverlay.xul
.js .xml polyglot
locale/de/ytoolbar/contents.rdf
locale/de/ytoolbar/ytoolbar.dtd
locale/de/ytoolbar/ytoolbar.properties
locale/en-UK/ytoolbar/contents.rdf
.xml
locale/en-UK/ytoolbar/ytoolbar.dtd
locale/en-UK/ytoolbar/ytoolbar.properties
locale/en-US/ytoolbar/contents.rdf
.xml
locale/en-US/ytoolbar/ytoolbar.dtd
locale/en-US/ytoolbar/ytoolbar.properties
locale/es/ytoolbar/contents.rdf
.xml
locale/es/ytoolbar/ytoolbar.dtd
locale/es/ytoolbar/ytoolbar.properties
locale/fr/ytoolbar/contents.rdf
locale/fr/ytoolbar/ytoolbar.dtd
locale/fr/ytoolbar/ytoolbar.properties
locale/kr/ytoolbar/contents.rdf
locale/kr/ytoolbar/ytoolbar.dtd
locale/kr/ytoolbar/ytoolbar.properties
locale/zh-HK/ytoolbar/contents.rdf
.xml
locale/zh-HK/ytoolbar/ytoolbar.dtd
locale/zh-HK/ytoolbar/ytoolbar.properties
locale/zt-TW/ytoolbar/contents.rdf
locale/zt-TW/ytoolbar/ytoolbar.dtd
locale/zt-TW/ytoolbar/ytoolbar.properties
skin/classic/ytoolbar/05c.gif
.gif
skin/classic/ytoolbar/07c.gif
.gif
skin/classic/ytoolbar/08c.gif
.gif
skin/classic/ytoolbar/11c.gif
.gif
skin/classic/ytoolbar/18c.gif
.gif
skin/classic/ytoolbar/19c.gif
.gif
skin/classic/ytoolbar/50c.gif
.gif
skin/classic/ytoolbar/52c.gif
.gif
skin/classic/ytoolbar/MY-ff-plus.gif
.gif
skin/classic/ytoolbar/chevron.gif
.gif
skin/classic/ytoolbar/contents.rdf
.xml
skin/classic/ytoolbar/ed.gif
.gif
skin/classic/ytoolbar/logo.gif
.gif
skin/classic/ytoolbar/mno2.gif
.gif
skin/classic/ytoolbar/my.gif
.gif
skin/classic/ytoolbar/new3.gif
.gif
skin/classic/ytoolbar/option.gif
.gif
skin/classic/ytoolbar/slider.gif
.gif
skin/classic/ytoolbar/tot.gif
.gif
skin/classic/ytoolbar/yahooicon.png
.png
skin/classic/ytoolbar/yma1.gif
.gif
skin/classic/ytoolbar/ytoolbar.css
skin/classic/ytoolbar/ytoolbar.properties-de
skin/classic/ytoolbar/ytoolbar.properties-es
skin/classic/ytoolbar/ytoolbar.properties-fr
skin/classic/ytoolbar/ytoolbar.properties-hk
skin/classic/ytoolbar/ytoolbar.properties-kr
skin/classic/ytoolbar/ytoolbar.properties-tw
skin/classic/ytoolbar/ytoolbar.properties-uk
skin/classic/ytoolbar/ytoolbar.properties-us
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.js
.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.xpt
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/defaults/preferences/yahoo.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.js
$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.rdf
.xml
$PLUGINSDIR/InetLoad.dll
.dll windows:4 windows x86 arch:x86

d8be1bce66a8b91950a8519f256400c0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

atoi
_initterm
malloc
strcpy
__dllonexit
_onexit
calloc
_stricmp
_open
strcat
_close
_unlink
free
sprintf
memset
strstr
strtol
strlen
strncmp
strtoul
_write
time
strrchr
strchr
_adjust_fdiv
strcmp

kernel32

lstrcpynA
CreateThread
WaitForSingleObject
TerminateThread
CloseHandle
GetModuleHandleA
lstrcpyA
GlobalFree
LoadLibraryA
GetProcAddress
Sleep
SleepEx
FreeLibrary
GetLastError
MulDiv
lstrlenA
GlobalAlloc

user32

GetDlgItem
SetWindowTextA
wsprintfA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
PostMessageA
DestroyWindow
EnableWindow
GetWindowLongA
CreateWindowExA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
MessageBoxA
SendDlgItemMessageA
SetDlgItemTextA
SetTimer
LoadIconA
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
IsWindow
CreateDialogParamA
FindWindowExA
GetWindowTextA
SendMessageA

wininet

InternetErrorDlg
InternetSetFilePointer
HttpQueryInfoA
InternetQueryOptionA
HttpSendRequestA
HttpAddRequestHeadersA
InternetSetOptionA
HttpOpenRequestA
FtpOpenFileA
InternetGetLastResponseInfoA
InternetConnectA
InternetCrackUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle

comctl32

ord17

Exports

Exports

load

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

57354bdeea3dfae6e948101add87501a

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetCurrentDirectoryA
GetCurrentDirectoryA
GetPrivateProfileIntA
GetModuleHandleA
lstrcmpiA
GetPrivateProfileStringA
lstrcatA
lstrcpynA
WritePrivateProfileStringA
lstrlenA
lstrcpyA
GlobalFree
MultiByteToWideChar
GlobalAlloc

user32

GetDlgCtrlID
GetClientRect
SetWindowRgn
MapWindowPoints
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
PtInRect
LoadCursorA
SetCursor
DrawTextA
GetWindowLongA
DrawFocusRect
CallWindowProcA
PostMessageA
MessageBoxA
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
LoadIconA

gdi32

SetTextColor
GetObjectA
SelectObject
GetDIBits
CreateRectRgn
CombineRgn
DeleteObject
CreateCompatibleDC

shell32

SHGetPathFromIDListA
SHBrowseForFolderA
SHGetDesktopFolder
SHGetMalloc
ShellExecuteA

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 954B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MoreInfo.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI

Exports

Exports

GetComments
GetCompanyName
GetFileDescription
GetFileVersion
GetInternalName
GetLegalCopyright
GetLegalTrademarks
GetOSUserinterfaceLanguage
GetOriginalFilename
GetPrivateBuild
GetProductName
GetProductVersion
GetSpecialBuild
GetUserDefined

Sections

CODE
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 512B - Virtual size: 196B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 1KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

a75ed4b57a83b633f5cb5d4939d72f27

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
GlobalFree
lstrcpyA
lstrcpynA
FreeLibrary
GetModuleHandleA
LoadLibraryA
GetProcAddress
lstrcatA
MultiByteToWideChar
lstrlenA
WideCharToMultiByte
GetLastError
VirtualAlloc
VirtualProtect

