ce34dca1bbb0d3fb71feef3e0173ddbc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

ce34dca1bbb0d3fb71feef3e0173ddbc_JaffaCakes118
Size

2.8MB
MD5

ce34dca1bbb0d3fb71feef3e0173ddbc
SHA1

a02e441f9e2e36e1652cba96ef41836d81df7f6a
SHA256

952eaedd301be55366263895a3a9bcf669558c20ee8bd7070d59be8e2c3f4989
SHA512

0ebfe804082f11ff36298c30234a8643d77cb3543cb955925748783613f0af959202284a3dc057b2d00466b51fea907793a1fe10eec8100053153e1196a7b0ee
SSDEEP

49152:nOkSo3jqTBILWwOeteKZyS7HLsOBJ1vR1z4Z6pUFw4XW+GidDTfPkp0koL:kMDk27HQ01z34XWwwWtL

Score

1^/10

Malware Config

Signatures

Files

ce34dca1bbb0d3fb71feef3e0173ddbc_JaffaCakes118
.7z
1031.mst
1033.mst
1034.mst
1036.mst
1040.mst
1041.mst
1043.mst
1045.mst
1049.mst
2070.mst
AskToolbarInstaller-12.45.1_BCPA3.msi
.msi
appdata/Mozilla/Firefox/Profiles/{DefaultProfilesFolder}/extensions/[email protected]
.zip
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
chrome.manifest
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/logo_32x_24x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/button.png
.png
config/skin/images/search/line.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/js/init-tb-stuff.js
config/skin/js/newtab-overlay.js
.js
config/skin/js/newtab-subscript.js
.js
config/skin/newtab-overlay.xul
.xml
config/skin/overlay.xul
.xml
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/amazon-navigation/button.png
.png
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/cnn/3.0/button.png
.png
config/skin/widgets/ebay_vanilla/button.png
.png
config/skin/widgets/facebook/button.png
.png
config/skin/widgets/games-feed/BubbleTown.png
.png
config/skin/widgets/games-feed/SlingoSupreme.png
.png
config/skin/widgets/games-feed/blackjack_32.png
.png
config/skin/widgets/games-feed/button.png
.png
config/skin/widgets/games-feed/game-3in1checkers-01.png
.png
config/skin/widgets/games-feed/game-4balls-01.png
.png
config/skin/widgets/games-feed/game-cubefield-01.png
.png
config/skin/widgets/games-feed/game-doublewires-01.png
.png
config/skin/widgets/games-feed/game-fishdom.png
.png
config/skin/widgets/games-feed/game-goldminer-01.png
.png
config/skin/widgets/games-feed/game-jewelsolitare-01.png
.png
config/skin/widgets/games-feed/game-pacxon-01.png
.png
config/skin/widgets/games-feed/game-supercollapse.png
.png
config/skin/widgets/games-feed/game-tropix-01.png
.png
config/skin/widgets/games-feed/games.png
.png
config/skin/widgets/games-feed/sudoku_32.png
.png
config/skin/widgets/map/3.0/button.png
.png
config/skin/widgets/netvibes-abc/button.png
.png
config/skin/widgets/netvibes-ascom/button.png
.png
config/skin/widgets/netvibes-bbc/button.png
.png
config/skin/widgets/netvibes-bbcsports/button.png
.png
config/skin/widgets/netvibes-beppegrillo/button.png
.png
config/skin/widgets/netvibes-corrieredellasera/button.png
.png
config/skin/widgets/netvibes-elmundo/button.png
.png
config/skin/widgets/netvibes-expansion/button.png
.png
config/skin/widgets/netvibes-financialtimes.de/button.png
.png
config/skin/widgets/netvibes-financialtimes/button.png
.png
config/skin/widgets/netvibes-folha/button.png
.png
config/skin/widgets/netvibes-g1/button.png
.png
config/skin/widgets/netvibes-kicker/button.png
.png
config/skin/widgets/netvibes-lagazzettadellosport/button.png
.png
config/skin/widgets/netvibes-lemonde/button.png
.png
config/skin/widgets/netvibes-lequipe/button.png
.png
config/skin/widgets/netvibes-mtv.it/button.png
.png
config/skin/widgets/netvibes-newsru/button.png
.png
config/skin/widgets/netvibes-nu-nl/button.png
.png
config/skin/widgets/netvibes-pbkdaily/button.png
.png
config/skin/widgets/netvibes-programmetv/button.png
.png
config/skin/widgets/netvibes-sportsnl/button.png
.png
config/skin/widgets/netvibes-sportsru/button.png
.png
config/skin/widgets/netvibes-todayinhistory/button.png
.png
config/skin/widgets/netvibes-uol/button.png
.png
config/skin/widgets/netvibes-voici/button.png
.png
config/skin/widgets/orkut/button.png
.png
config/skin/widgets/radio/5.0/button.png
.png
config/skin/widgets/simple-email-list/button.png
.png
config/skin/widgets/simple-email-list/gmail.png
.png
config/skin/widgets/simple-email-list/hotmail.png
.png
config/skin/widgets/simple-email-list/outlook.png
.png
config/skin/widgets/simple-email-list/yahoo!.png
.png
config/skin/widgets/toolbar-options/css/options.css
config/skin/widgets/toolbar-options/images/button-blue-1x20.png
.png
config/skin/widgets/toolbar-options/images/button-grey-1x26.png
.png
config/skin/widgets/toolbar-options/images/button.png
.png
config/skin/widgets/toolbar-options/images/icons.png
.png
config/skin/widgets/toolbar-options/images/lightblue-1x43.png
.png
config/skin/widgets/toolbar-options/js/options.js
.js
config/skin/widgets/toolbar-options/js/translations.js
.js
config/skin/widgets/toolbar-options/js/translations.json
config/skin/widgets/toolbar-options/options.html
.html
config/skin/widgets/ultimosegundo/button.png
.png
config/skin/widgets/vk/button.png
.png
config/skin/widgets/weather/7.0/button.png
.png
config/skin/widgets/wordoftheday/button.png
.png
config/skin/widgets/yt/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
.js
config/widget-config.json
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/overlay.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
icon.png
.png
install.rdf
.xml
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/constant.json
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/shims/jquery.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/update-constant.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
mozilla/InstallCheck.jsm
.js
mozilla/JSONStore.jsm
.js
newtab/_newtab.html
.html
newtab/css/newtab.css
newtab/images/button-images.png
.png
newtab/images/button-news.png
.png
newtab/images/button-video.png
.png
newtab/images/button-web.png
.png
newtab/js/_newtab.js
newtab/js/jquery.js
.js
newtab/js/newtab.js
.js
newtab/newtab.html
newtab/search-suggestion/css/images/animated-overlay.gif
.gif
newtab/search-suggestion/css/images/ui-bg_diagonals-thick_18_b81900_40x40.png
.png
newtab/search-suggestion/css/images/ui-bg_diagonals-thick_20_666666_40x40.png
.png
newtab/search-suggestion/css/images/ui-bg_flat_10_000000_40x100.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_100_f6f6f6_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_100_fdf5ce_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_glass_65_ffffff_1x400.png
.png
newtab/search-suggestion/css/images/ui-bg_gloss-wave_35_f6a828_500x100.png
.png
newtab/search-suggestion/css/images/ui-bg_highlight-soft_100_eeeeee_1x100.png
.png
newtab/search-suggestion/css/images/ui-bg_highlight-soft_75_ffe45c_1x100.png
.png
newtab/search-suggestion/css/images/ui-icons_222222_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_228ef1_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ef8c08_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ffd27a_256x240.png
.png
newtab/search-suggestion/css/images/ui-icons_ffffff_256x240.png
.png
newtab/search-suggestion/css/jquery-ui.css
newtab/search-suggestion/css/search-suggestion.css
newtab/search-suggestion/js/jquery-ui.js
.js
newtab/search-suggestion/js/search-suggestion.js
.js
newtab/search-suggestion/js/storage.js
.js
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/ToolbarCR.crx
.zip
_metadata/verified_contents.json
background/OneTimeCode.js
.js
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/content-script.xul
.xml
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/init-tb-stuff.js
config/skin/newtab-overlay.xul
.js .xml polyglot
config/skin/newtab-subscript.js
.js
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/amazon-navigation/button.png
.png
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/cnn/2.0/button.png
.png
config/skin/widgets/ebay_vanilla/button.png
.png
config/skin/widgets/facebook/5.1/button.png
.png
config/skin/widgets/games-feed/BubbleTown.png
.png
config/skin/widgets/games-feed/SlingoSupreme.png
.png
config/skin/widgets/games-feed/blackjack_32.png
.png
config/skin/widgets/games-feed/button.png
.png
config/skin/widgets/games-feed/game-3in1checkers-01.png
.png
config/skin/widgets/games-feed/game-4balls-01.png
.png
config/skin/widgets/games-feed/game-cubefield-01.png
.png
config/skin/widgets/games-feed/game-doublewires-01.png
.png
config/skin/widgets/games-feed/game-fishdom.png
.png
config/skin/widgets/games-feed/game-goldminer-01.png
.png
config/skin/widgets/games-feed/game-jewelsolitare-01.png
.png
config/skin/widgets/games-feed/game-pacxon-01.png
.png
config/skin/widgets/games-feed/game-supercollapse.png
.png
config/skin/widgets/games-feed/game-tropix-01.png
.png
config/skin/widgets/games-feed/games.png
.png
config/skin/widgets/games-feed/sudoku_32.png
.png
config/skin/widgets/map/2.1/button.png
.png
config/skin/widgets/netvibes-abc/button.png
.png
config/skin/widgets/netvibes-ascom/button.png
.png
config/skin/widgets/netvibes-bbc/button.png
.png
config/skin/widgets/netvibes-bbcsports/button.png
.png
config/skin/widgets/netvibes-beppegrillo/button.png
.png
config/skin/widgets/netvibes-corrieredellasera/button.png
.png
config/skin/widgets/netvibes-elmundo/button.png
.png
config/skin/widgets/netvibes-expansion/button.png
.png
config/skin/widgets/netvibes-financialtimes.de/button.png
.png
config/skin/widgets/netvibes-financialtimes/button.png
.png
config/skin/widgets/netvibes-folha/button.png
.png
config/skin/widgets/netvibes-g1/button.png
.png
config/skin/widgets/netvibes-kicker/button.png
.png
config/skin/widgets/netvibes-lagazzettadellosport/button.png
.png
config/skin/widgets/netvibes-lemonde/button.png
.png
config/skin/widgets/netvibes-lequipe/button.png
.png
config/skin/widgets/netvibes-mtv.it/button.png
.png
config/skin/widgets/netvibes-newsru/button.png
.png
config/skin/widgets/netvibes-nu-nl/button.png
.png
config/skin/widgets/netvibes-pbkdaily/button.png
.png
config/skin/widgets/netvibes-programmetv/button.png
.png
config/skin/widgets/netvibes-sportsnl/button.png
.png
config/skin/widgets/netvibes-sportsru/button.png
.png
config/skin/widgets/netvibes-todayinhistory/button.png
.png
config/skin/widgets/netvibes-uol/button.png
.png
config/skin/widgets/netvibes-voici/button.png
.png
config/skin/widgets/orkut/button.png
.png
config/skin/widgets/radio/4.0/button.png
.png
config/skin/widgets/simple-email-list/button.png
.png
config/skin/widgets/simple-email-list/gmail.png
.png
config/skin/widgets/simple-email-list/hotmail.png
.png
config/skin/widgets/simple-email-list/outlook.png
.png
config/skin/widgets/simple-email-list/yahoo!.png
.png
config/skin/widgets/toolbar-options/css/options.css
config/skin/widgets/toolbar-options/images/button-blue-1x20.png
.png
config/skin/widgets/toolbar-options/images/button-grey-1x26.png
.png
config/skin/widgets/toolbar-options/images/button.png
.png
config/skin/widgets/toolbar-options/images/icons.png
.png
config/skin/widgets/toolbar-options/images/lightblue-1x43.png
.png
config/skin/widgets/toolbar-options/js/options.js
