DAMsetup[.]exe | Triage™

resource
DAMsetup.exe
unpack001/$PLUGINSDIR/Dialer.dll
unpack001/$PLUGINSDIR/DotNetChecker.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/StdUtils.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsisdl.dll
unpack001/$PLUGINSDIR/registry.dll
unpack001/$TEMP/setupc.exe
unpack001/DamFirefox/components/DamMz.dll
unpack001/DamFirefox/components2/DamMz.dll
unpack001/DamFirefox/components2/DamMz25.dll
unpack001/DamFirefox/components2/DamMz26.dll
unpack001/DamFirefox/components2/DamMz27.dll
unpack001/DamFirefox/components2/DamMz28.dll
unpack001/DamFirefox/components2/DamMz29.dll
unpack001/DamFirefox/components2/DamMz30.dll
unpack001/DamFirefox/components2/DamMz31.dll
unpack001/DamFirefox/components2/DamMz32.dll
unpack001/DamFirefox/components2/DamMz33.dll
unpack001/DamFirefox/components2/DamMz34.dll
unpack001/DamFirefox/components2/DamMz35.dll
unpack001/DamFirefox/components2/DamMz36.dll
unpack001/DamFirefox/components2/DamMz37.dll
unpack001/DamFirefox/components2/DamMz38.dll
unpack001/DamFirefox/components2/DamMz39.dll
unpack001/DamFirefox/components2/DamMz40.dll
unpack001/DamFirefox/components2/DamMz41.dll
unpack001/DamFirefox/components2/DamMz42p.dll
unpack001/DamFirefox/old/components/dammz.dll
unpack001/DamLinkHandler.dll
unpack001/DownloadAcceleratorManager.exe
unpack001/Interop.SHDocVw.dll
unpack006/$PLUGINSDIR/Dialer.dll
unpack006/$PLUGINSDIR/DotNetChecker.dll
unpack006/$PLUGINSDIR/InstallOptions.dll
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/UAC.dll
unpack006/$PLUGINSDIR/nsisdl.dll
unpack006/$PLUGINSDIR/registry.dll
unpack006/Interop.SHDocVw.dll
unpack001/uninstall.exe
unpack008/$PLUGINSDIR/KillProcDLL.dll
unpack008/$PLUGINSDIR/System.dll
unpack008/$PLUGINSDIR/UAC.dll
unpack008/$TEMP/setupc.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/WRCsetup.exe	nsis_installer_1
static1/unpack001/WRCsetup.exe	nsis_installer_2
static1/unpack001/uninstall.exe	nsis_installer_1
static1/unpack001/uninstall.exe	nsis_installer_2

DAMsetup.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 5443b1c3aa80091b7e0d86681892e0871a7f1954dfa5cfd33318bc597116dd52
MD5 c4f6847c160205eaaba5af06dc3d5873
SHA1 74c1c9a22e85305cb21ff22e68800f96daaa8464
SHA512 997687ab9f5b1507690ffb6d474d7f3cb81d4204e5e7face86c5d1fb54030d8c7c53ad16e533650b5a88abbdf6ab84e58dd8b7d3adb6d049aa244d08d1a950bc
SSDEEP 49152:YKVrCbIS6kXtqMsSOqzw9iDxivzrp/SLyB+Lgyl8WLpqIDXssjromawYuwD:YKVry6ItqqkUVivXpGLLVpq3sPomy
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/Dialer.dll

IMPHASH 1f1fddd20def884fc86e064d8f2333ae
SHA256 745acd94c78e5ea93268310977a83473825ad911bbea0a9ea3e4521170745adb
MD5 4c225c3da808e6c95b6699c5db8c636b
SHA1 a09dd7dabea628b9e7b38720e98ad6aa1a53d0bc
SHA512 a35f81a34bec708db98f28906741298994cdf07ca09ee48e76e0f4f84277203df8912be8fa5cd489e980d86115788ff3dac778b9b967a401109a4152ae895740
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DotNetChecker.dll

IMPHASH 5ad36eab05b8e2d08aa628c3ac87e927
SHA256 3f7bed61a1f5ad0c0a468363c4f2974c2674fd018ce2aabd40b5a16604c2d4cd
MD5 83b493e0bc0cf1105ce25d9bd5d1c2b9
SHA1 1813bcb2a4384bd2a134bec29bd978f0b5c4e1b4
SHA512 3aaccda41b5822d8eca0f8fb01c060151a1a19038c35905c937949491edc803ad7399f71ea7d56fded69394e4abb3f6266b3b3a8bcf644ef4bccb3406e3c2769
SSDEEP 12288:/s3lPW//U+/ViiIuuaOVs51bWMt1wbdKfK3s+TGsNlmH:/O+qsPWMt1wbuKcgNK
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