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 490B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/YDefUser.dll
.dll windows:4 windows x86 arch:x86

eb9b12f933fc102c731bc4f747f068e1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiA
GetModuleHandleA
DisableThreadLibraryCalls
GetCurrentProcess
GetLastError
CloseHandle
ExpandEnvironmentStringsA
GetCurrentThreadId
GetCommandLineA
GetVersionExA
HeapFree
HeapAlloc
ExitProcess
GetProcAddress
TerminateProcess
TlsAlloc
SetLastError
TlsFree
TlsSetValue
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
UnhandledExceptionFilter
WriteFile
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
InitializeCriticalSection
RtlUnwind
InterlockedExchange
VirtualQuery
LoadLibraryA
HeapSize
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
LCMapStringA
LCMapStringW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualProtect
GetSystemInfo

advapi32

RegDeleteValueA
RegEnumKeyExA
RegLoadKeyA
RegOpenKeyExA
RegUnLoadKeyA
RegEnumValueA
RegSetValueExA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
AdjustTokenPrivileges
LookupPrivilegeValueA

Exports

Exports

CloneForAllExistingUsers
CloneForDefaultUser

Sections

.text
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/finish.ini
$PLUGINSDIR/nsisProcMgr.dll
.dll windows:4 windows x86 arch:x86

c9fc7f6df8fedf8f8f1f9f820c072664

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
CloseHandle
TerminateProcess
OpenProcess
lstrcmpiA
WideCharToMultiByte
FreeLibrary
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryA
GetVersionExA
GlobalFree
lstrcpynA
GlobalAlloc

Exports

Exports

_FindProc
_KillProc
_Unload

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 530B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 148B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/privacy.ini
$PLUGINSDIR/timet.dll
.dll windows:4 windows x86 arch:x86

651bc9f5d0db795bf404d577647568d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetSystemTimeAsFileTime
lstrcpynA

user32

wsprintfA

Exports

Exports

TimeNow

Sections

.text
Size: 512B - Virtual size: 312B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 276B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 78B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/toolbar.bmp
$PLUGINSDIR/welcome.ini
$PROGRAM_FILES/Yahoo!/Common/$PROGRAM_FILES/Yahoo!/Common/unyt.exe.nsis
$_30_/Data/dlg_atb.html
.html .js polyglot
$_30_/Data/dlg_catb.html
.html .js polyglot
$_30_/Data/dlg_cnf.html
.html .js polyglot
$_30_/Data/dlg_cotb.html
.html .js polyglot
$_30_/Data/dlg_ctb.html
.html .js polyglot
$_30_/Data/dlg_fantip.html
.html .js polyglot
$_30_/Data/dlg_fantipg.html
.html .js polyglot
$_30_/Data/dlg_fintip.html
.html .js polyglot
$_30_/Data/dlg_fintipg.html
.html .js polyglot
$_30_/Data/dlg_grptip.html
.html .js polyglot
$_30_/Data/dlg_grptipg.html
.html .js polyglot
$_30_/Data/dlg_logtip.html
.html .js polyglot
$_30_/Data/dlg_mailatip.html
.html .js polyglot
$_30_/Data/dlg_mailtip.html
.html .js polyglot
$_30_/Data/dlg_map.html
.html
$_30_/Data/dlg_mlbtip.html
.html .js polyglot
$_30_/Data/dlg_mlbtipg.html
.html .js polyglot
$_30_/Data/dlg_msgratip.html
.html .js polyglot
$_30_/Data/dlg_msgrtip.html
.html .js polyglot
$_30_/Data/dlg_nbatip.html
.html
$_30_/Data/dlg_nbatipg.html
.html
$_30_/Data/dlg_newstip.html
.html .js polyglot
$_30_/Data/dlg_newstipg.html
.html .js polyglot
$_30_/Data/dlg_nfltip.html
.html
$_30_/Data/dlg_nfltipg.html
.html
$_30_/Data/dlg_opt.html
.html .js polyglot
$_30_/Data/dlg_pub.html
.html .js polyglot
$_30_/Data/dlg_srchtip.html
.html .js polyglot
$_30_/Data/dlg_upg.html
.html .js polyglot
$_30_/Data/dlg_wp.html
.html .js polyglot
YMERemote.dll
.dll regsvr32 windows:4 windows x86 arch:x86

60fc59d11639941018b6f0547a2767a1

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YMERemote\Release\YMERemote.pdb

Imports

comctl32

ImageList_AddMasked
ImageList_Create
ImageList_DrawEx

kernel32

LockResource
LoadLibraryA
GetProcAddress
GetVersionExA
WaitForSingleObject
WaitForMultipleObjects
GetACP
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
Sleep
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetFileAttributesA
VirtualQuery
GetSystemInfo
VirtualProtect
HeapReAlloc
GetLocaleInfoA
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetCurrentProcess
GetCurrentProcessId
lstrcpynA
CloseHandle
CreateMutexA
OpenEventA
SetThreadLocale
GetThreadLocale
GetCurrentThreadId
SetLastError
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
GetModuleFileNameA
MultiByteToWideChar
RaiseException
WideCharToMultiByte
lstrlenW
lstrlenA
InterlockedDecrement
GetLastError
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
ReleaseMutex
InterlockedIncrement
FlushInstructionCache

user32

GetClientRect
DestroyWindow
IsWindow
CreateWindowExA
CharNextA
SetWindowPos
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
EndDialog
RemovePropA
SetWindowRgn
SetPropA
GetWindowRect
LoadStringA
GetDlgItem
DialogBoxParamA
GetPropA
GetClassNameA
GetWindowThreadProcessId
EnumThreadWindows
FindWindowA
InsertMenuItemA
GetMenuItemCount
AppendMenuA
DestroyMenu
TrackPopupMenu
ClientToScreen
CreatePopupMenu
MessageBoxA
GetDlgCtrlID
MapWindowPoints
SetForegroundWindow
ShowWindow
IsZoomed
DrawTextW
TrackMouseEvent
GetCursorPos
ScrollDC
FrameRect
FillRect
UnionRect
EndPaint
BeginPaint
KillTimer
SetTimer
RegisterWindowMessageA
PtInRect
IntersectRect
LoadImageA
LoadCursorA
GetClassInfoExA
RegisterClassExA
PostMessageA
LoadBitmapA
InvalidateRect
InflateRect
DrawTextA
ReleaseDC
GetDC
OffsetRect
CallWindowProcA
DefWindowProcA
GetWindowLongA
SetWindowLongA
SendMessageA
SendMessageTimeoutA
GetParent
UnregisterClassA

gdi32

ExtCreateRegion
CreateFontIndirectA
CreateCompatibleBitmap
SelectClipRgn
CombineRgn
CreateRectRgn
LineTo
MoveToEx
GetClipBox
GetStockObject
SetBkColor
SetTextColor
CreatePen
CreateSolidBrush
BitBlt
DeleteDC
CreateCompatibleDC
DeleteObject
GetObjectA
SelectObject
SetBkMode

advapi32

RegDeleteValueA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA

shell32

ShellExecuteA

ole32

CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID

oleaut32

LoadTypeLi
RegisterTypeLi
SysAllocStringLen
VariantClear
VariantInit
LoadRegTypeLi
SysStringLen
DispCallFunc
SysAllocString
SysFreeString
VarUI4FromStr
UnRegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YPUBC.dll
.dll regsvr32 windows:4 windows x86 arch:x86

f063b20f8606a0032283d06ba86aaa26

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\Development\Visualstudio\YBrowser_v34\src\Ypub\RelCompanion\YPUBC.pdb