.js
config/skin/widgets/toolbar-options/js/translations.js
config/skin/widgets/toolbar-options/options.html
.html
config/skin/widgets/ultimosegundo/button.png
.png
config/skin/widgets/video/4.1/button.png
.png
config/skin/widgets/vk/button.png
.png
config/skin/widgets/weather/6.0/button.png
.png
config/skin/widgets/wordoftheday/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
config/widget-config.jse
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
devtools/logtrace/ClassTreeView.js
.js
devtools/logtrace/Tracer.jsm
.js
devtools/logtrace/button.js
.js
devtools/logtrace/logtrace-bindings.css
devtools/logtrace/logtrace-bindings.xml
.js .xml polyglot
devtools/logtrace/logtrace.js
.js
devtools/logtrace/logtrace.xul
.xml
devtools/removeFromToolbar.py
.py .sh linux
icon.png
.png
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/json.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
manifest.json
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/bl-new-tab-page.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/new-tab-page.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/Update.xml
.xml
common appdata/AskPartnerNetwork/Toolbar/{PartnerID}/CRX/{Crx_Version}/Toolbar.crx
.zip
background/background-options.js
.js
background/background.html
.html
background/background.js
.js
background/browser-action.js
.js
background/cache-config.js
.js
background/cookies.js
.js
background/feeds.js
.js
background/fixup-jquery-for-ie.js
.js
background/history.js
.js
background/ie-bg-shim.js
.js
background/init-bg-messaging.js
background/install-api.js
.js
background/lifecycle.js
.js
background/localStorage.js
.js
background/popup.js
.js
background/preference.js
.js
background/rebuttal.js
.js
background/registry.js
.js
background/reporting.js
.js
background/search.js
.js
background/security.js
.js
background/sideByside.js
.js
background/tabs.js
.js
background/utils.js
.js
config/build.json
config/lang-config.js
config/skin/chrome-options.html
.html
config/skin/css/bl-new-tab.css
config/skin/css/chrome-options.css
config/skin/css/containers.css
config/skin/css/hp-new-tab.css
config/skin/css/new-tab.css
config/skin/css/searchbox.css
config/skin/css/themes/avira/avira.css
config/skin/css/themes/imesh/imesh.css
config/skin/css/themes/mindspark/mindspark.css
config/skin/css/themes/mindspark/new-search-button-mid.png
.png
config/skin/css/themes/mindspark/new-search-button-sides.png
.png
config/skin/css/themes/plain/plain.css
config/skin/css/themes/taskbar/taskbar.css
config/skin/css/themes/v5parity/v5parity.css
config/skin/css/toolbar.css
config/skin/images/IDR_WEBSTORE_ICON.png
.png
config/skin/images/logo/ask_flat_20x.png
.png
config/skin/images/logo/icon.png
.png
config/skin/images/logo/logo_128x.png
.png
config/skin/images/logo/logo_19x.png
.png
config/skin/images/logo/logo_19x_grey.png
.png
config/skin/images/logo/logo_24x.png
.png
config/skin/images/logo/logo_32x.png
.png
config/skin/images/logo/logo_32x_24x.png
.png
config/skin/images/logo/newtablogo.png
.png
config/skin/images/logo/toolbar-icons.png
.png
config/skin/images/newtab/bl-homepage_logo.png
.png
config/skin/images/newtab/btn_x.png
.png
config/skin/images/newtab/homepage_logo.png
.png
config/skin/images/newtab/manifier.png
.png
config/skin/images/newtab/thirdparty_icons.png
.png
config/skin/images/search/btn_search_ask_taskbar.png
.png
config/skin/images/search/button.png
.png
config/skin/images/search/line.png
.png
config/skin/images/search/logo_cobrand_18px.png
.png
config/skin/images/search/logo_cobrand_24px.png
.png
config/skin/images/search/new-search-button-mid.png
.png
config/skin/images/search/new-search-button-sides.png
.png
config/skin/images/search/search-button-mid.png
.png
config/skin/images/search/search-button-sides.png
.png
config/skin/images/vanilla/badge_1.png
.png
config/skin/images/vanilla/badge_10.png
.png
config/skin/images/vanilla/badge_10plus.png
.png
config/skin/images/vanilla/badge_2.png
.png
config/skin/images/vanilla/badge_3.png
.png
config/skin/images/vanilla/badge_4.png
.png
config/skin/images/vanilla/badge_5.png
.png
config/skin/images/vanilla/badge_6.png
.png
config/skin/images/vanilla/badge_7.png
.png
config/skin/images/vanilla/badge_8.png
.png
config/skin/images/vanilla/badge_9.png
.png
config/skin/images/vanilla/badge_exclaim.png
.png
config/skin/images/vanilla/badge_numbers.png
.png
config/skin/images/vanilla/bdg-gradient.png
.png
config/skin/images/vanilla/bg.png
.png
config/skin/images/vanilla/curved-divider.png
.png
config/skin/images/vanilla/left-bg.png
.png
config/skin/js/init-tb-stuff.js
config/skin/js/newtab-overlay.js
.js
config/skin/js/newtab-subscript.js
.js
config/skin/newtab-overlay.xul
.xml
config/skin/overlay.xul
.xml
config/skin/toolbar.html
.html
config/skin/toolbar.xul
.xml
config/skin/widget-bundled.xul
.xml
config/skin/widget-hosted.xul
.xml
config/skin/widgets/amazon-navigation/button.png
.png
config/skin/widgets/ask-homepage/button.png
.png
config/skin/widgets/cnn/3.0/button.png
.png
config/skin/widgets/ebay_vanilla/button.png
.png
config/skin/widgets/facebook/button.png
.png
config/skin/widgets/games-feed/BubbleTown.png
.png
config/skin/widgets/games-feed/SlingoSupreme.png
.png
config/skin/widgets/games-feed/blackjack_32.png
.png
config/skin/widgets/games-feed/button.png
.png
config/skin/widgets/games-feed/game-3in1checkers-01.png
.png
config/skin/widgets/games-feed/game-4balls-01.png
.png
config/skin/widgets/games-feed/game-cubefield-01.png
.png
config/skin/widgets/games-feed/game-doublewires-01.png
.png
config/skin/widgets/games-feed/game-fishdom.png
.png
config/skin/widgets/games-feed/game-goldminer-01.png
.png
config/skin/widgets/games-feed/game-jewelsolitare-01.png
.png
config/skin/widgets/games-feed/game-pacxon-01.png
.png
config/skin/widgets/games-feed/game-supercollapse.png
.png
config/skin/widgets/games-feed/game-tropix-01.png
.png
config/skin/widgets/games-feed/games.png
.png
config/skin/widgets/games-feed/sudoku_32.png
.png
config/skin/widgets/map/3.0/button.png
.png
config/skin/widgets/netvibes-abc/button.png
.png
config/skin/widgets/netvibes-ascom/button.png
.png
config/skin/widgets/netvibes-bbc/button.png
.png
config/skin/widgets/netvibes-bbcsports/button.png
.png
config/skin/widgets/netvibes-beppegrillo/button.png
.png
config/skin/widgets/netvibes-corrieredellasera/button.png
.png
config/skin/widgets/netvibes-elmundo/button.png
.png
config/skin/widgets/netvibes-expansion/button.png
.png
config/skin/widgets/netvibes-financialtimes.de/button.png
.png
config/skin/widgets/netvibes-financialtimes/button.png
.png
config/skin/widgets/netvibes-folha/button.png
.png
config/skin/widgets/netvibes-g1/button.png
.png
config/skin/widgets/netvibes-kicker/button.png
.png
config/skin/widgets/netvibes-lagazzettadellosport/button.png
.png
config/skin/widgets/netvibes-lemonde/button.png
.png
config/skin/widgets/netvibes-lequipe/button.png
.png
config/skin/widgets/netvibes-mtv.it/button.png
.png
config/skin/widgets/netvibes-newsru/button.png
.png
config/skin/widgets/netvibes-nu-nl/button.png
.png
config/skin/widgets/netvibes-pbkdaily/button.png
.png
config/skin/widgets/netvibes-programmetv/button.png
.png
config/skin/widgets/netvibes-sportsnl/button.png
.png
config/skin/widgets/netvibes-sportsru/button.png
.png
config/skin/widgets/netvibes-todayinhistory/button.png
.png
config/skin/widgets/netvibes-uol/button.png
.png
config/skin/widgets/netvibes-voici/button.png
.png
config/skin/widgets/orkut/button.png
.png
config/skin/widgets/radio/5.0/button.png
.png
config/skin/widgets/simple-email-list/button.png
.png
config/skin/widgets/simple-email-list/gmail.png
.png
config/skin/widgets/simple-email-list/hotmail.png
.png
config/skin/widgets/simple-email-list/outlook.png
.png
config/skin/widgets/simple-email-list/yahoo!.png
.png
config/skin/widgets/toolbar-options/css/options.css
config/skin/widgets/toolbar-options/images/button-blue-1x20.png
.png
config/skin/widgets/toolbar-options/images/button-grey-1x26.png
.png
config/skin/widgets/toolbar-options/images/button.png
.png
config/skin/widgets/toolbar-options/images/icons.png
.png
config/skin/widgets/toolbar-options/images/lightblue-1x43.png
.png
config/skin/widgets/toolbar-options/js/options.js
.js
config/skin/widgets/toolbar-options/js/translations.js
.js
config/skin/widgets/toolbar-options/js/translations.json
config/skin/widgets/toolbar-options/options.html
.html
config/skin/widgets/ultimosegundo/button.png
.png
config/skin/widgets/vk/button.png
.png
config/skin/widgets/weather/7.0/button.png
.png
config/skin/widgets/wordoftheday/button.png
.png
config/skin/widgets/yt/button.png
.png
config/tb-config.js
.js
config/test-widget-config.js
config/widget-config.js
.js
config/widget-config.json
content_script/content-script.js
.js
content_script/hack/facebook.css
content_script/hack/relative.css
content_script/hack/static.css
content_script/injector.js
.js
content_script/inline-html.js
.js
content_script/notify-presence.js
.js
content_script/overlay.js
.js
content_script/positioning.js
.js
content_script/toolbar.js
.js
content_script/widget-hosted.js
.js
content_script/widget.js
.js
icon.png
.png
lib/DataStore.js
.js
lib/async-gate.js
.js
lib/browser-shim.js
.js
lib/constant.js
lib/constant.json
lib/default-config.js
.js
lib/i18n.js
.js
lib/jquery.js
.js
lib/logger.js
.js
lib/polyfill.js
.js
lib/protocol.js
.js
lib/shims/console.js
.js
lib/state-machine.js
.js
lib/tb-config-update.js
.js
lib/tb-message.js
.js
lib/update-constant.js
.js
lib/widget-config-update.js
lib/widget-messaging.js
.js
lib/window-position.js
.js
manifest.json
tb_ux/IFrameButton.js
.js
tb_ux/SimpleButton.js
.js
tb_ux/chrome-options.js
.js
tb_ux/ieCS.js
.js
tb_ux/init-toolbar.js
.js
tb_ux/rebuttal.js
.js
tb_ux/reel.js
.js
tb_ux/searchbox.js
.js
tb_ux/shimIE.js
.js
tb_ux/toolbar.js
.js
widgets/options/images/button-blue-1x20.png
.png
widgets/options/images/button-grey-1x26.png
.png
widgets/options/images/button.png
.png
widgets/options/images/icons.png
.png
widgets/options/images/lightblue-1x43.png
.png
widgets/options/options.css
widgets/options/options.html
.html
widgets/options/options.js
.js
widgets/rebuttal/images/warning.png
.png
widgets/rebuttal/rebuttal.css
widgets/rebuttal/rebuttal.html
.html .js polyglot
widgets/rebuttal/rebuttal.js
.js
widgets/search-suggestion/search-suggestion.css
widgets/search-suggestion/search-suggestion.html
.html
widgets/search-suggestion/search-suggestion.js
.js
widgets/templates/css/images/footer_gradient.png
.png
widgets/templates/css/images/footer_shadow.png
.png
widgets/templates/css/images/image_placeholder.png
.png
widgets/templates/css/images/item-bg.png
.png
widgets/templates/css/menu.css
widgets/templates/feed.html
.html
widgets/templates/js/api.js
.js
widgets/templates/js/feed.js
.js
widgets/templates/js/menu.js
.js
widgets/templates/menu.html
.html
program files/AskPartnerNetwork/ChromeUtils/APNNativeMsgHost.exe
.exe windows:5 windows x86 arch:x86