308460

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\sumitk\codebase\NsisDotNetChecker\plugin\Debug\DotNetChecker.pdb

kernel32

LoadLibraryExW LoadLibraryW GetProcAddress DecodePointer EncodePointer FlushFileBuffers FreeLibrary GetSystemInfo CloseHandle SetErrorMode GlobalFree lstrcpyW lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar IsDebuggerPresent RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleFileNameA GetModuleHandleExW ExitProcess HeapValidate GetCurrentThread GetACP GetStdHandle GetFileType WriteFile OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FindClose FindFirstFileExA FindFirstFileExW FindNextFileA FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetEnvironmentVariableW OutputDebugStringA GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapSize HeapReAlloc HeapQueryInformation GetStringTypeW SetStdHandle GetConsoleCP GetConsoleMode SetFilePointerEx CreateFileW

user32

GetSystemMetrics wsprintfW

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

Name

.textbss

Size

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

638KB

Virtual Size

637KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

144KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

260B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
MD5 8d5a5529462a9ba1ac068ee0502578c7
SHA1 875e651e302ce0bfc8893f341cf19171fee25ea5
SHA512 101da2c33f47bd85b8934318e0f0b72f820afc928a2a21e2c7823875e3a0e830f7c67f42b4c2f30596eaa073617790c89700c0d95b7949ec617e52800b61d462
SSDEEP 192:W4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjAK72dwF7dBOne:3n3T5KdHCMRD/R1cOnrjA+BO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/StdUtils.dll

IMPHASH ecbe1fbe5190eab5d326930114ad14a8
SHA256 59622532708a74464095e77e867168bb28e7c35d3d92b58469f19eada34e2f73
MD5 565644184c2d2d9eb07f6fa70b0f61c5
SHA1 ec9eca126c99dbca789651002bb2017d10eab0fc
SHA512 2e32c53d1f10789a3b604a34709e93dacfb693851e4befb96a0e69dd894f80e752510aab7bf437120be880e8b38253033f6dd283a9870b54b4b8ff13e993da01
SSDEEP 1536:fO3Dhu1Fggjb6GCDMTF7Rq9fVGLgCf466g4m38goHB+d:fONu1Fg26hDMTF7Rq9fMcW4U8p+d
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

59272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

??3@YAXPAX@Z isspace _msize setlocale iscntrl sscanf _beginthreadex time srand rand clock _getpid _splitpath strncpy strchr isgraph __getmainargs _strnicmp _stricmp calloc free _wcsicmp _snprintf swscanf abort ??2@YAPAXI@Z memset memcpy

shlwapi

ord176

crypt32

CryptProtectData CryptUnprotectData

kernel32

GlobalFree MultiByteToWideChar WideCharToMultiByte InterlockedExchange HeapValidate InterlockedDecrement InterlockedIncrement GetSystemTime OutputDebugStringA DeleteCriticalSection InitializeCriticalSection SystemTimeToFileTime TerminateThread WaitForSingleObject LocalFree GetFullPathNameA GetVersion GetCommandLineA GetVersionExA LoadLibraryW FreeLibrary CloseHandle lstrcpynA GlobalAlloc GetExitCodeProcess LeaveCriticalSection EnterCriticalSection GetTickCount Sleep VerSetConditionMask GetCurrentProcess GetModuleHandleW GetVersionExW TerminateProcess RaiseException VerifyVersionInfoW GetLastError GetProcAddress GetModuleFileNameA GetModuleHandleA FatalAppExitA CreateFileA SetFilePointerEx WriteFile ReadFile GetFileSizeEx GetFileAttributesA

user32

MsgWaitForMultipleObjects PeekMessageA DispatchMessageA wsprintfA DestroyWindow SetTimer KillTimer LoadStringW MessageBoxA GetWindowThreadProcessId AllowSetForegroundWindow UnregisterClassA CreateWindowExA RegisterClassA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteExA SHFileOperationA ShellExecuteA

ole32

CoInitialize CoCreateInstance CoUninitialize

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 2457671c10c5aa708d9619798ec0139c
SHA256 6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
MD5 acfb66ee6fc1f4266229ec6098fe1740
SHA1 e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA512 bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP 192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA SetLastError CloseHandle GlobalFree LocalFree FormatMessageA MultiByteToWideChar GetLastError CreateProcessA GlobalAlloc lstrlenA GetVersionExA LoadLibraryA lstrcatA GetProcAddress lstrcpynA GetExitCodeProcess WaitForSingleObject lstrcmpiA lstrcpyA GetCurrentProcess GetCurrentThread GetCurrentProcessId Sleep CreateThread GetStartupInfoA GetCommandLineA GetPrivateProfileIntA GetPrivateProfileStringA FreeLibrary GetModuleHandleA

user32

EnableWindow GetWindowLongA DestroyWindow LoadImageA SetWindowLongA EndDialog MessageBoxA SendMessageW DialogBoxParamA CharNextA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA SetWindowTextA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/customPage002.ini