Imports

kernel32

MulDiv
lstrcpynA
InterlockedIncrement
InterlockedDecrement
IsDBCSLeadByte
Sleep
GetCurrentThreadId
GetModuleFileNameA
FreeLibrary
LoadLibraryExA
GetModuleHandleA
HeapAlloc
GetProcessHeap
FlushInstructionCache
GetCurrentProcess
GetTickCount
IsBadWritePtr
IsBadReadPtr
HeapFree
CreateMutexA
CloseHandle
ReleaseMutex
WaitForSingleObject
QueryPerformanceCounter
UnmapViewOfFile
GetSystemTime
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
GetDateFormatA
InterlockedCompareExchange
lstrcpyA
lstrcatA
GlobalAlloc
ReadFile
SetStdHandle
SetFilePointer
IsBadCodePtr
LoadLibraryA
GetStringTypeW
GetStringTypeA
WriteFile
UnhandledExceptionFilter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
GetStdHandle
SetHandleCount
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
TerminateProcess
LCMapStringW
LCMapStringA
GetProcAddress
TlsGetValue
TlsSetValue
TlsFree
SetLastError
TlsAlloc
GetCPInfo
GetOEMCP
VirtualFree
HeapCreate
GetCommandLineA
InterlockedExchange
GlobalLock
GlobalUnlock
FindFirstFileA
FindClose
lstrcmpiA
lstrlenA
OutputDebugStringA
EnterCriticalSection
LeaveCriticalSection
FindResourceExA
FindResourceA
LoadResource
LockResource
SizeofResource
DeleteCriticalSection
InitializeCriticalSection
GetLastError
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
FlushFileBuffers
RtlUnwind
ExitProcess
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapSize
HeapReAlloc
HeapDestroy

user32

PtInRect
UnionRect
CharNextA
SetWindowPos
SetWindowRgn
OffsetRect
EqualRect
IntersectRect
ReleaseDC
GetDC
UnregisterClassA
SetWindowLongA
DefWindowProcA
RegisterWindowMessageA
SetWindowsHookExA
UnhookWindowsHookEx
GetClassNameA
GetPropA
PostMessageA
CallNextHookEx
MessageBeep
RegisterClassExA
GetClassInfoExA
LoadCursorA
CreateWindowExA
wsprintfA
GetParent
SetFocus
ShowWindow
GetFocus
IsChild
BeginPaint
GetClientRect
EndPaint
InvalidateRect
IsWindow
DestroyWindow
GetKeyState
CallWindowProcA
GetWindowLongA

gdi32

CreateDCA
LPtoDP
SetMapMode
SetViewportOrgEx
DeleteDC
GetDeviceCaps
CreateMetaFileA
SaveDC
SetWindowOrgEx
SetWindowExtEx
RestoreDC
CloseMetaFile
DeleteMetaFile
CreateRectRgnIndirect
SetTextAlign
TextOutA

advapi32

RegQueryValueExA
RegEnumKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
OleRegEnumVerbs
OleRegGetUserType
OleRegGetMiscStatus
CreateDataAdviseHolder
CoCreateInstance
CreateOleAdviseHolder
StringFromGUID2
OleSaveToStream
WriteClassStm
OleLoadFromStream

oleaut32

RegisterTypeLi
UnRegisterTypeLi
SysAllocString
SysFreeString
SysStringLen
VarBstrCmp
VariantInit
VariantClear
SysAllocStringLen
SysStringByteLen
VariantChangeType
VarUI4FromStr
SysAllocStringByteLen
LoadRegTypeLi
LoadTypeLi
OleCreatePropertyFrame

shlwapi

PathFindExtensionA

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTAntiSpy.dll
.dll regsvr32 windows:4 windows x86 arch:x86

b9926d7ffd0efba81ed49dd7de4fdb2d

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2009, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

73:45:1f:8f:5c:64:a3:d4:37:dd:09:2d:d4:9d:83:65
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

01/08/2005, 00:00

Not After

21/08/2006, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\work\Yahoo\depot\toolbar\Main\ytie\plugins\YTAntiSpy\ATL30 Release\YTAntiSpy.pdb

Imports

msvcrt

_adjust_fdiv
_initterm
??3@YAXPAX@Z
_purecall
realloc
memcmp
_wtoi
toupper
tolower
wcscspn
_wcsnicmp
memmove
wcsstr
_mbsnbcmp
strcat
malloc
wcslen
memcpy
free
atoi
strchr
memset
strlen
strcspn
strncmp
??2@YAPAXI@Z
strncpy
strcmp
strcpy
strrchr

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

kernel32

CloseHandle
GetShortPathNameA
LoadLibraryExA
GetLastError
FindResourceA
SizeofResource
DisableThreadLibraryCalls
lstrcatA
lstrcpyA
HeapDestroy
lstrcpynA
IsDBCSLeadByte
lstrcmpiA
InterlockedIncrement
CreateThread
Sleep
MultiByteToWideChar
LoadLibraryA
GetProcAddress
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
WideCharToMultiByte
lstrcmpA
CreateFileA
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
LoadResource
InterlockedDecrement
lstrlenA

user32

GetDesktopWindow
CharNextA
LoadStringA
SetForegroundWindow
SetWindowPos
FindWindowA

advapi32

RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegCloseKey
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA

shell32

ShellExecuteExA

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc

oleaut32

SysAllocStringLen
SysFreeString
SysStringLen
VariantClear
VarUI4FromStr
LoadTypeLi
RegisterTypeLi
LoadRegTypeLi
SysAllocString

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTBM.dll
.dll regsvr32 windows:4 windows x86 arch:x86

387e62e2fbfe685904999456824c2bdc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTBM\Release\YTBM.pdb