2b57af0c917c34fcca63cbb5f50af55a

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

79:e5:86:f8:13:ef:88:52:20:00:a7:8a:36:dc:2b:f3:fd:ae:95:e7
Signer

Actual PE Digest

79:e5:86:f8:13:ef:88:52:20:00:a7:8a:36:dc:2b:f3:fd:ae:95:e7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\ANH_SRC\Release\APNNativeMsgHost.pdb

Imports

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

kernel32

GetModuleHandleW
WriteFile
OpenProcess
WideCharToMultiByte
LoadLibraryW
Sleep
SizeofResource
FormatMessageW
ReadFile
MultiByteToWideChar
lstrlenW
RaiseException
GetStdHandle
GetLastError
GetProcAddress
Process32FirstW
LocalAlloc
LockResource
GetLogicalDriveStringsW
Process32NextW
lstrcmpiW
CreateToolhelp32Snapshot
LocalSize
CloseHandle
GetCurrentProcessId
LocalFree
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
LoadResource
FreeLibrary
FindResourceW
FindResourceExW
WriteConsoleW
CreateFileW
QueryDosDeviceW
InitializeCriticalSectionAndSpinCount
GetStringTypeW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
RtlUnwind
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
IsProcessorFeaturePresent
HeapCreate
ExitProcess
GetModuleFileNameW
LCMapStringW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType

user32

GetWindowRect
IsWindowEnabled
EnumWindows
GetForegroundWindow
GetWindowLongW
GetDesktopWindow
IsWindowVisible
SendMessageW
GetWindowThreadProcessId
GetWindow

advapi32

RegCloseKey
RegOpenKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW

shell32

ShellExecuteW

ole32

CoTaskMemAlloc
CoTaskMemFree

Sections

.text
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/ChromeUtils/com.apn.native_messaging_host_aaaamkngpohceidkefhicjjcedfcidai.json
program files/AskPartnerNetwork/Toolbar/BrowserHost.dll
.dll regsvr32 windows:6 windows x86 arch:x86

1f97472c6b5c25086597a0293d7cbb47

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

21:ee:ca:47:e7:22:c0:80:19:f4:4b:22:9e:f9:ee:9d:07:28:5a:1e
Signer

Actual PE Digest

21:ee:ca:47:e7:22:c0:80:19:f4:4b:22:9e:f9:ee:9d:07:28:5a:1e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\BrowserHost.pdb

Imports

kernel32

GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
lstrcmpiW
FindResourceW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
VerSetConditionMask
CompareFileTime
OutputDebugStringW
CloseHandle
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSection
SetEvent
CreateEventW
GetProcessTimes
GetCurrentProcessId
GetExitCodeProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ProcessIdToSessionId
OpenProcess
GetModuleFileNameW
LockResource
LoadLibraryW
VerifyVersionInfoW
FlushFileBuffers
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetStringTypeW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WriteFile
FreeLibrary
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
DecodePointer
FindResourceExW
EncodePointer
GetStdHandle
CreateFileW
GetStartupInfoW
TerminateProcess
GetCurrentProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
GetModuleHandleExW
ExitProcess
GetCommandLineA
ExitThread
GetCurrentThreadId
CreateThread
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwind
IsProcessorFeaturePresent
IsDebuggerPresent

user32

RegisterWindowMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
SendMessageTimeoutW
PostMessageW
IsWindow
ShowWindow
GetWindowPlacement
IsWindowVisible
CharNextW
SendMessageW
UnhookWinEvent
SetWinEventHook
GetWindowThreadProcessId
GetClassNameW
EnumWindows
FindWindowW
EnumChildWindows
GetWindowTextW
SetForegroundWindow
GetForegroundWindow
KillTimer
SetTimer
MsgWaitForMultipleObjects
IsIconic

advapi32

RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteW

ole32

CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoTaskMemAlloc
CoInitialize
OleInitialize
OleUninitialize
StringFromGUID2
CoGetInterfaceAndReleaseStream
CoCreateInstance

oleaut32

LoadTypeLi
RegisterTypeLi
UnRegisterTypeLi
VariantInit
SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadRegTypeLi
VariantCopy
VariantClear

shlwapi

PathStripPathW

psapi

GetModuleFileNameExW

wtsapi32

WTSEnumerateProcessesW
WTSFreeMemory

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 129KB - Virtual size: 129KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/DeskBar.exe
.exe windows:6 windows x86 arch:x86