SHA256 7d9cd3c64e2bbed6791a5b9727e818e9dfb906040b31a56f1c4f996796a19903
MD5 88fbc6c2f14d0e1bd94bd20c6dedbd56
SHA1 8d4f833b7018d8357e4d143f4ae4793297aa968c
SHA512 a7d43526749169ea8f872326f2ce5f542ce72c7992493573ac7dbe1e3e642b6c75e3e48e0f277f2a6df270327f0e028ce1a4d15894f0ff748c26e079be3b4a18
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/makensis.ini

SHA256 897809761e9dfb522a603d0d33ce51cf2b2337708829b087b79055692f108b1d
MD5 3f67759230f26fff95e39d0ec328f518
SHA1 b5790baf51f35d4a56559381d7eb43cb44c7e53b
SHA512 a10ec0d66a8967c3c95ab4c7edf44fee1eb5a25e86b0ab2520939e88f3e9873f2f1ee5c7bb62f73939bece9b4dbd0f72e26a8ddc6be0fd18dcdda768946394c1
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 687888aa7f5f1507076297ff186a1a931a5a2e76b61f1a6f9bc2596dada887fc
MD5 ad9d0d9af9ddc968f2081999bce22881
SHA1 a4914d2f0d7726f4bd49d5f74679d26f34f007b6
SHA512 dd5cb37d8b31b59b4ce321996dd02412ce4e063ef8cf85dc96642ee137f99cbdfedbb9b8a60650b477ffffa78c8ded63ba6129ecfe34430f4a6b65c95588c49a
SSDEEP 384:U2/qSGGP/vF7VdG/vVEkT3Q0/wB2QjTIjgZW6fXMKE9nMzMwF8IhzEPVlm:MqNX0V9vAIjg7XMrGzND
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 e4c383d45cdfc69f18984a87d144113450e16bf6bb1d260234f473bab5df49e8
MD5 41b240ef557f2c4b65774c0bd718f7f0
SHA1 eac0adbd09a018a37ccc07bc651fb6fd0a473f9b
SHA512 0e591f23671f439a83b5d5c5f7488749a1d542717ae71d2297363f022540bea1357b79510d6f778b5fd250a300d51920caabeb9f8c605ff6487839975b700cd6
SSDEEP 1536:Ij/7rGIKDMR/SdOU4xNuwUYol6CXUgeeDoDRG/sCNimePfTtb+V/bokhHTb6NVOH:eYFvgrnWJ3P
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 a1e09fb1739ef7557d18104b0d6a4c7725e1ec293f5404c80402f57ff9ebb9d0
MD5 a95c7af96416b2cd084fed4c07c8c291
SHA1 0c62c2fd843ccb59784404ed36369784dc557671
SHA512 427ef14b116b574c5558cc6bb0ce03ab37f891f2d7ab0f130e3cddd0265e6bd269c598ce93230e56cd41bb9d2649bbbaa2fa2c654d8116c0c6f79a6f3419d1dc
SSDEEP 384:9ck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2NE:9ck76gibLCMLDLCx04HNVNE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH cd53277eaa7bbb8fb5b2b678274dcb4e
SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
MD5 24a7a119e289f1b5b69f3d6cf258db7c
SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$TEMP/setupc.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 55e37ec9db608c9dd898e3fd23975503e079a6f5ab82e0f9106014851ea2411f
MD5 62738e8892a6d7b05cbb3b8a192afe9b
SHA1 6546f3fc2b4d1301bbc57ea98e57ebdabcc4b9cd
SHA512 b88a231bfaad80f9c50dead56287d4e2bd445d5471267dcf39805c42abe692225696f7afbafa4fbbf0b4046de38e6f9edf03bed24f039a6d054a29aed4951762
SSDEEP 96:yoQGbu/vta8ksNuLikA70kfj73dteDNdxpCueczNt:af/1a8buLi3eDNdnCPm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DamBho.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a391a059943274d82a89dc0eb069a57f8984c56cb3c4cded13388d4873985f16
MD5 2cac7bdbcd895a3b2216fbff08f87799
SHA1 ae20d356c897fa271a712a429ea7368cf379c55c
SHA512 13937d63facaf2c661dde15b456cb0c062712165acf9054171f3a47711eba78729d83ea54bf55e443bd55c83478660ffb4c49bb2a28a966bb30ca4eeda934dfc
SSDEEP 768:gIYSKiHRbUxF2hC9AZHHwIp5ByQisriWh5:QGRbBKAtH1KQisriWh5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

88:f0:8f:30:34:9b:10:54:53:46:be:d6:9a:58:fc:8b:fd:dd:bf:27

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Mar 20, 2024

Minor OS version

0

Major OS version

4

Entry point

29454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DamFirefox/chrome.manifest