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetCrackUrlA
HttpQueryInfoA
InternetOpenUrlA
InternetSetOptionA
InternetQueryOptionA
HttpSendRequestA
InternetConnectA
InternetOpenA
HttpOpenRequestA

urlmon

ObtainUserAgentString

kernel32

GetFileSize
ReadFile
CloseHandle
RaiseException
InterlockedIncrement
GetVersionExA
MultiByteToWideChar
lstrlenA
GetACP
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
EnterCriticalSection
InitializeCriticalSection
DeleteCriticalSection
IsDBCSLeadByte
lstrcmpiA
SizeofResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
GetLastError
GetModuleFileNameA
LeaveCriticalSection
WriteFile
SetFilePointer
ReleaseMutex
GetCurrentProcess
LocalAlloc
CreateFileA
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
CreateEventA
CreateThread
SetThreadPriority
GetExitCodeThread
GetCurrentThreadId
SetEvent
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
Sleep
GetComputerNameA
GetStdHandle
GetTickCount
QueryPerformanceCounter
GetCurrentProcessId
GlobalMemoryStatus
SetStdHandle
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcAddress
LoadLibraryA
FreeLibrary
InterlockedDecrement
LoadResource
WideCharToMultiByte
lstrlenW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetEndOfFile
LocalFree
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
ExitProcess
HeapCreate
HeapDestroy
VirtualFree
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlUnwind
GetCommandLineA
GetSystemTimeAsFileTime
InterlockedExchange
GetLocaleInfoA
GetFileAttributesA
DeleteFileA
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery

user32

CharNextA
UnregisterClassA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects

gdi32

DeleteObject

advapi32

RegCreateKeyExA
GetUserNameA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegDeleteKeyA
RegOpenKeyExA
RegCloseKey

ole32

CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CLSIDFromString
CoInitialize
CoInitializeEx

oleaut32

VarUI4FromStr
SysAllocStringLen
VariantClear
VariantInit
RegisterTypeLi
SysAllocStringByteLen
SysStringByteLen
LoadRegTypeLi
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysStringLen

shlwapi

StrStrIW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTMsgr.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5fdd7a2fa0538db5d8fc3db799e8a758

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTMsgr\Release\YTMsgr.pdb

Imports

kernel32

GetProcAddress
LoadLibraryA
RaiseException
DeleteCriticalSection
WideCharToMultiByte
lstrlenW
MultiByteToWideChar
GetACP
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
lstrlenA
lstrcmpiA
DisableThreadLibraryCalls
IsDBCSLeadByte
SizeofResource
FindResourceA
LoadLibraryExA
GetModuleHandleA
SetThreadLocale
GetThreadLocale
GetTickCount
CreateMutexA
WaitForMultipleObjects
WaitForSingleObject
GetComputerNameA
FreeLibrary
LockResource
SetEvent
GetCurrentThreadId
Sleep
CreateThread
CreateEventA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
RtlUnwind
GetStartupInfoA
GetFileType
SetHandleCount
GetStdHandle
GetModuleFileNameA
FindResourceExA
GetExitCodeThread
LoadResource
CreateFileA
GetCurrentProcess
GetLastError
LocalAlloc
LocalFree
CloseHandle
GetVersionExA
ReleaseMutex
InterlockedDecrement
InterlockedIncrement
SetThreadPriority
WriteFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
ExitProcess
VirtualFree
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
InterlockedExchange
GetLocaleInfoA
GetFileAttributesA
HeapFree
HeapAlloc
HeapReAlloc
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetCommandLineA
GetProcessHeap
GetCPInfo

user32

UnregisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
MsgWaitForMultipleObjects
PostMessageA
EnumChildWindows
IsWindow
GetClassNameA
IsWindowVisible
GetForegroundWindow
GetWindowThreadProcessId
AttachThreadInput
SetForegroundWindow
IsIconic
ShowWindow
LoadStringA
CharNextA
FindWindowA
PeekMessageA

gdi32

DeleteObject

advapi32

RegCreateKeyExA
GetUserNameA
RegDeleteKeyA
RegOpenKeyExA
RegEnumKeyExA
RegSetValueExA
RegQueryValueExA
RegQueryInfoKeyA
RegDeleteValueA
RegCloseKey

ole32

CoUninitialize
CoInitializeEx
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc
StringFromCLSID
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
CoCreateGuid

oleaut32

VariantClear
SysAllocString
SysFreeString
SysAllocStringLen
VariantCopy
LoadRegTypeLi
SysStringByteLen
SysAllocStringByteLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysStringLen
VariantInit

shlwapi

StrStrIW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
YTabBar.dll
.dll regsvr32 windows:4 windows x86 arch:x86

43a74f471c917b4f8b795e72305cff53

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\YTabBar\Release\YTabBar.pdb

Imports

comctl32

ImageList_Draw
ImageList_SetImageCount
ImageList_ReplaceIcon
ImageList_Create
ImageList_Destroy
ImageList_Remove

wininet

InternetCrackUrlA

kernel32

SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
WideCharToMultiByte
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCurrentThreadId
lstrlenW
GetModuleFileNameA
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
GetACP
lstrcpynA
DisableThreadLibraryCalls
GetThreadLocale
SetThreadLocale
GetCurrentProcess
FlushInstructionCache
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
HeapSize
Sleep
GetStdHandle
WriteFile
ExitProcess
HeapCreate
HeapDestroy
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetOEMCP
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
VirtualAlloc
lstrcmpiA
IsDBCSLeadByte
ReleaseMutex
GetVersionExA
LoadLibraryA
FreeLibrary
MultiByteToWideChar
lstrlenA
GetProcAddress
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
SetLastError
GetLastError
RaiseException
CloseHandle
CreateFileA
InterlockedDecrement
InterlockedIncrement
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetLocaleInfoA
InterlockedExchange

user32

CharNextA
CreateWindowExA
SendMessageA
DestroyIcon
LoadIconA
IsWindow
PostMessageA
CopyRect
GetSystemMetrics
InsertMenuItemA
CreatePopupMenu
DrawTextW
TrackMouseEvent
InvalidateRect
PtInRect
GetCursorPos
GetSysColor
GetSysColorBrush
FillRect
DrawTextA
TrackPopupMenu
ScreenToClient
ReleaseDC
GetClientRect
MapWindowPoints
GetDC
DestroyMenu
SystemParametersInfoA
IsWindowUnicode
LoadCursorA
MoveWindow
GetClassNameA
CallNextHookEx
GetAsyncKeyState
IsWindowEnabled
IsIconic
SetForegroundWindow
SetWindowPos
ShowWindow
IsWindowVisible
DestroyWindow
GetParent
UnhookWindowsHookEx
SetWindowsHookExA
GetClassInfoExA
RegisterClassExA
UnregisterClassA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
CallWindowProcA
DefWindowProcA
GetWindowLongA
SetWindowLongA
GetWindowRect
IsZoomed

gdi32

SetBkColor
RoundRect
CreatePen
SetTextColor
SetBkMode
DeleteDC
BitBlt
CreateCompatibleDC
CreateFontIndirectA
GetObjectA
SelectObject
CreateCompatibleBitmap
DeleteObject

advapi32

RegQueryValueExA
RegCloseKey
RegQueryInfoKeyA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA

ole32

CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
VariantClear
DispCallFunc
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
VarBstrCat
SysStringByteLen
SysAllocStringByteLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
inyt.exe
.exe windows:4 windows x86 arch:x86