39910aed83ee1ab74e87a2ffef061145

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

86:08:dc:d7:3f:37:9c:d4:cd:9d:44:8c:fa:52:37:65:2c:15:85:88
Signer

Actual PE Digest

86:08:dc:d7:3f:37:9c:d4:cd:9d:44:8c:fa:52:37:65:2c:15:85:88

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerifyVersionInfoW
FileTimeToLocalFileTime
OutputDebugStringW
DecodePointer
CloseHandle
SetLastError
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
CreateMutexW
CreateEventW
GetProcessTimes
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
FlushInstructionCache
OpenProcess
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
WaitForMultipleObjects
lstrcmpiW
LoadLibraryW
FindResourceW
FileTimeToSystemTime
MultiByteToWideChar
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
FlushFileBuffers
WriteConsoleW
SetStdHandle
FormatMessageW
LCMapStringW
CompareStringW
GetThreadPriority
GetStringTypeW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
RtlUnwind
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetFileType
GetTimeZoneInformation
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
Sleep
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WriteFile
GetStdHandle
WideCharToMultiByte
SetEnvironmentVariableA
GetModuleHandleExW
ExitProcess
GetCommandLineW
GetSystemTimeAsFileTime
LocalFree
GetTickCount
SetThreadPriority
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
ExitThread
CreateThread
EncodePointer
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
VerSetConditionMask

user32

IsWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
RegisterWindowMessageW
SendMessageW
UnregisterClassW
LoadCursorW
SetWindowLongW
PtInRect
IsRectEmpty
GetCursorPos
GetClientRect
EndPaint
BeginPaint
CharNextW
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
PeekMessageW
DispatchMessageW
TranslateMessage
GetMessageW
GetWindow
GetDesktopWindow
GetWindowLongW
OffsetRect
CopyRect
SetRectEmpty
MessageBoxW
GetWindowRect
RedrawWindow
SetWindowRgn
SetForegroundWindow
GetForegroundWindow
UpdateWindow
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
SetRect

gdi32

CreateRectRgn
ExtTextOutW

advapi32

RegEnumKeyExW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
RegOpenKeyExW
InitializeSecurityDescriptor
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
SetSecurityDescriptorDacl

shell32

SHAppBarMessage

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantClear
VarUI4FromStr
SystemTimeToVariantTime
SysFreeString
SysAllocString
VariantTimeToSystemTime

comctl32

InitCommonControlsEx

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/SO.dll
.dll windows:5 windows x86 arch:x86

24691ef5f67628ef43780b76418c0f75

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

6e:93:2e:62:9d:75:fb:dc:8b:cd:83:99:fd:22:52:03:d3:09:3d:58
Signer

Actual PE Digest

6e:93:2e:62:9d:75:fb:dc:8b:cd:83:99:fd:22:52:03:d3:09:3d:58

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\so.pdb

Imports

kernel32

GetFileSize
lstrlenA
GlobalAlloc
Sleep
MulDiv
GlobalUnlock
GlobalLock
InterlockedExchange
GlobalFree
GlobalHandle
CreateEventW
GetCurrentProcessId
lstrcmpiW
SetEvent
CreateProcessW
WaitForMultipleObjects
SetFileAttributesW
GetFileAttributesW
DeleteFileW
SetFilePointer
GetVersionExW
LocalFree
LocalAlloc
WriteFile
SetEndOfFile
SetEnvironmentVariableA
CompareStringW
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetConsoleMode
GetConsoleCP
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
ReadFile
GetFileType
SetHandleCount
LCMapStringW
RtlUnwind
GetTimeZoneInformation
ExitProcess
GetStringTypeW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetStdHandle
HeapCreate
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
ResumeThread
CreateThread
ExitThread
VirtualQuery
GetSystemInfo
VirtualProtect
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
CreateFileW
WideCharToMultiByte
WaitForSingleObject
CloseHandle
ReleaseMutex
CreateMutexW
GetModuleHandleW
LoadLibraryW
GetProcAddress
FreeLibrary
FindFirstFileW
FindNextFileW
FindClose
SetLastError
OutputDebugStringW
GetCurrentThreadId
lstrcmpW
MultiByteToWideChar
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
InterlockedIncrement
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
lstrlenW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetStartupInfoW
HeapDestroy

user32

DestroyWindow
RegisterWindowMessageW
CallWindowProcW
GetWindowLongW
CreateWindowExW
RegisterClassExW
DefWindowProcW
LoadCursorW
SetWindowRgn
PostMessageW
ShowWindow
GetMonitorInfoW
MonitorFromWindow
SendMessageW
GetKeyState
GetSysColor
GetWindow
GetParent
MoveWindow
GetWindowRect
IsWindow
SetTimer
KillTimer
SetLayeredWindowAttributes
CharNextW
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
RedrawWindow
SetCapture
IsChild
GetDlgItem
GetClassNameW
ReleaseCapture
UnregisterClassA
FillRect
EndPaint
BeginPaint
GetDesktopWindow
DestroyAcceleratorTable
GetFocus
SetFocus
CreateAcceleratorTableW
SetWindowContextHelpId
MapDialogRect
GetClassInfoExW
SetWindowLongW
LoadStringW
EnableWindow
MapWindowPoints
GetForegroundWindow
CreateDialogIndirectParamW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
FrameRect
EndDialog

gdi32

CreateDIBSection
SetDIBColorTable
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
CreateRectRgn
GetDIBits

advapi32

GetNamedSecurityInfoW
GetAclInformation
ConvertStringSidToSidW
GetLengthSid
InitializeAcl
GetAce
AddAce
EqualSid
CopySid
SetNamedSecurityInfoW
FreeSid
RegQueryInfoKeyW
RegEnumValueW
RegCreateKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathAndSubDirW

ole32

CoTaskMemAlloc
CoInitializeEx
CoUninitialize
ProgIDFromCLSID
OleUninitialize
OleInitialize
CreateStreamOnHGlobal
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
CoCreateInstance
CoTaskMemFree

oleaut32

SystemTimeToVariantTime
VariantTimeToSystemTime
CreateErrorInfo
SetErrorInfo
OleCreateFontIndirect
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayGetVartype
SysFreeString
VariantClear
VariantCopy
SysAllocStringLen
SysStringLen
LoadRegTypeLi
LoadTypeLi
VariantInit
SysAllocString
DispCallFunc
SysAllocStringByteLen
SysStringByteLen
VarBstrCmp
VariantChangeType
VarBstrCat

wininet

InternetOpenUrlW
InternetSetOptionW
InternetSetStatusCallbackW
HttpQueryInfoW
PrivacySetZonePreferenceW
InternetCrackUrlW
InternetReadFile
InternetCloseHandle
InternetOpenW
InternetGetConnectedState
PrivacyGetZonePreferenceW

shlwapi

StrCmpW
StrCmpNW
UrlCreateFromPathW

urlmon

URLDownloadToFileW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipAlloc
GdipDeleteGraphics
GdiplusShutdown
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdiplusStartup
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage
GdipFree
GdipGetImagePalette

msimg32

AlphaBlend

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 356KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 139KB - Virtual size: 138KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/ServiceLocator.exe
.exe windows:5 windows x86 arch:x86

89deb219dcfb1b48f3237ccde8a4ff81

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:6f:41:e7:24:e2:37:41:3b:ab:18:42:b7:14:08:e5:86:f1:86:3f
Signer

Actual PE Digest

53:6f:41:e7:24:e2:37:41:3b:ab:18:42:b7:14:08:e5:86:f1:86:3f

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\ServiceLocator.pdb

Imports

kernel32

GetProcAddress
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
GetModuleFileNameW
Sleep
CreateThread
CreateEventW
GetCurrentThreadId
SetEvent
FreeLibrary
MultiByteToWideChar
DeleteCriticalSection
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
LockResource
FindResourceExW
GetStringTypeW
LCMapStringW
WideCharToMultiByte
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetLastError
LeaveCriticalSection
EnterCriticalSection
RaiseException
WaitForSingleObject
CloseHandle
SizeofResource
lstrlenW
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsProcessorFeaturePresent
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RtlUnwind
DecodePointer
EncodePointer
HeapSetInformation
GetStartupInfoW
ExitProcess
WriteFile
GetStdHandle
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess

user32

TranslateMessage
GetMessageW
PostThreadMessageW
CharNextW
CharUpperW
DispatchMessageW

advapi32

RegQueryInfoKeyW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegEnumKeyExW

ole32

CoRevokeClassObject
CoTaskMemRealloc
CoRegisterClassObject
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
CoResumeClassObjects
CoAddRefServerProcess
CoTaskMemAlloc
CoReleaseServerProcess
StringFromGUID2

oleaut32

VariantClear
VariantInit
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Toolbar.exe
.exe windows:5 windows x86 arch:x86

bff34ce957691caf859245f054ede349

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

fe:99:47:0a:85:3d:45:1c:8e:ac:98:44:9c:72:1d:8d:be:51:8e:67
Signer

Actual PE Digest

fe:99:47:0a:85:3d:45:1c:8e:ac:98:44:9c:72:1d:8d:be:51:8e:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\Toolbarcore.pdb