SHA256 9ec07e8ebdc668a03965e9c33312d8c340941b78f96f385d66dd9e1fa25bf491
MD5 337e0534676e8433b155a8bbe96bc476
SHA1 43c3888e2d7dda8f227aec03f12de0c3ff47f668
SHA512 f93d0552ac6f492eed5aa4bb4a38fe0d8735b1b38e0729db3d85fe87f7cd5d5e30b79134b61e908ad4df36897ae64e73fe0c92c8f5a39bda192688e787a42ed5
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/chrome/dammz.jar

SHA256 aa972414e67fc764a682590c781073dfbb64c5ac99aeb4e34b05d86d99f87556
MD5 ca0b09f12199013eb4156bf0d8cc503b
SHA1 749d8ea8b829adf6fff51d73295079794fd29d2e
SHA512 f83c94d4222689a1f9c349eb9adf4ef54a688118437aae100c37ef9b9b7fc7d892a39c4e29f66a4b974686ca6e7e571032af4919ce8b6dccd8dd631389c8c358
SSDEEP 48:9kPh0/PxFISLdMwB5rGtt1vSZLika4vhB0CPFsUiAuQ8iOZzaKaTQLT8kB2cvgao:yPG/ZQARGz1CLFFVuaOFaKY62/ErQzjP
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/contents.rdf

SHA256 6a3d00b2bfff28aee12bc586390db91bb3b1a712be61648a843ff9f816681b8e
MD5 78877fb43b11be500774a45f4aec65f3
SHA1 0e6d0b9e7a0fa9d9e4507562fcd1b9aa90c258fb
SHA512 0dd669a0ffd49df434fc70e0faf4e12a2c308a02ebb485b6bd60a6bdd6b4945110860ff849ff9f7ae1a6facae925672810073c327c8398722601968373b54de0
MD5 SHA1 SHA512

NSIS installer

installer

content/ctmn.js

SHA256 a8cabc17227047dfc76230af8a882ccdf1c10794678190bf9441e46ca775305b
MD5 4c934183672ee15594978f7a30de4459
SHA1 fb523e7cd82524985a89723bfa2cf32314da3f01
SHA512 b9d3d9bcb560650db7dd08aca0261fd0669901504c3c63dd26bcf7618d108d1f1eeacf7981b0ff18a3c32545c5f91ace78293c6e189db441388d8db4607c1a2e
MD5 SHA1 SHA512

NSIS installer

installer

content/ctmn.xul

SHA256 b16cb63632fd5433192bf1a3fec22abdfb3b10e8ac79ee91aaae52bc5a8e3797
MD5 ec87f508b5a877131bf654065d9fefd4
SHA1 01d2e2910a51aa2a9754d21ffd9dee0291e04d1f
SHA512 b7308711cc2887eca14a519df917dcdf1a59758e823f882682d4bea00f479852da7394fcebb40d43eeefe8035c6fcb00fb67cad9354f387002e98e7c176aef7b
MD5 SHA1 SHA512

NSIS installer

installer

content/dam.css

SHA256 998415f333c2e4a09d66871008e543d1c62b9e6a359cc49f6486cabd45290a38
MD5 f9a910cfc7cd0ba71757cee4bc310448
SHA1 d8abf805660dada3fb71a496437ea8b3d303bd83
SHA512 230d72b8efc1a5764d714c3f8fb7e0180d290a8190f28cba43bbe0db745501dc42dca8f38fccf3c037a4c9c679d074cbe6ae8a2a875a865b4c412cf2b8fa70f9
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.gif

SHA256 ac8b5c79f6d16db89d5eaf76cc24567d01927aebcac559efaf95a76b4d89180f
MD5 9bb9833f428ca90c47d2094f112eb629
SHA1 94678f78c5c63bfdd76ba24037bf19cc0eedf639
SHA512 9b0a93ab617fe7d726b28c9cc5dd2cf5b3501e9bb954cd3d66328205450898d094da5974995a2d5ac619012158837e272f9955af99b34c6b9d956eb60dec202e
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.js

SHA256 b95dc9837b0275cb204cdfecc79bb3e2ee133f2fdb6af8b21ef27152035ba9e4
MD5 84c0301618e0085b2c5ce96366b7ca92
SHA1 21f9e41cefae6abe1ff2f7a8cdf261afda658d8c
SHA512 f44e1db9ab224610e1d51b586c08e5dd1b42e60c4331e85e01d4f4063fbd255f82979c94a5400492ffd8de298dbdd2c742d97f5d9c41b6e1f269d0064c4bd1bc
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.xul