1ee0c47671c74b65bc79dddfdfface52

Code Sign

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

04/12/2003, 00:00

Not After

03/12/2008, 23:59

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\inyt\Release\inyt.pdb

Imports

setupapi

SetupIterateCabinetA

kernel32

CreateThread
CreateEventA
InterlockedIncrement
GetCommandLineA
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
lstrlenW
InitializeCriticalSection
lstrlenA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
SetEvent
GetVersionExA
GetProcAddress
LoadLibraryA
DebugBreak
OutputDebugStringA
MoveFileExA
WriteFile
SetFilePointer
ReadFile
GetFileSize
GetShortPathNameA
CreateFileA
GetWindowsDirectoryA
SetEndOfFile
DeleteFileA
CopyFileA
Sleep
FindNextFileA
FindFirstFileA
RemoveDirectoryA
ReleaseMutex
GetCurrentProcess
LockResource
LoadResource
FindResourceExA
CreateMutexA
WaitForMultipleObjects
lstrcmpA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteCriticalSection
RaiseException
InterlockedDecrement
WaitForSingleObject
CloseHandle
LoadLibraryExA
GetLastError
FreeLibrary
FindClose
GetConsoleCP
FlushFileBuffers
WriteConsoleW
GetEnvironmentStrings
GetConsoleOutputCP
WriteConsoleA
FreeEnvironmentStringsA
RtlUnwind
GetStdHandle
HeapCreate
HeapDestroy
VirtualFree
GetStringTypeW
GetStringTypeA
ExitProcess
HeapSize
LCMapStringW
SetStdHandle
GetConsoleMode
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
EnterCriticalSection
LeaveCriticalSection
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetFileAttributesA
GetProcessHeap
GetStartupInfoA
HeapReAlloc
GetCPInfo
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
LCMapStringA

user32

MsgWaitForMultipleObjects
CharUpperA
CharNextA
PostThreadMessageA
GetMessageA
TranslateMessage
DispatchMessageA
LoadStringA
UnregisterClassA
PeekMessageA

advapi32

RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA

ole32

CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

shlwapi

StrStrIA

imagehlp

ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData

Sections

.text
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
inyt.exe.manifest
.xml
pubmod.dll
.dll regsvr32 windows:4 windows x86 arch:x86

00b621b6342f7ef7fc3bfa73a2cdeddc

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\plugins\PopupBlocker\Release\pubmod.pdb

Imports

wininet

InternetCrackUrlA

kernel32

LeaveCriticalSection
GetCurrentThreadId
LockResource
GlobalAlloc
GlobalLock
GlobalUnlock
lstrcmpA
GetCurrentProcess
FlushInstructionCache
MulDiv
SetLastError
LoadLibraryA
GetProcAddress
GetVersionExA
CreateMutexA
CloseHandle
WaitForSingleObject
WaitForMultipleObjects
GetACP
ReleaseMutex
LocalAlloc
LocalFree
CreateFileA
FindResourceExA
GetFileSize
ReadFile
WriteFile
FindResourceW
GetCurrentProcessId
GlobalHandle
GlobalFree
SetFilePointer
RtlUnwind
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetStartupInfoA
GetFileType
SetHandleCount
GetStringTypeW
lstrlenW
LCMapStringW
LCMapStringA
GetOEMCP
GetCPInfo
GetStdHandle
HeapCreate
HeapDestroy
ExitProcess
HeapSize
Sleep
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
HeapReAlloc
VirtualQuery
GetSystemInfo
VirtualProtect
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
InterlockedExchange
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
GetLastError
WideCharToMultiByte
GetConsoleCP
MultiByteToWideChar
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetModuleFileNameA
LoadResource
FindResourceA
RaiseException
DisableThreadLibraryCalls
GetModuleHandleA
LoadLibraryExA
SizeofResource
lstrcmpiA
IsDBCSLeadByte
FreeLibrary
lstrlenA
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetConsoleMode

user32

IsWindowVisible
SetTimer
KillTimer
GetKeyState
GetWindowRect
MapWindowPoints
GetSystemMetrics
ShowWindow
SetPropA
GetPropA
AnimateWindow
DialogBoxIndirectParamW
DialogBoxIndirectParamA
EndDialog
OffsetRect
UnregisterClassA
RemovePropA
MsgWaitForMultipleObjects
DispatchMessageA
TranslateMessage
GetMessageA
PeekMessageA
DestroyWindow
SendMessageA
SetWindowLongA
DestroyAcceleratorTable
DefWindowProcA
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
GetDC
ReleaseDC
IsChild
GetFocus
SetFocus
CallWindowProcA
IsWindow
GetDlgItem
GetWindowLongA
RedrawWindow
GetClassNameA
GetParent
CreateAcceleratorTableA
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
RegisterClassExA
CreateWindowExA
MapDialogRect
GetWindow
SetWindowPos
SetWindowContextHelpId
PostMessageA
CharNextA
FindWindowExA

gdi32

GetObjectA
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
SelectObject
BitBlt
CreateSolidBrush
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

RegEnumKeyExA
RegQueryValueExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA

ole32

CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
OleInitialize
CreateStreamOnHGlobal
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
OleUninitialize

oleaut32

VariantClear
SysStringLen
SysFreeString
VarUI4FromStr
VarBstrCmp
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
OleCreateFontIndirect
SysAllocStringLen
SysAllocString
VariantInit
SysStringByteLen
SysAllocStringByteLen
LoadTypeLi
LoadRegTypeLi
UnRegisterTypeLi
RegisterTypeLi

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
yt.dll
.dll regsvr32 windows:4 windows x86 arch:x86

5ddf08cdd83e6433fc7ac662c0f9997e

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

11/08/2006, 00:00

Not After

03/09/2009, 23:59

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\Release\yt.pdb

Imports

wininet

InternetCrackUrlA
UnlockUrlCacheEntryStream
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
InternetSetOptionA
InternetOpenUrlA
HttpQueryInfoA
InternetReadFile
InternetCloseHandle
InternetGetCookieA
InternetSetCookieA
RetrieveUrlCacheEntryStreamA
GetUrlCacheEntryInfoA
ReadUrlCacheEntryStream