Imports

kernel32

DeleteFileW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
CreateEventW
ResetEvent
GetCurrentProcessId
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
LoadLibraryExW
WaitForMultipleObjects
WaitForSingleObject
Sleep
CreateThread
GetCommandLineW
SetErrorMode
InterlockedPopEntrySList
VirtualFree
InterlockedPushEntrySList
InterlockedCompareExchange
GetProcessHeap
SetEndOfFile
GetStringTypeW
WriteFile
WriteConsoleW
SetStdHandle
CreateFileA
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapSize
HeapReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
ExitProcess
HeapDestroy
HeapCreate
GetFileType
GetStdHandle
SetHandleCount
GetConsoleMode
GetConsoleCP
IsProcessorFeaturePresent
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
ReadFile
WideCharToMultiByte
CloseHandle
GetModuleHandleW
GetProcAddress
CreateFileW
GetFileSize
SetFilePointer
LocalFree
FlushFileBuffers
SetLastError
RaiseException
GlobalAlloc
GlobalLock
GlobalUnlock
GetModuleFileNameW
MulDiv
lstrcmpW
EnterCriticalSection
GetLastError
lstrlenW
lstrlenA
GetCurrentProcess
FlushInstructionCache
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
MultiByteToWideChar
lstrcmpiW
HeapSetInformation
EncodePointer
DecodePointer
ExitThread
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
RtlUnwind
HeapAlloc
HeapFree
SetEvent
LeaveCriticalSection
GetTickCount

user32

IsWindow
SendMessageW
DefWindowProcW
PostMessageW
CallWindowProcW
GetKeyState
GetWindow
GetParent
GetSysColor
CharNextW
MoveWindow
SetWindowPos
GetClientRect
ClientToScreen
ScreenToClient
GetDC
DestroyWindow
CreateWindowExW
GetWindowLongW
SetWindowLongW
PostThreadMessageW
CharUpperW
UnregisterClassA
GetMessageW
DispatchMessageW
TranslateMessage
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
RegisterClassExW
LoadCursorW
GetClassInfoExW
SetFocus
GetFocus
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
IsChild
SetCapture
RedrawWindow
InvalidateRgn
InvalidateRect
ReleaseDC

gdi32

GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
DeleteDC
SelectObject
DeleteObject
GetStockObject

advapi32

RegOpenKeyExW
CryptVerifySignatureW
CryptReleaseContext
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegQueryInfoKeyW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CryptGetHashParam
RegSetValueExW
RegEnumKeyExW
RegCloseKey
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey

shell32

SHGetFolderPathAndSubDirW
ord165

ole32

StringFromGUID2
OleLockRunning
CoGetClassObject
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc
CreateStreamOnHGlobal
OleInitialize
CoTaskMemRealloc
OleUninitialize
CoReleaseServerProcess
CoAddRefServerProcess
CoRegisterClassObject
CoRevokeClassObject
CoUninitialize
CoInitialize
CoTaskMemFree

oleaut32

VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
OleCreateFontIndirect
VarBstrCmp
RegisterTypeLi
UnRegisterTypeLi
DispCallFunc
VariantCopy
SysStringLen
SysFreeString
VariantInit
VariantClear
SysAllocStringLen
SysAllocString
VarBstrCat

shlwapi

PathFileExistsW
UrlCreateFromPathW

urlmon

CoInternetSetFeatureEnabled

crypt32

CryptDecodeObjectEx
CryptImportPublicKeyInfo

Sections

.text
Size: 191KB - Virtual size: 190KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/ToolbarPS.dll
.dll regsvr32 windows:5 windows x86 arch:x86

535bb2ccc6052bcfc9df013593e51b6b

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bb:ed:70:00:96:4c:c7:38:99:c8:8f:f3:50:3f:5a:2c:cd:0c:09:20
Signer

Actual PE Digest

bb:ed:70:00:96:4c:c7:38:99:c8:8f:f3:50:3f:5a:2c:cd:0c:09:20

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DisableThreadLibraryCalls
HeapSize
GetStringTypeW
MultiByteToWideChar
LCMapStringW
RtlUnwind
GetModuleFileNameW
WriteFile
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
HeapReAlloc
HeapAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetCurrentThreadId
DecodePointer
GetCommandLineA
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetLastError
InterlockedDecrement
GetProcAddress
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent

rpcrt4

NdrOleAllocate
NdrOleFree
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
NdrStubForwardingFunction
NdrStubCall2
NdrDllUnregisterProxy
NdrDllRegisterProxy
NdrCStdStubBuffer2_Release
NdrDllCanUnloadNow
NdrDllGetClassObject
IUnknown_QueryInterface_Proxy

oleaut32

VARIANT_UserSize
VARIANT_UserMarshal
VARIANT_UserUnmarshal
VARIANT_UserFree
BSTR_UserSize
BSTR_UserMarshal
BSTR_UserUnmarshal
BSTR_UserFree

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
GetProxyDllInfo

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.orpc
Size: 512B - Virtual size: 254B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/TopSitesRT.exe
.exe windows:6 windows x86 arch:x86

3c8379274e30fdd3650f8788e981c62a

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2d:f8:50:84:a0:60:f0:8a:15:9a:a4:c2:b2:00:38:bd:92:7c:9c:fd
Signer

Actual PE Digest

2d:f8:50:84:a0:60:f0:8a:15:9a:a4:c2:b2:00:38:bd:92:7c:9c:fd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\TopSitesRT.pdb

Imports

kernel32

HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetFullPathNameW
GetFullPathNameA
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
SystemTimeToFileTime
QueryPerformanceCounter
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
LoadLibraryW
Sleep
FormatMessageW
GetFileAttributesA
LeaveCriticalSection
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
GetLastError
FindResourceExW
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
InitializeCriticalSectionEx
RaiseException
DecodePointer
FindFirstFileExW
FindNextFileW
FindClose
FileTimeToLocalFileTime
GetLocalTime
GetModuleHandleW
CopyFileW
FlushInstructionCache
GetCurrentProcess
lstrcmpiW
SetLastError
WriteConsoleW
SetStdHandle
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
CompareStringW
FindResourceW
LoadResource
LockResource
SizeofResource
GetProcAddress
WideCharToMultiByte
GetStringTypeW
RtlUnwind
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
IsDebuggerPresent
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
EncodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineW
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
SetEnvironmentVariableA

user32

LoadCursorW
UnregisterClassW
SetWindowLongW
GetWindowLongW
CreateWindowExW
DestroyWindow
SendMessageW
CallWindowProcW
RegisterClassExW
GetClassInfoExW
DefWindowProcW

advapi32

RegQueryInfoKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegEnumValueW

ole32

CoTaskMemFree
CoFileTimeNow
CoUninitialize
CoInitializeEx
CoTaskMemAlloc
CoCreateInstance

shlwapi

PathFileExistsW
PathRemoveFileSpecW

Sections

.text
Size: 612KB - Virtual size: 612KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/UpdateManager.exe
.exe windows:5 windows x86 arch:x86

2b57cf45989a5ba3a83f968ccec21019

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

20:3f:06:1a:9f:d7:1b:7d:57:7f:1a:05:85:a8:6e:42:7f:49:f2:b5
Signer

Actual PE Digest

20:3f:06:1a:9f:d7:1b:7d:57:7f:1a:05:85:a8:6e:42:7f:49:f2:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\UpdateManager.pdb

Imports

kernel32

LoadLibraryW
FreeLibrary
lstrcmpiW
GetExitCodeProcess
Sleep
CreateDirectoryW
LockResource
LoadResource
FindResourceW
FindResourceExW
WaitForSingleObject
SetEvent
CreateEventW
GetLastError
GetModuleHandleW
GetProcAddress
SizeofResource
CloseHandle
CreateFileW
WriteConsoleW
SetStdHandle
GetStringTypeW
LCMapStringW
FlushFileBuffers
MultiByteToWideChar
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
GetCommandLineW
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
WideCharToMultiByte
SetFilePointer
GetConsoleCP
GetConsoleMode

advapi32

RegQueryInfoKeyW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumValueW

shell32

ShellExecuteExW
SHGetFolderPathW

ole32

CoTaskMemFree
CoUninitialize
CoTaskMemAlloc
CoInitializeEx

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/TBNotifier.exe
.exe windows:5 windows x86 arch:x86

3cb383176d24f600ca1e8d4a104d4603

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:a1:37:62:5b:29:a0:07:c4:db:f0:c7:39:f3:66:bb:00:c2:79:d3
Signer

Actual PE Digest

bc:a1:37:62:5b:29:a0:07:c4:db:f0:c7:39:f3:66:bb:00:c2:79:d3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\TBNotifier.pdb