SHA256 322d8908ef0b3630a05db857aeb8bd2568cca5230627c8c46941eefe8e561f7e
MD5 46cd55fa35b7c047f812dbdb1c2de9c3
SHA1 a53fe5b07a89d232b2a51d22f18077843694c397
SHA512 161ddef696052cdbf8bbe41b0438d22b279110fe141bcfa19365082c61f4ab15a6501014698a42e73e4de5f4843cd0c9e6f0cbea0c6007b2b6f183e2a968a75c
MD5 SHA1 SHA512

NSIS installer

installer

content/mg.gif

SHA256 eebb09bce65f74d7ebad485e2de3e97277e1c5afa5f8d70d15dcae8b8da14daf
MD5 3d820e6238d40ef3cd56c19de27ddcf6
SHA1 301df37e70a0b1d363aa196003061aa293a44ab5
SHA512 df1583f65c441b0ad47940e01faa93a542d27595bcf27f4c5b3ccb4456e2582456bcd168a44127175b6aaab0a2e343d304239dc6a166d7d1f7fba9340a0f5e04
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/components/DamMz.dll

IMPHASH fcd2bde51c22e50522f0f2defa43aa78
SHA256 d1bdf68eb4f0f0f5728f60715e96bdc1b86378de46f047a2f2e956b59b3a4055
MD5 0627cc328c35b676a621bc5dd5652c54
SHA1 b31f347d8cba9995790d6d133bd1d2f917b8a5f3
SHA512 49590935459b5f53ee360566509c98b86504f5cd6d1130076864450d7a50c4b46d85c343a8ad7ebc0806870bf8634510d04a79754dddd2fb15517f650241c820
SSDEEP 1536:EIcgJQmIbcO60MYyYjWg2G2jEasHS43oRD7dmVe:ETIbJlrgp2jKHS43oRlm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

26254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_Alloc NS_GetServiceManager NS_CStringGetData NS_CStringContainerInit2 NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerInit NS_UTF16ToCString NS_StringContainerFinish

ole32

CoCreateInstance

oleaut32

SysAllocString

nspr4

PR_AtomicIncrement PR_AtomicDecrement

kernel32

GetFileType CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer GetLocaleInfoA InitializeCriticalSectionAndSpinCount LoadLibraryA IsValidCodePage GetOEMCP RtlUnwind RaiseException GetCurrentThreadId GetCommandLineA GetLastError GetCurrentProcess HeapAlloc HeapFree GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep ExitProcess SetHandleCount GetStdHandle GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime WriteFile CloseHandle EnterCriticalSection LeaveCriticalSection SetStdHandle HeapSize VirtualAlloc HeapReAlloc GetCPInfo GetACP

DamFirefox/components/idammz.xpt

SHA256 1a1dc688d7edb3c2c0c6a2067fb72247119664e1920b18c9967792b8869d0392
MD5 cd13ca068d2483f5c640fe6132e84976
SHA1 d712bf152b162cfa95ec21e383ec3440fd0e0b40
SHA512 9d1929d84e90f634f9a71abcaba4e0c83549a969dcceeed419f5bc2ef217748b7f9f77844a1fe1afc43f153b18e0bb3f50700c3f13c1005d0cbc4280dd944e6f
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/components2/DamMz.dll

IMPHASH d4fd6eae43ded259ccc5d68c73841750
SHA256 28cb7431134c936aa718a1eb8d1a4d1c024819ba4ccd31cc8fc00597182a14b2
MD5 7f5c21afbcee02b57851a101c0c308de
SHA1 353aebccb24988942ebee69c847fc255d72e046a
SHA512 7d3ba4d0b487366f21d174a02533b9132108dd296661e043beb6b90ef1afd5ec4653543e09e2c0d57d05973737745741619908e3a3cd90cafa1d31cee07f0b43
SSDEEP 1536:V7lCwCmNHkkt16U3+20m96SSH3iFRBA/:VBzhZ420m96XyFRG/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

25008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xpcom

NS_GetServiceManager NS_CStringGetData NS_CStringContainerInit2 NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerInit NS_UTF16ToCString NS_StringContainerFinish

ole32

CoCreateInstance

oleaut32

SysAllocString

kernel32

GetStartupInfoA CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA FlushFileBuffers GetConsoleMode GetConsoleCP SetFilePointer InitializeCriticalSectionAndSpinCount LoadLibraryA RtlUnwind RaiseException GetCurrentThreadId GetCommandLineA GetLastError GetCurrentProcess HeapAlloc HeapFree GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep ExitProcess SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CloseHandle EnterCriticalSection LeaveCriticalSection SetStdHandle HeapSize VirtualAlloc HeapReAlloc WriteFile GetCPInfo GetACP GetOEMCP IsValidCodePage