wsock32

gethostbyname

comctl32

ImageList_Create
ImageList_Destroy
ImageList_AddMasked

imagehlp

ImageGetCertificateData
ImageEnumerateCertificates
ImageGetCertificateHeader

winmm

PlaySoundA

urlmon

FindMimeFromData
ObtainUserAgentString

msimg32

AlphaBlend

iphlpapi

GetAdaptersInfo

netapi32

Netbios

kernel32

MultiByteToWideChar
GetCurrentThreadId
GlobalAlloc
GlobalLock
GetModuleFileNameA
CreateProcessA
LoadLibraryExA
FindResourceA
GlobalUnlock
EnterCriticalSection
lstrcmpA
GetCurrentProcess
FlushInstructionCache
MulDiv
LeaveCriticalSection
ReleaseMutex
IsDBCSLeadByte
lstrcmpiA
SizeofResource
InitializeCriticalSection
DeleteCriticalSection
CreateMutexA
WaitForSingleObject
WaitForMultipleObjects
SetEvent
GetACP
lstrcpynA
CreateEventA
CreateThread
SetThreadPriority
GetExitCodeThread
TlsAlloc
TlsFree
GetThreadLocale
SetThreadLocale
GetComputerNameA
GetCurrentProcessId
GetTickCount
FindFirstFileA
FindNextFileA
FindClose
DeleteFileA
WriteFile
IsBadStringPtrA
TlsGetValue
TlsSetValue
Sleep
lstrlenA
GetVersionExA
LocalAlloc
LocalFree
CreateDirectoryA
SetFilePointer
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GlobalDeleteAtom
GlobalAddAtomA
GlobalGetAtomNameA
GlobalFree
FindResourceW
GlobalHandle
GetExitCodeProcess
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
GetFileAttributesExA
GetSystemTimeAsFileTime
CompareFileTime
FindFirstChangeNotificationA
FindNextChangeNotification
FindCloseChangeNotification
CopyFileA
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
GetFileAttributesA
WinExec
InterlockedExchange
GetLocaleInfoA
InterlockedCompareExchange
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
OutputDebugStringA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
LoadLibraryW
SetLastError
GetLastError
CloseHandle
ReadFile
GetFileSize
CreateFileA
GetProcAddress
LoadLibraryA
FreeLibrary
LockResource
LoadResource
FindResourceExA
WideCharToMultiByte
lstrlenW
InterlockedDecrement
RaiseException
InterlockedIncrement
GetStdHandle
HeapSize
GetTimeZoneInformation
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
VirtualProtect
GetSystemInfo
VirtualQuery
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlUnwind
TerminateProcess
IsDebuggerPresent
GetCPInfo
GetOEMCP
HeapDestroy
HeapCreate
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
ExitProcess
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
FlushFileBuffers
CompareStringA
CompareStringW
GetShortPathNameA

user32

SetMenuItemInfoA
GetSysColorBrush
EqualRect
InflateRect
TrackPopupMenu
DialogBoxIndirectParamW
DialogBoxIndirectParamA
CreateDialogParamW
CreateDialogParamA
EnableWindow
IsIconic
EndDialog
EnumWindows
EnumThreadWindows
CreateDialogIndirectParamA
DrawEdge
TrackPopupMenuEx
IsRectEmpty
GetDlgCtrlID
CopyRect
SendMessageW
AnimateWindow
RegisterClipboardFormatA
DeleteMenu
GetWindowDC
FrameRect
SetCursor
GetCapture
GetDCEx
IsClipboardFormatAvailable
OpenClipboard
GetClipboardData
CloseClipboard
RemoveMenu
IsWindowVisible
VkKeyScanA
GetAsyncKeyState
GetCursorPos
SetTimer
PtInRect
WindowFromPoint
GetPropA
EnumChildWindows
UnregisterClassA
MessageBoxA
CallNextHookEx
GetWindowRect
UnhookWindowsHookEx
SetWindowsHookExA
MsgWaitForMultipleObjects
GetKeyState
GetMessageA
PeekMessageA
DestroyWindow
SendMessageA
SetWindowLongA
DestroyAcceleratorTable
DefWindowProcA
GetSysColor
BeginPaint
GetClientRect
FillRect
EndPaint
IsChild
GetFocus
SetFocus
CallWindowProcA
IsWindow
GetDlgItem
GetWindowLongA
DrawFrameControl
GetSystemMetrics
GetMenuItemInfoA
GetMenuItemCount
InsertMenuItemA
CreatePopupMenu
DestroyMenu
mouse_event
TrackMouseEvent
SetWindowRgn
OffsetRect
SetActiveWindow
MapWindowPoints
SendMessageCallbackA
FindWindowA
CreateIconFromResource
CreateIconFromResourceEx
CopyIcon
LoadBitmapA
DrawIconEx
SetParent
IntersectRect
ValidateRect
GetUpdateRect
IsWindowEnabled
CallWindowProcW
GetWindowLongW
SetWindowLongW
IsWindowUnicode
RemovePropA
LoadImageA
GetActiveWindow
KillTimer
ShowWindow
SendMessageTimeoutA
RedrawWindow
GetParent
CreateAcceleratorTableA
ClientToScreen
ScreenToClient
MoveWindow
SetCapture
ReleaseCapture
InvalidateRect
InvalidateRgn
GetDesktopWindow
RegisterWindowMessageA
GetWindowTextLengthA
GetWindowTextA
SetWindowTextA
GetClassInfoExA
LoadCursorA
RegisterClassExA
MapDialogRect
GetWindow
SetWindowPos
SetWindowContextHelpId
LoadStringA
PostMessageA
CharLowerA
GetWindowThreadProcessId
FindWindowExA
GetClassNameA
CreateWindowExA
CharNextA
ReleaseDC
GetDC
DestroyIcon
DrawTextA
SetPropA
TranslateMessage
SystemParametersInfoA
DispatchMessageA

advapi32

RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegQueryValueExA
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteValueA
RegCreateKeyA
GetUserNameA
RegNotifyChangeKeyValue

ole32

CreateStreamOnHGlobal
CoTaskMemFree
CoTaskMemAlloc
StringFromGUID2
StringFromCLSID
CoCreateInstance
OleUninitialize
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoTaskMemRealloc
CoInitializeEx
CoUninitialize
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoCreateGuid
OleDraw
RegisterDragDrop
RevokeDragDrop
ReleaseStgMedium
OleInitialize

shell32

ShellExecuteA
ShellExecuteExA
SHFileOperationA

oleaut32

UnRegisterTypeLi
SysAllocStringLen
VariantClear
VariantInit
VariantChangeType
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
SafeArrayGetElement
VariantCopy
SafeArrayPutElement
SafeArrayCreate
OleLoadPicture
VarBstrCat
VarBstrCmp
SysAllocStringByteLen
OleCreateFontIndirect
RegisterTypeLi
DispCallFunc
VarUI4FromStr
SysStringLen
SysAllocString
SysStringByteLen
LoadTypeLi
LoadRegTypeLi
SysFreeString

shlwapi

StrTrimA
StrTrimW
StrStrIA
StrStrIW

gdi32

MoveToEx
LineTo
GetBkColor
DeleteObject
GetObjectType
CreateBrushIndirect
SelectObject
CreatePen
Rectangle
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
GetObjectA
GetTextColor
SetDIBits
GetStockObject
GetDeviceCaps
GetDIBits
CombineRgn
CreateSolidBrush
RestoreDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
LPtoDP
CreateDCA
CreateFontIndirectA
TextOutA
SetTextAlign
GetTextMetricsA
EnumFontFamiliesExA
TranslateCharsetInfo
CreateBitmap
SetBkColor
SetTextColor
SetStretchBltMode
StretchBlt
CreateDIBSection
GetPixel
CreateRectRgn
SetBkMode