Imports

msi

ord70
ord195

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification
WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateProcessesW

kernel32

CreateEventW
ReleaseMutex
CreateMutexW
GetSystemTime
ResetEvent
WaitForMultipleObjects
LocalFree
GetCurrentProcessId
GetFileSize
ReadFile
FindClose
GetPrivateProfileStringW
GetTempPathW
GetTempFileNameW
CreateDirectoryW
DeleteFileW
FindFirstFileW
FindNextFileW
CopyFileW
ProcessIdToSessionId
GetUserDefaultUILanguage
CreateThread
GetFileTime
FileTimeToSystemTime
FormatMessageW
GetFileAttributesW
TerminateThread
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Thread32First
Thread32Next
GetWindowsDirectoryW
GetProcessTimes
CompareFileTime
MoveFileW
SetNamedPipeHandleState
OutputDebugStringW
WaitNamedPipeW
CreateTimerQueueTimer
DeleteTimerQueueTimer
LocalAlloc
lstrcmpA
DuplicateHandle
lstrcmpiW
LoadLibraryExW
GetSystemInfo
GetNativeSystemInfo
IsWow64Process
WritePrivateProfileStringW
LockFile
UnlockFile
SetFilePointer
GetLocalTime
OutputDebugStringA
DecodePointer
TzSpecificLocalTimeToSystemTime
CreateProcessW
SystemTimeToFileTime
lstrlenA
FindFirstChangeNotificationW
FindNextChangeNotification
GetLongPathNameW
ExpandEnvironmentStringsW
GetPrivateProfileSectionW
GetPrivateProfileSectionNamesW
FormatMessageA
CreateFileA
SetEnvironmentVariableA
SetEndOfFile
GetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
WriteConsoleW
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
SetEvent
QueryPerformanceCounter
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetFileType
GetTimeZoneInformation
GetStdHandle
GetOEMCP
GetACP
IsValidCodePage
AreFileApisANSI
GetModuleHandleExW
ExitProcess
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetCommandLineW
GetFullPathNameW
GetSystemTimeAsFileTime
VirtualQuery
VirtualProtect
ExitThread
RtlUnwind
EncodePointer
GetStringTypeW
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
IsDebuggerPresent
InterlockedDecrement
QueryDosDeviceW
DeleteFileA
GetTempPathA
GetVersionExA
LoadLibraryA
LockFileEx
GetFileAttributesA
LockResource
GetProcAddress
LoadLibraryW
GetLogicalDriveStringsW
GetProcessId
TerminateProcess
OpenProcess
FreeLibrary
WideCharToMultiByte
CreateFileW
WriteFile
GetSystemDefaultLangID
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
LoadResource
SizeofResource
GetModuleHandleW
FindResourceW
FindResourceExW
RaiseException
GetTickCount
lstrlenW
InterlockedIncrement
GetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
CloseHandle
InterlockedExchange
GlobalAlloc
GlobalLock
MultiByteToWideChar
GetVersionExW
GetModuleFileNameW
OpenMutexW
lstrcmpW
MulDiv
Sleep
InitializeCriticalSection
SetLastError
GetCurrentThreadId
GetCurrentProcess
FlushInstructionCache
GlobalFree
GlobalUnlock
GlobalHandle
GetEnvironmentStringsW

user32

CreateWindowExW
IsWindow
IsChild
DestroyWindow
ShowWindow
SetLayeredWindowAttributes
MoveWindow
SetWindowPos
DispatchMessageW
TranslateMessage
LoadStringW
GetMessageW
MessageBoxW
TranslateAcceleratorW
LoadAcceleratorsW
GetClassInfoExW
WindowFromPoint
SystemParametersInfoW
IsDlgButtonChecked
CheckDlgButton
AnimateWindow
IsWindowEnabled
IsRectEmpty
SetRectEmpty
PostThreadMessageW
SetRect
IsDialogMessageW
CallNextHookEx
SetWindowsHookExW
GetActiveWindow
MsgWaitForMultipleObjects
RegisterClassExW
CallWindowProcW
DefWindowProcW
PostMessageW
DialogBoxIndirectParamW
SendMessageW
RegisterWindowMessageW
UnregisterClassW
GetSysColorBrush
PeekMessageW
FindWindowW
GetForegroundWindow
keybd_event
GetAsyncKeyState
SendMessageTimeoutW
GetWindowThreadProcessId
EnumThreadWindows
EnumWindows
SetForegroundWindow
SetWinEventHook
UnhookWinEvent
MapDialogRect
DrawIconEx
IsWindowVisible
CreateDialogIndirectParamW
EndDialog
GetDlgItem
SendDlgItemMessageW
CharNextW
SetFocus
GetFocus
SetCapture
ReleaseCapture
EnableWindow
CreateAcceleratorTableW
DestroyAcceleratorTable
DrawTextW
UpdateWindow
GetDC
ReleaseDC
BeginPaint
EndPaint
InvalidateRect
InvalidateRgn
RedrawWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
SetWindowContextHelpId
ClientToScreen
ScreenToClient
SetActiveWindow
SetWindowRgn
BringWindowToTop
LoadImageW
LoadCursorW
PostQuitMessage
KillTimer
SetTimer
SetDlgItemTextW
EnumChildWindows
GetWindow
GetClassNameW
GetParent
GetDesktopWindow
SetWindowLongW
GetWindowLongW
FillRect
GetSysColor
GetCursorPos
PtInRect

gdi32

SetBkMode
SelectObject
GetTextExtentPoint32W
GetStockObject
GetDeviceCaps
SetTextColor
CreateSolidBrush
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteDC
GetTextMetricsW
CreateDIBSection
GetObjectW
TextOutW
CreatePen
CreatePolygonRgn
StretchBlt
DeleteObject
GetTextExtentPointW
Rectangle
SetDIBColorTable

advapi32

CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegNotifyChangeKeyValue
RegFlushKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CheckTokenMembership
FreeSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
RegDeleteValueW
RegEnumKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteW
SHAppBarMessage
SHGetFolderPathAndSubDirW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW

ole32

OleInitialize
StringFromGUID2
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoGetClassObject
CoUninitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid
CoInitializeEx
CoTaskMemRealloc
CoAddRefServerProcess
CoReleaseServerProcess
OleLockRunning
CoInitialize
CreateStreamOnHGlobal

oleaut32

SafeArrayUnaccessData
VariantChangeType
SystemTimeToVariantTime
VariantTimeToSystemTime
VariantCopy
VarCmp
SysAllocStringByteLen
SysStringByteLen
SafeArrayAccessData
VarDateFromStr
VarBstrCmp
SafeArrayCreate
SafeArrayDestroy
SafeArrayCopy
SafeArrayGetVartype
VarUI4FromStr
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
VariantClear
VariantInit
SysStringLen
SysAllocStringLen
VarUdateFromDate
SysAllocString
SysFreeString

shlwapi

PathFindFileNameW
StrStrIW
UrlCreateFromPathW
PathFileExistsW
PathRemoveFileSpecW

psapi

GetModuleFileNameExW
GetProcessImageFileNameW

crypt32

CertFreeCertificateContext
CertCloseStore
CryptMsgClose
CryptDecodeObject
CryptQueryObject
CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CryptBinaryToStringA

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

gdiplus

GdipSetTextRenderingHint
GdipCreateFromHDC
GdipCreateSolidFill
GdipDeleteBrush
GdipFillRectangleI
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipCreateFontFromDC
GdipDeleteFont
GdipDrawString
GdipMeasureString

msimg32

TransparentBlt
AlphaBlend

wintrust

WinVerifyTrust

oleacc

WindowFromAccessibleObject
AccessibleChildren
AccessibleObjectFromEvent
AccessibleObjectFromWindow

wininet

HttpAddRequestHeadersA
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetReadFile
InternetConnectW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetGetConnectedState
InternetSetOptionW
HttpSendRequestA

comctl32

ord17

ws2_32

freeaddrinfo
getaddrinfo
WSACleanup
WSAStartup
socket
setsockopt
send
recv
ntohs
listen
getsockname
closesocket
bind
accept

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 48KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/tbnhlpr.exe
.exe windows:5 windows x86 arch:x86

45b888999868de5172cedef29529e4d5

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

8a:e9:9e:8d:1b:dd:aa:f1:7a:27:3c:7a:03:9d:28:58:ef:50:bb:02
Signer

Actual PE Digest

8a:e9:9e:8d:1b:dd:aa:f1:7a:27:3c:7a:03:9d:28:58:ef:50:bb:02

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\tbnhlpr.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
GetProcAddress
OutputDebugStringA
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
GetModuleHandleW
CreateFileW
ReadConsoleW
HeapFree
HeapAlloc
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetStdHandle
LoadLibraryExW
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
MultiByteToWideChar
GetStringTypeW
GetCommandLineW
RtlUnwind
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize

Sections

.text
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/tbnhlpr_x64.exe
.exe windows:5 windows x64 arch:x64

845c829a257701c426ef7aeede2ceae9

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5a:5c:25:a5:35:2e:b2:fe:ff:a7:7d:e4:a8:2c:cd:6a:36:fc:15:d9
Signer

Actual PE Digest

5a:5c:25:a5:35:2e:b2:fe:ff:a7:7d:e4:a8:2c:cd:6a:36:fc:15:d9

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\DEFENSE_SRC\APNU\Release\tbnhlpr_x64.pdb