DamFirefox/components2/DamMz25.dll

IMPHASH 5648c991df33faaf9be8a5b14f66a2ea
SHA256 0a28393fb6c9c19ab16aad595f36714fa40039528e1d1f52f56b550b85e7f6f9
MD5 4a234889ef003c0e3bb5821e64c3f6c0
SHA1 d8e5e611b95c5a8fb05c9e2d04f0f66472c3765f
SHA512 62b6b6eb148272a7e6595f7f5aa489587cc0ab75f9d0ca8071331b9a51c46911917a3da6636c290625dff018e5f5e7b90d52a2e2142eddb8cf235bcf005f5dc6
SSDEEP 384:Rj8saJw/JpnGGVgp64HvwGXsSyKuxbAvTpvP3eNgUkGHflkImBBxQOZXOPVgTIgI:RUvwmWCvkpfWP8OZXOd0IgI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls IsDebuggerPresent SetUnhandledExceptionFilter TerminateProcess GetCurrentProcess UnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcr100

??1exception@std@@UAE@XZ memcpy memmove memset ??_U@YAPAXI@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z free ??3@YAXPAX@Z memcmp ?what@exception@std@@UBEPBDXZ _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??0exception@std@@QAE@ABQBD@Z __CxxFrameHandler3 ??2@YAPAXI@Z strlen

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

DamFirefox/components2/DamMz26.dll

IMPHASH 50bbac0c22ef6b4ae362809f809ef233
SHA256 39d3ba2cbb33c5c17e4152060cf0da06d931384ea9f9886ba753064187abf695
MD5 54226a2afce74522824fa6bf50bf9be8
SHA1 4204a619f975d4f3140c3a438794bde498c4ec0c
SHA512 6efd6ab10940f0b37b859d2e5143966c6485aafc117e67e6728620446494a6880d44b626445d03ce0b50ab2993688b9fc4f56430ed5da1608aa190b22b0fdbed
SSDEEP 384:JM86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRgI3gQOZXOPVTFI/s:JyfjKbvxZneRZOZXOdBI/s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcr100

?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ memcpy memmove memset ??_U@YAPAXI@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z free ??2@YAPAXI@Z strlen memcmp ??0exception@std@@QAE@ABQBD@Z _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common __CxxFrameHandler3 ??3@YAXPAX@Z

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

DamFirefox/components2/DamMz27.dll

IMPHASH 50bbac0c22ef6b4ae362809f809ef233
SHA256 0611356b149563c75f9779e3e9cd3d0aba67702a7838bd463b93589b8ebcfb80
MD5 34333f3b88330254aba3b32bae10204c
SHA1 a9f6a4eedaea9a1534fdfbba4619177711243be6
SHA512 aac9704c58391e64c65e2c271e85fd689ac3faee0442880e65984b3cbbc31ff3ba2287ae7a4b0a470c17196b0930842007d9a3842bf058abc4c3e46689f41928
SSDEEP 384:6M86ZdsRJnsKhYnK4HfjSP8Si6rSEPDpvP3educUUGtJnuNRjI3gQOZXOPVT0I/s:6yfjKbvxZneR+OZXOdAI/s
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17622

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcr100

?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ memcpy memmove memset ??_U@YAPAXI@Z _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??_V@YAXPAX@Z free ??2@YAPAXI@Z strlen memcmp ??0exception@std@@QAE@ABQBD@Z _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common __CxxFrameHandler3 ??3@YAXPAX@Z

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

DamFirefox/components2/DamMz28.dll

IMPHASH 0b690ef827097e859bcf07ba00add4f4
SHA256 59c74ee09c808d559a55d9787efe3faf58360af69eabd58501ee268e8b2b36a9
MD5 e52da85d0c4081579fd8ffa4d8d6fc6d
SHA1 72db42eca75a40ebc324cea8531efafb7149b3e9
SHA512 d911589147bc1c74f3a8559368fe63c365e7b5e173736d1568d8fe0501c3cdaf1afe68e5f41ad5c705fd87c92b4715d7a349da1c1918dc514538522c4d9c3d57
SSDEEP 384:sROMVl49usuFHXZunKBbfjmRY2k6MLMzpvH3eIuVgUJsZnbia0TZGOZnPVTqRIdc:sRO0fjwPvDRnbi9kOZndORIdc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17626

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??2@YAPAXI@Z memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ free strlen memcmp _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??_V@YAXPAX@Z

DamFirefox/components2/DamMz29.dll

IMPHASH 0b690ef827097e859bcf07ba00add4f4
SHA256 b38262b85214336fb21531ca626256bef689d8be787d28086fbecae39e1e80a5
MD5 9ce7d1a875775395398cc518e302a45d
SHA1 6c9306da0c65c793fb340463a4d17a9ebbc5f06c
SHA512 68b91825228c4c30b002fb3528c010004d425e129a4ac414bf5da27f0499077a337338b4205df4c05754f236a6ea80c6724feb2966ac555f1dd5b8ef6b8f9d63
SSDEEP 384:sHMZD2nquuFHXZun8BbfHmNm2W6IpMLPvH3esuxgUq2lncOORxQYZGOZnPVThRI6:sHyfHYDv/QncOOFkOZndVRItc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??2@YAPAXI@Z memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ free strlen memcmp _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??_V@YAXPAX@Z