Exports

Exports

DllCanUnloadNow
DllCommand
DllGetClassObject
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 575KB - Virtual size: 574KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 25KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Acknowledgements.txt
AsyncOps.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\ExternalProjects\MovieEditor\AsyncOps\obj\Debug\AsyncOps.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
AxInterop.WMPLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Bass.Net.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 472KB - Virtual size: 470KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 28KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
FLVmovie.DLL
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Documents and Settings\rbhargav\My Documents\Visual Studio 2005\Projects\FLVjoin\FLVmovie\obj\Release\FLVmovie.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 744B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Interop.QuartzTypeLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Interop.WMPLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 256KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IrisSkin2.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.textxc
Size: 528KB - Virtual size: 525KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.datax
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 86B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 988B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Lang/English.lang
Settings.xml
SteelBlue.ssk
Translator.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Uninst.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 196KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
$PLUGINSDIR/Processes.dll
.dll windows:4 windows x86 arch:x86

f5edecae12589e705677a6e272ad0394

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LoadLibraryA
GetProcAddress
FreeLibrary
OpenProcess
CloseHandle
TerminateProcess
GlobalFree
lstrcpyA
GetCommandLineA
GetVersionExA
ExitProcess
GetModuleHandleA
GetCurrentProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
UnhandledExceptionFilter
DisableThreadLibraryCalls
WriteFile
SetFilePointer
HeapAlloc
GetACP
GetOEMCP
GetCPInfo
VirtualAlloc
HeapReAlloc
RtlUnwind
InterlockedExchange
VirtualQuery
SetStdHandle
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
LCMapStringA
MultiByteToWideChar
LCMapStringW
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
VirtualProtect
GetSystemInfo

user32

FindWindowA
GetDesktopWindow
wsprintfA
UpdateWindow

Exports

Exports

FindDevice
FindProcess
KillProcess

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VideoEditorMaster.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VideoEditorMaster.xml
asfbin.exe
.exe windows:4 windows x86 arch:x86

8b42065943351bb7e7ec08899b0bfa64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MulDiv
GetCurrentDirectoryA
InterlockedIncrement
InterlockedDecrement
FileTimeToSystemTime
FileTimeToLocalFileTime
WideCharToMultiByte
GetFileTime
GetPrivateProfileIntA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetWindowsDirectoryA
GlobalFree
GlobalUnlock
SetEndOfFile
GlobalAlloc
GetVersionExA
GetLocaleInfoA
MultiByteToWideChar
GetProcAddress
LoadLibraryA
Beep
GetModuleFileNameA
GetConsoleScreenBufferInfo
GetStdHandle
ReadConsoleOutputCharacterA
SetConsoleCursorPosition
GetStringTypeA
IsBadCodePtr
CreateFileW
SetFileTime
GetSystemTime
GlobalLock
SystemTimeToFileTime
IsBadReadPtr
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
FlushFileBuffers
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
HeapSize
UnhandledExceptionFilter
WriteConsoleA
SetUnhandledExceptionFilter
GetStartupInfoA
SetHandleCount
TerminateProcess
IsBadWritePtr
VirtualAlloc
VirtualFree
HeapCreate
GetStringTypeW
HeapDestroy
GetEnvironmentVariableA
GetModuleHandleA
ExitProcess
GetVersion
GetCommandLineA
GetFileAttributesW
SetConsoleCtrlHandler
RtlUnwind
HeapAlloc
HeapFree
GetLastError
DuplicateHandle
GetCurrentProcess
HeapReAlloc
SetStdHandle
GetFileType
RaiseException
SetFilePointer
WriteFile
ReadFile
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
CloseHandle
CreateFileA
GetFileAttributesA

user32

MessageBoxA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA

ole32

CoCreateGuid
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoInitializeEx

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

msvfw32

ICClose
ICSendMessage
ICDecompress
ICCompress
ICOpen
ICGetInfo
ICGetDisplayFormat

msacm32

acmStreamSize
acmStreamUnprepareHeader
acmStreamConvert
acmStreamPrepareHeader
acmMetrics
acmFormatSuggest
acmStreamOpen
acmStreamClose

msdmo

MoFreeMediaType
DMOEnum
MoInitMediaType

Sections

.text
Size: 296KB - Virtual size: 293KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
asfcut.exe
.exe windows:4 windows x86 arch:x86

357612c96da940893e10c5238d2d0ea6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

_wcsicmp
fflush
_access
printf
_mbsnbcpy
_iob
_getche
_mbsnbcat
_mbsrchr
_vsnprintf
_errno
??1type_info@@UAE@XZ
atoi
_mbsstr
exit
__p___initenv
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
_mbsicmp
_ismbblead
__set_app_type
_except_handler3
_controlfp
_mbsnbicmp
_mbsinc
wcslen
sprintf
_exit
_mbclen
fopen
fclose
_mbschr
_mbscspn
_CxxThrowException
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
??2@YAPAXI@Z
??3@YAXPAX@Z
_open
_lseeki64
_telli64
_read
_mbccpy
_mbsdec
fgets
_close
__p__fmode
_XcptFilter
__p__commode

wmvcore

WMCreateIndexer
WMCreateProfileManager
WMCreateReader
WMCreateWriter
WMCreateEditor

kernel32

CloseHandle
GlobalMemoryStatus
GetCurrentDirectoryA
GetLocaleInfoA
WideCharToMultiByte
WaitForSingleObject
SetEvent
CreateEventA
GetLastError
MultiByteToWideChar
GetModuleHandleA
GetModuleFileNameA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

ole32

CoInitialize
CoUninitialize

msvcp60

??0logic_error@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??_7out_of_range@std@@6B@
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
??0out_of_range@std@@QAE@ABV01@@Z
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