Imports

kernel32

InitializeCriticalSectionAndSpinCount
HeapDestroy
RaiseException
GetLastError
HeapSize
DecodePointer
DeleteCriticalSection
GetProcAddress
OutputDebugStringA
GetProcessHeap
GetCurrentProcessId
GetCurrentThreadId
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLocalTime
GetModuleHandleW
CreateFileW
ReadConsoleW
HeapFree
HeapAlloc
WideCharToMultiByte
HeapReAlloc
WriteConsoleW
SetStdHandle
LoadLibraryExW
SetFilePointerEx
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
EncodePointer
MultiByteToWideChar
GetStringTypeW
GetCommandLineW
RtlPcToFileHeader
RtlLookupFunctionEntry
RtlUnwindEx
GetCPInfo
IsProcessorFeaturePresent
RtlCaptureContext
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
Sleep
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ExitProcess
GetModuleHandleExW
IsValidCodePage
GetACP
GetOEMCP
GetStdHandle
GetFileType
GetModuleFileNameW
WriteFile
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile

advapi32

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

ole32

CoInitializeEx
CoUninitialize

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/Updater/{PartnerID}/config.xml
program files/AskPartnerNetwork/Toolbar/apnmcp.exe
.exe windows:5 windows x86 arch:x86

92217c46031e25639ce949ff082b29f3

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f5:e1:3f:29:3e:e1:1b:a7:75:01:31:fa:8e:f2:23:3f:40:56:ea:3e
Signer

Actual PE Digest

f5:e1:3f:29:3e:e1:1b:a7:75:01:31:fa:8e:f2:23:3f:40:56:ea:3e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\apnmcp.pdb

Imports

psapi

GetModuleFileNameExW

kernel32

FreeLibrary
LoadLibraryW
OutputDebugStringW
GetCurrentProcessId
GetLocalTime
lstrcmpA
WTSGetActiveConsoleSessionId
WriteFile
ReadFile
CreateNamedPipeW
ConnectNamedPipe
DisconnectNamedPipe
GetOverlappedResult
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
GetStringTypeW
GetConsoleMode
GetConsoleCP
CreateFileW
lstrcatW
FindFirstFileW
lstrcmpW
FindNextFileW
FindClose
WaitForSingleObject
SetEvent
GetSystemTime
lstrcpynW
CreateToolhelp32Snapshot
Process32FirstW
ProcessIdToSessionId
Process32NextW
OpenProcess
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
ResetEvent
GetModuleFileNameW
lstrcpyW
MultiByteToWideChar
lstrcmpiW
CloseHandle
CreateEventW
LocalAlloc
LocalFree
GetCurrentThreadId
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
CompareStringW
SetEnvironmentVariableA
SetFilePointer
GetTickCount
QueryPerformanceCounter
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapCreate
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
GetTimeZoneInformation
WideCharToMultiByte
GetStdHandle
SetLastError
InterlockedIncrement
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
HeapSetInformation
GetSystemTimeAsFileTime
ExitThread
EncodePointer
DecodePointer
RtlUnwind
GetProcessHeap
HeapSize
Sleep
InterlockedDecrement
GetCommandLineW
CreateThread
SetThreadPriority
WaitForMultipleObjects
FindCloseChangeNotification
lstrlenW
FindFirstChangeNotificationW
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
EnterCriticalSection
LeaveCriticalSection

user32

TranslateMessage
DispatchMessageW
PostThreadMessageW
GetMessageW
CharNextW
LoadStringW
MessageBoxW
KillTimer
RegisterWindowMessageW
SetTimer
CharUpperW

advapi32

RegEnumValueW
LookupPrivilegeValueW
SetTokenInformation
AdjustTokenPrivileges
RegQueryInfoKeyW
RegEnumKeyExW
GetTokenInformation
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
ControlService
DeleteService
CreateServiceW
OpenProcessToken
DuplicateTokenEx
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
CreateProcessAsUserW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
QueryServiceConfigW
ChangeServiceConfigW
ChangeServiceConfig2W
CreateWellKnownSid
SetEntriesInAclW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
GetAclInformation
GetAce
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource

ole32

CoCreateInstance
CoAddRefServerProcess
CoTaskMemAlloc
CoUninitialize
CoInitializeEx
CoReleaseServerProcess
CoTaskMemFree
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType

shlwapi

SHGetValueW
PathAddBackslashW
PathQuoteSpacesW
SHSetValueW
PathFindFileNameW

winhttp

WinHttpCrackUrl
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpen
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect

wtsapi32

WTSEnumerateSessionsW
WTSFreeMemory

userenv

UnloadUserProfile
CreateEnvironmentBlock
DestroyEnvironmentBlock

crypt32

CertCloseStore
CryptMsgClose
CryptDecodeObject
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertFreeCertificateContext

wintrust

WinVerifyTrust

msi

ord195

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/searchhook.dll
.dll regsvr32 windows:5 windows x86 arch:x86

d315beb5b6d9bf1e814e0f786dfaa448

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f2:a3:c2:2c:ce:be:9b:7f:65:a7:84:91:ff:94:a9:3b:9a:48:ae:f5
Signer

Actual PE Digest

f2:a3:c2:2c:ce:be:9b:7f:65:a7:84:91:ff:94:a9:3b:9a:48:ae:f5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\searchhook.pdb

Imports

kernel32

EnterCriticalSection
LeaveCriticalSection
GetProcAddress
GetModuleHandleW
lstrlenW
GetModuleFileNameW
SetThreadLocale
GetThreadLocale
InterlockedDecrement
LockResource
LoadResource
FindResourceW
FindResourceExW
WideCharToMultiByte
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
SizeofResource
RaiseException
GetStringTypeW
MultiByteToWideChar
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
LoadLibraryW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
EncodePointer
DecodePointer
RtlUnwind
GetCurrentThreadId
GetCommandLineA
Sleep
ExitProcess
HeapCreate
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
WriteFile
GetStdHandle
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
IsProcessorFeaturePresent
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter

user32

CharNextW

advapi32

RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW

ole32

StringFromGUID2
CoCreateInstance

oleaut32

SysFreeString
SysStringLen
SysAllocString
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi

ws2_32

freeaddrinfo
getaddrinfo

wininet

InternetCrackUrlW
InternetCanonicalizeUrlW

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/toolbar.dll
.dll regsvr32 windows:5 windows x86 arch:x86

26da0019c4be13aff5cbbbde96e0cdc1

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a4:6d:e2:0e:98:19:69:6f:a0:8b:b3:25:61:57:d4:33:35:7e:89:85
Signer

Actual PE Digest

a4:6d:e2:0e:98:19:69:6f:a0:8b:b3:25:61:57:d4:33:35:7e:89:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\toolbar.pdb

Imports

kernel32

LocalAlloc
LocalFree
LoadLibraryW
lstrcmpiW
Sleep
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
WaitForSingleObject
ResumeThread
lstrcmpA
MoveFileW
GetTempFileNameW
GetTempPathW
MulDiv
CreateFileW
MultiByteToWideChar
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
GetSystemTimeAsFileTime
VirtualQuery
GetSystemInfo
VirtualProtect
DecodePointer
EncodePointer
RtlUnwind
CreateThread
ExitThread
HeapSize
HeapReAlloc
HeapDestroy
InterlockedPopEntrySList
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
lstrcmpW
GetProcessHeap
HeapFree
InterlockedPushEntrySList
InterlockedCompareExchange
HeapCreate
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetCPInfo
GetACP
GetOEMCP
GetTickCount
FreeLibrary
GetVersionExW
InterlockedDecrement
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalFindAtomW
WaitForMultipleObjects
GetLastError
ResetEvent
GetModuleFileNameW
InterlockedExchange
lstrlenW
SetLastError
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
CloseHandle
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
IsValidCodePage
WriteFile
GetStdHandle
FlushFileBuffers
WriteConsoleW
SetStdHandle
LCMapStringW
SetHandleCount
GetFileType
GetStartupInfoW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
SetFilePointer
GetConsoleCP
GetConsoleMode
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetEvent
CreateEventW
HeapAlloc
GetStringTypeW
TerminateProcess

user32

GetDesktopWindow
IsIconic
SetWindowTextW
InvalidateRect
GetClientRect
PeekMessageW
TranslateMessage
DispatchMessageW
UnregisterClassA
UpdateWindow
PtInRect
SendMessageW
GetCursorPos
WindowFromPoint
ScreenToClient
GetParent
GetClassNameW
GetAncestor
FindWindowExW
RegisterWindowMessageW
CreateWindowExW
CallWindowProcW
GetWindowLongW
RegisterClassExW
DefWindowProcW
IsWindow
GetWindowRect
GetDC
ReleaseDC
DestroyWindow
LoadCursorW
GetClassInfoExW
PostMessageW
SetWindowLongW
ShowWindow

gdi32

CreateFontW
SetBkMode
GetStockObject
CreateDIBSection
CreateCompatibleBitmap
BitBlt
GetPixel
DeleteObject
GetObjectW
SelectObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps

advapi32

RegCloseKey
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegQueryInfoKeyW
RegOpenKeyExW

shell32

SHGetFolderPathAndSubDirW
ShellExecuteW

ole32

CLSIDFromString
CreateStreamOnHGlobal
CoLockObjectExternal
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
StringFromGUID2

oleaut32

SysFreeString
VariantInit
LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear

shlwapi

PathFindExtensionW
UrlCreateFromPathW

crypt32

CryptDecodeObject
CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptQueryObject

wintrust

WinVerifyTrust

gdiplus

GdipDrawImageRectI
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipLoadImageFromStreamICM
GdipDeleteGraphics
GdipCloneImage
GdiplusStartup
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipAlloc
GdipFree
GdiplusShutdown
GdipGetImageWidth

uxtheme

DrawThemeParentBackground
IsThemeActive

Exports

Exports

DllCanUnloadNow
DllCanUnloadNowCRX
DllCanUnloadNowTSB
DllGetClassObject
DllGetClassObjectCRX
DllGetClassObjectTSB
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 134KB - Virtual size: 134KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/toolbar_x64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

cb1ad7486f4da2a8b4c9d769f169188f

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

94:24:f3:1b:3d:b5:07:ef:b4:9f:2f:07:b7:18:f1:84:c8:e3:96:15
Signer

Actual PE Digest

94:24:f3:1b:3d:b5:07:ef:b4:9f:2f:07:b7:18:f1:84:c8:e3:96:15

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\x64\Release\toolbar_x64.pdb