DamFirefox/components2/DamMz30.dll

IMPHASH 0b690ef827097e859bcf07ba00add4f4
SHA256 b001b0a3db0743251b6d6bcc11b156098d732170cdcceaf918bd272aeb263d07
MD5 cf42e9ea3308770408899b58946c3894
SHA1 9fa2df15ae1cad9bb9625338e6a4bf9a14a2466e
SHA512 aa8e287fce6471ee26f05c4356e5ed949b41a72dfa8232ae5a059672768e1004aaafa90b50dc4d525d2a8a7e628beee39b66441ba7860e04c289d9fb2d7dc5d2
SSDEEP 384:s5MZD2np+uFHXZunhB7f3mtWmW6opcQvvH3ec+RAUK2lHReeRrYyMcZGOZnPVTo4:s5of34ov/QHRee2IkOZndcIt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??2@YAPAXI@Z memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ free strlen memcmp _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??_V@YAXPAX@Z

DamFirefox/components2/DamMz31.dll

IMPHASH 0b690ef827097e859bcf07ba00add4f4
SHA256 978845a6aefa29ea610fcd8bbc8d2ea2f790338e40efce960634fe7477499cec
MD5 a14764bf495ec66e283e7623366de3ec
SHA1 a302a7bcf3ec8df6cf949f145c091aba892a9f82
SHA512 9ade6b21a16237fe8d1e00742383c8b03211b70f24e5b8366e4e99d351947f1293c0c0d140d8924980f4de65bdf2a85727fb950cd1e33ed14fa569a36bb58f2d
SSDEEP 384:sfMZD2np+uFHXZunhB7f3mtWmW6opcQvvH3ec+RAUK2lHReeRGYypZGOZnPVT4It:sfof34ov/QHReeZUkOZndsIt
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??2@YAPAXI@Z memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z ??1exception@std@@UAE@XZ free strlen memcmp _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??_V@YAXPAX@Z

DamFirefox/components2/DamMz32.dll

IMPHASH 917b3384630cb3c55b7098f0adde3107
SHA256 95523e70d637d777685bb1d0c737333bba900c20889d39e97998c1fcb37ebc16
MD5 40bb9fb4d6a2b046586ca38c391cc56a
SHA1 56a3feea87c4e290c0363a4d4789441bd5f3d8e0
SHA512 03efd6d60d3b7e4425255a96243c9f05b2bddade02bb5566fcd2514ab8c8e3b47a42ee6f4cab32b8081735223e599550062d4e7261fe132cbbbd0479e5f33752
SSDEEP 384:HI98rSjDGyml/fcPXx+Zzv829/uhKIt9HAALvX3e7WWMokokOi23/19pBBgZsOZB:HI9Jav8QgRv0EOi23d1aaOZndOYZJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ??2@YAPAXI@Z ??1exception@std@@UAE@XZ memcpy memmove memset _CxxThrowException ?what@exception@std@@UBEPBDXZ ??_V@YAXPAX@Z free _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??0exception@std@@QAE@ABV01@@Z

DamFirefox/components2/DamMz33.dll

IMPHASH 917b3384630cb3c55b7098f0adde3107
SHA256 db101f402b5785dfc1578196c5e903ed5a2699297b1634da00ead8b10068101f
MD5 c23e79df39e5b859e63dfa8f13d58e4b
SHA1 5d7edeeb3b4ab35c5757c89026fa850bf1f30e6c
SHA512 926e681792a1ed3dfbea605de1d82b6e5c902aacb403dcdb601345dd1f4146b8b5d62a4ea9bf72a0775ac9b6771460543e3987891ae1de92c48e086cf5cb9484
SSDEEP 384:HF98rSjDGyml/fcPXx+Zzv829/uhKIt9HAALvX3QWWMokokOi23/1hjpBBIZsOZv:HF9Jav8QgRvkEOi23dhL6aOZndUYZJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

17656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCurrentProcess IsDebuggerPresent InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

??3@YAXPAX@Z __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ??2@YAPAXI@Z ??1exception@std@@UAE@XZ memcpy memmove memset _CxxThrowException ?what@exception@std@@UBEPBDXZ ??_V@YAXPAX@Z free _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter _crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock __dllonexit _lock _onexit _except_handler4_common ??0exception@std@@QAE@ABV01@@Z