Sections

.text
Size: 43KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bass.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_Apply3D
BASS_ChannelBytes2Seconds
BASS_ChannelGet3DAttributes
BASS_ChannelGet3DPosition
BASS_ChannelGetAttributes
BASS_ChannelGetData
BASS_ChannelGetDevice
BASS_ChannelGetEAXMix
BASS_ChannelGetInfo
BASS_ChannelGetLength
BASS_ChannelGetLevel
BASS_ChannelGetPosition
BASS_ChannelGetTags
BASS_ChannelIsActive
BASS_ChannelIsSliding
BASS_ChannelPause
BASS_ChannelPlay
BASS_ChannelPreBuf
BASS_ChannelRemoveDSP
BASS_ChannelRemoveFX
BASS_ChannelRemoveLink
BASS_ChannelRemoveSync
BASS_ChannelSeconds2Bytes
BASS_ChannelSet3DAttributes
BASS_ChannelSet3DPosition
BASS_ChannelSetAttributes
BASS_ChannelSetDSP
BASS_ChannelSetDevice
BASS_ChannelSetEAXMix
BASS_ChannelSetFX
BASS_ChannelSetFlags
BASS_ChannelSetLink
BASS_ChannelSetPosition
BASS_ChannelSetSync
BASS_ChannelSlideAttributes
BASS_ChannelStop
BASS_ErrorGetCode
BASS_FXGetParameters
BASS_FXReset
BASS_FXSetParameters
BASS_Free
BASS_Get3DFactors
BASS_Get3DPosition
BASS_GetCPU
BASS_GetConfig
BASS_GetDSoundObject
BASS_GetDevice
BASS_GetDeviceDescription
BASS_GetEAXParameters
BASS_GetInfo
BASS_GetVersion
BASS_GetVolume
BASS_Init
BASS_MusicFree
BASS_MusicGetAttribute
BASS_MusicGetOrderPosition
BASS_MusicGetOrders
BASS_MusicLoad
BASS_MusicSetAttribute
BASS_Pause
BASS_PluginFree
BASS_PluginGetInfo
BASS_PluginLoad
BASS_RecordFree
BASS_RecordGetDevice
BASS_RecordGetDeviceDescription
BASS_RecordGetInfo
BASS_RecordGetInput
BASS_RecordGetInputName
BASS_RecordInit
BASS_RecordSetDevice
BASS_RecordSetInput
BASS_RecordStart
BASS_SampleCreate
BASS_SampleCreateDone
BASS_SampleFree
BASS_SampleGetChannel
BASS_SampleGetChannels
BASS_SampleGetInfo
BASS_SampleLoad
BASS_SampleSetInfo
BASS_SampleStop
BASS_Set3DFactors
BASS_Set3DPosition
BASS_SetConfig
BASS_SetDevice
BASS_SetEAXParameters
BASS_SetVolume
BASS_Start
BASS_Stop
BASS_StreamCreate
BASS_StreamCreateFile
BASS_StreamCreateFileUser
BASS_StreamCreateURL
BASS_StreamFree
BASS_StreamGetFilePosition
BASS_Update
_

Sections

Size: 86KB - Virtual size: 244KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 568B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
bass_fx.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_FX_BPM_BeatCallbackReset
BASS_FX_BPM_BeatCallbackSet
BASS_FX_BPM_BeatDecodeGet
BASS_FX_BPM_BeatFree
BASS_FX_BPM_BeatGetParameters
BASS_FX_BPM_BeatSetParameters
BASS_FX_BPM_CallbackReset
BASS_FX_BPM_CallbackSet
BASS_FX_BPM_DecodeGet
BASS_FX_BPM_Free
BASS_FX_BPM_Translate
BASS_FX_DSP_GetParameters
BASS_FX_DSP_Remove
BASS_FX_DSP_Reset
BASS_FX_DSP_Set
BASS_FX_DSP_SetParameters
BASS_FX_ReverseCreate
BASS_FX_ReverseGetDirection
BASS_FX_ReverseGetSource
BASS_FX_ReverseSetDirection
BASS_FX_TempoCreate
BASS_FX_TempoGet
BASS_FX_TempoGetOption
BASS_FX_TempoGetRateRatio
BASS_FX_TempoGetSource
BASS_FX_TempoSet
BASS_FX_TempoSetOption

Sections

.petite
Size: 24KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 600B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
basswma.dll
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BASS_WMA_EncodeClose
BASS_WMA_EncodeGetClients
BASS_WMA_EncodeGetPort
BASS_WMA_EncodeGetRates
BASS_WMA_EncodeOpen
BASS_WMA_EncodeOpenFile
BASS_WMA_EncodeOpenNetwork
BASS_WMA_EncodeOpenNetworkMulti
BASS_WMA_EncodeOpenPublish
BASS_WMA_EncodeOpenPublishMulti
BASS_WMA_EncodeSetNotify
BASS_WMA_EncodeSetTag
BASS_WMA_EncodeWrite
BASS_WMA_GetWMObject
BASS_WMA_StreamCreateFile
BASS_WMA_StreamCreateFileAuth
BASS_WMA_StreamCreateFileUser
BASSplugin

Sections

Size: 11KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 568B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
license.txt
mpgtx.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

UPX0
Size: - Virtual size: 72KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 62KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX2
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 92KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 52KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
tools/register.exe
.exe windows:4 windows x86 arch:x86

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

kernel32

SetHandleCount
SetStdHandle
ReadFile
LoadLibraryA
MultiByteToWideChar
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapSize
WideCharToMultiByte
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
tools/register_y.exe
.exe windows:4 windows x86 arch:x86

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

wininet

InternetCloseHandle
InternetReadFile
InternetOpenA
InternetOpenUrlA

kernel32

SetHandleCount
SetStdHandle
ReadFile
LoadLibraryA
MultiByteToWideChar
RtlUnwind
RaiseException
GetCommandLineA
GetVersion
ExitProcess
HeapFree
TerminateProcess
GetCurrentProcess
HeapAlloc
HeapReAlloc
HeapSize
WideCharToMultiByte
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
IsBadWritePtr
GetLastError
SetFilePointer
FlushFileBuffers
CloseHandle
IsBadReadPtr
IsBadCodePtr
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
GetProcAddress

Sections

.text
Size: 48KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 196KB

UPX1 Size: 17KB - Virtual size: 20KB

.rsrc Size: 15KB - Virtual size: 16KB

2dfc6a992d004b736e85c64219a88b4a

Headers

File Characteristics

Imports

kernel32

user32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 172B

.reloc Size: 512B - Virtual size: 266B

b1cd0d78f652ce5fc63f0879371af012

Headers

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 10KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1024B - Virtual size: 1012B

4ec328f99bdd944fc98d8a5cf11f7a62

Headers

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 6KB

.rdata Size: 1024B - Virtual size: 784B

.data Size: 512B - Virtual size: 92B

.reloc Size: 512B - Virtual size: 496B

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

Imports

wininet

kernel32

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 10KB

492138ce5716142bee4b8c6ddf19a2c0

Headers

File Characteristics

Imports

wininet

kernel32

Sections

.text Size: 48KB - Virtual size: 44KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 4KB - Virtual size: 10KB

21607682c19f7802c7d98afd746dbe9e

Code Sign

01Certificate

0aCertificate

UPX0
Size: - Virtual size: 196KB

UPX1
Size: 17KB - Virtual size: 20KB

.rsrc
Size: 15KB - Virtual size: 16KB

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 172B

.reloc
Size: 512B - Virtual size: 266B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 10KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 1012B

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 784B

.data
Size: 512B - Virtual size: 92B

.reloc
Size: 512B - Virtual size: 496B

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 10KB

.text
Size: 48KB - Virtual size: 44KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 4KB - Virtual size: 10KB

01
Certificate

0a
Certificate

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

5e:b6:9a:dc:01:d0:04:73:92:e2:97:77:b3:ed:38:c5
Certificate

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 80B

.rsrc
Size: 368KB - Virtual size: 367KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7
Certificate

.text
Size: 22KB - Virtual size: 22KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 1024B - Virtual size: 109KB

.ndata
Size: - Virtual size: 40KB

.rsrc
Size: 3KB - Virtual size: 2KB

.text
Size: 7KB - Virtual size: 6KB

.rdata
Size: 1024B - Virtual size: 816B

.data
Size: - Virtual size: 56B

.reloc
Size: 512B - Virtual size: 490B