Imports

kernel32

lstrcmpiW
Sleep
DeleteFileW
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
WaitForSingleObject
ResumeThread
lstrcmpA
MoveFileW
GetTempFileNameW
GetTempPathW
MulDiv
CreateFileW
MultiByteToWideChar
FlushFileBuffers
WriteConsoleW
SetStdHandle
GetStringTypeW
LoadLibraryW
GetConsoleMode
GetConsoleCP
SetFilePointer
QueryPerformanceCounter
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetModuleFileNameA
GetStartupInfoW
GetFileType
SetHandleCount
lstrlenW
GetStdHandle
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
ExitProcess
FlsAlloc
FlsFree
FlsGetValue
HeapCreate
LocalFree
LocalAlloc
lstrcmpW
GetTickCount
FreeLibrary
GetVersionExW
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GlobalFindAtomW
WaitForMultipleObjects
GetLastError
ResetEvent
GetModuleFileNameW
SetLastError
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
FlushInstructionCache
CloseHandle
GetModuleHandleW
GetProcAddress
FindResourceExW
FindResourceW
GetVersion
HeapSetInformation
TerminateProcess
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCommandLineA
FlsSetValue
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetProcessHeap
VirtualFree
VirtualAlloc
InterlockedPopEntrySList
HeapDestroy
HeapReAlloc
HeapSize
RtlPcToFileHeader
ExitThread
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
LoadResource
LockResource
SizeofResource
LeaveCriticalSection
EnterCriticalSection
RaiseException
SetEvent
LCMapStringW
CreateEventW
VirtualProtect
DecodePointer
EncodePointer
RtlUnwindEx
RtlLookupFunctionEntry
CreateThread
InterlockedPushEntrySList

user32

CreateWindowExW
RegisterWindowMessageW
FindWindowExW
GetAncestor
GetClassNameW
GetParent
ScreenToClient
WindowFromPoint
GetCursorPos
SendMessageW
PtInRect
GetWindowLongPtrW
ShowWindow
DispatchMessageW
RegisterClassExW
PeekMessageW
GetClientRect
InvalidateRect
SetWindowTextW
IsIconic
GetDesktopWindow
DefWindowProcW
SetWindowLongPtrW
UpdateWindow
CallWindowProcW
PostMessageW
GetClassInfoExW
LoadCursorW
DestroyWindow
ReleaseDC
GetDC
GetWindowRect
TranslateMessage
UnregisterClassA
IsWindow

gdi32

CreateFontW
SetBkMode
GetStockObject
CreateDIBSection
CreateCompatibleBitmap
BitBlt
GetPixel
DeleteObject
GetObjectW
SelectObject
DeleteDC
CreateCompatibleDC
GetDeviceCaps

advapi32

RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
RegOpenKeyExW

shell32

ShellExecuteW
SHGetFolderPathAndSubDirW

ole32

CoTaskMemFree
CoLockObjectExternal
StringFromGUID2
CreateStreamOnHGlobal
CLSIDFromString
CoCreateInstance
CoTaskMemAlloc

oleaut32

LoadTypeLi
LoadRegTypeLi
DispCallFunc
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear
VariantInit
SysFreeString

shlwapi

UrlCreateFromPathW
PathFindExtensionW

crypt32

CertGetNameStringW
CryptMsgClose
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptMsgGetParam
CryptDecodeObject
CryptQueryObject

wintrust

WinVerifyTrust

gdiplus

GdipDisposeImage
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdiplusShutdown
GdipAlloc
GdipCloneImage
GdipDeleteGraphics
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdiplusStartup
GdipFree
GdipGetImageEncoders
GdipLoadImageFromStreamICM
GdipDrawImageRectI
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageSelectActiveFrame
GdipImageGetFrameCount

uxtheme

DrawThemeParentBackground
IsThemeActive

Exports

Exports

DllCanUnloadNow
DllCanUnloadNowCRX
DllCanUnloadNowTSB
DllGetClassObject
DllGetClassObjectCRX
DllGetClassObjectTSB
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 153KB - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 72KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/{PartnerID}/Passport.dll
.dll windows:5 windows x86 arch:x86

f5aea7b43d8246a57c78cdb8d98c2685

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ed:a0:11:c2:67:9a:9f:a8:05:00:25:5d:a8:46:bd:d1:d3:1c:fa:28
Signer

Actual PE Digest

ed:a0:11:c2:67:9a:9f:a8:05:00:25:5d:a8:46:bd:d1:d3:1c:fa:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\Release\Passport.pdb

Imports

kernel32

FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryW
GetModuleFileNameW
GetProcAddress
lstrcmpiW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1024B - Virtual size: 1022B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 874B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 226B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
program files/AskPartnerNetwork/Toolbar/{PartnerID}/Passport_x64.dll
.dll windows:5 windows x64 arch:x64

c7f3bf7296dc44c871edca9a01413923

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Not Before

31/12/2015, 00:00

Not After

09/07/2019, 18:40

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

03/12/2015, 00:00

Not After

27/05/2018, 23:59

Subject

CN=APN LLC,O=APN LLC,L=Oakland,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ec:af:d3:32:e7:d5:4b:95:75:aa:bb:16:e9:93:34:15:4d:21:93:5b
Signer

Actual PE Digest

ec:af:d3:32:e7:d5:4b:95:75:aa:bb:16:e9:93:34:15:4d:21:93:5b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Jenkins\workspace\TOOLBAR_PACKAGE\IE_CORE_SRC\x64\Release\Passport_x64.pdb

Imports

kernel32

FreeLibrary
HeapAlloc
HeapFree
GetProcessHeap
LoadLibraryW
GetModuleFileNameW
GetProcAddress
lstrcmpiW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

Exports

Exports

DllCanUnloadNow
DllGetClassObject

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2b57af0c917c34fcca63cbb5f50af55a

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

79:e5:86:f8:13:ef:88:52:20:00:a7:8a:36:dc:2b:f3:fd:ae:95:e7Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

psapi

kernel32

user32

advapi32

shell32

ole32

Sections

.text Size: 115KB - Virtual size: 114KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 5KB - Virtual size: 12KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 9KB - Virtual size: 8KB

1f97472c6b5c25086597a0293d7cbb47

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

21:ee:ca:47:e7:22:c0:80:19:f4:4b:22:9e:f9:ee:9d:07:28:5a:1eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

psapi

wtsapi32

Exports

Exports

Sections

.text Size: 129KB - Virtual size: 129KB

.rdata Size: 44KB - Virtual size: 44KB

.data Size: 10KB - Virtual size: 17KB

.rsrc Size: 6KB - Virtual size: 5KB

.reloc Size: 10KB - Virtual size: 10KB

39910aed83ee1ab74e87a2ffef061145

Code Sign

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0bCertificate

Extended Key Usages

Key Usages

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6bCertificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

86:08:dc:d7:3f:37:9c:d4:cd:9d:44:8c:fa:52:37:65:2c:15:85:88Signer

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

79:e5:86:f8:13:ef:88:52:20:00:a7:8a:36:dc:2b:f3:fd:ae:95:e7
Signer

.text
Size: 115KB - Virtual size: 114KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 5KB - Virtual size: 12KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 9KB - Virtual size: 8KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

21:ee:ca:47:e7:22:c0:80:19:f4:4b:22:9e:f9:ee:9d:07:28:5a:1e
Signer

.text
Size: 129KB - Virtual size: 129KB

.rdata
Size: 44KB - Virtual size: 44KB

.data
Size: 10KB - Virtual size: 17KB

.rsrc
Size: 6KB - Virtual size: 5KB

.reloc
Size: 10KB - Virtual size: 10KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

86:08:dc:d7:3f:37:9c:d4:cd:9d:44:8c:fa:52:37:65:2c:15:85:88
Signer

.text
Size: 108KB - Virtual size: 107KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 6KB - Virtual size: 14KB

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 7KB - Virtual size: 6KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

6e:93:2e:62:9d:75:fb:dc:8b:cd:83:99:fd:22:52:03:d3:09:3d:58
Signer

.text
Size: 356KB - Virtual size: 356KB

.rdata
Size: 98KB - Virtual size: 98KB

.data
Size: 43KB - Virtual size: 51KB

.rsrc
Size: 139KB - Virtual size: 138KB

.reloc
Size: 42KB - Virtual size: 42KB

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b
Certificate

76:a1:fc:71:ce:00:68:3a:2b:88:7a:2c:fa:2f:5d:6b
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

53:6f:41:e7:24:e2:37:41:3b:ab:18:42:b7:14:08:e5:86:f1:86:3f
Signer