DamFirefox/components2/DamMz34.dll

IMPHASH d53b18fb51aba35dc26e0f98b22f8107
SHA256 b89087ddc46e634865f595c1dff8552f6edb886b2684336dbf9d5ba47989a517
MD5 ce37b6131817c45d96dbae2038a04ea3
SHA1 5163dc38631c9d18453e16f6aee6f3fbaaeddb1e
SHA512 6b00ad330904e628fc4f6a6fef9abdbeb54b17fd3e3b6f6d09080995e2c7eb343c281624a57318ed40ea0fbc3b7f7e98b7cc65225cdea2c8b1bba4eab88e37dc
SSDEEP 768:2qF+fdqubZVdV4B/XrnfjuuHOZndfEknD:20o0kHdV4B/rjukOZVEknD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

20036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringSetDataRange NS_CStringCopy NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

mozalloc

moz_free moz_xmalloc

wsock32

shutdown send socket ioctlsocket htons connect setsockopt closesocket

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer GetCurrentProcess IsDebuggerPresent TerminateProcess

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

_crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock _lock __CppXcptFilter _amsg_exit _onexit _except_handler4_common __dllonexit __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z _itoa _malloc_crt free _encoded_null _initterm _initterm_e

DamFirefox/components2/DamMz35.dll

IMPHASH d53b18fb51aba35dc26e0f98b22f8107
SHA256 538577f9e1bb7a564ed2734dc454dfa812331b0c2fcb378073965e24d4de9087
MD5 1f5ecfdabf5a6c9dc99fee131355b3fb
SHA1 e3e051db94a8e193cde75febb1fa5188a348a35e
SHA512 2218a089ef3dbf3c9431f156b9397184543729115b862d16d4d39576f242a8d12c7daa0e13e4067eae67098f401d80aadd83e4b5d0b5f6fe700509c0eebe248b
SSDEEP 768:2rF+fdqubZVdV4B/Xrnbu+HOZnd4EknD:2po0kHdV4B/fu0OZ+EknD
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

20036

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringSetDataRange NS_CStringCopy NS_CStringGetData NS_GetServiceManager NS_UTF16ToCString NS_CStringContainerFinish NS_CStringSetData NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit

mozalloc

moz_free moz_xmalloc

wsock32

shutdown send socket ioctlsocket htons connect setsockopt closesocket

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter DisableThreadLibraryCalls SetUnhandledExceptionFilter UnhandledExceptionFilter InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer GetCurrentProcess IsDebuggerPresent TerminateProcess

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp100

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

msvcr100

_crt_debugger_hook ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ __clean_type_info_names_internal _unlock _lock __CppXcptFilter _amsg_exit _onexit _except_handler4_common __dllonexit __CxxFrameHandler3 ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ memcpy memmove memset _CxxThrowException ??0exception@std@@QAE@ABV01@@Z _itoa _malloc_crt free _encoded_null _initterm _initterm_e

DamFirefox/components2/DamMz36.dll

IMPHASH 01068c6aaef55a810c6ece64f114b800
SHA256 ddd38fe844e9fbc3264cc46b7e5c457f42564b30a36c438e09538205c8aaf65c
MD5 ec45ceafb08253c71282d0d2823abf51
SHA1 7b9260cd79e2f38f30d840983aea08b1c0bc1545
SHA512 b6ca7b3762eb57c22859216152903360eee2a53019604913c85bb2e3ba66f4c0dfb03ab03c544738052dea2577da56279bbf323fbc42666651238a05806d6f16
SSDEEP 768:MmyxRIUG+Wk405EGaIZO7jdNAl9N2OIKkX:MmygUGFj04+yNa2OIJX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

19375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringCopy NS_CStringSetDataRange NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

mozalloc

moz_free moz_xmalloc

wsock32

connect htons socket shutdown setsockopt send ioctlsocket closesocket

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

_malloc_crt _amsg_exit __CppXcptFilter ??1type_info@@UAE@XZ _initterm _initterm_e _crt_debugger_hook _onexit __dllonexit _calloc_crt _unlock __crtUnhandledException __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal free __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa memcmp _lock

DamFirefox/components2/DamMz37.dll

IMPHASH 01068c6aaef55a810c6ece64f114b800
SHA256 029edb8c7507efeae94edaa36732954b3479dd41c123d5e300bd2989825f7c48
MD5 e5352dd353e3b25e65526af991cde540
SHA1 310e40a30c6768d9e4bd66e280a6cdb54dc45081
SHA512 782a3608bf0e0c53ffc55d088374df64adfe2c38eb82692e48a436d35ec77dce257a7e411e437aa5235ed80e6effe572d43a35be2f3d79f84f2c1dfedb4e2be4
SSDEEP 768:SmyxRIUG+WkM05EGaIJOmHtxwlNXl0IKoz1:SmygUGFv04Opx0l0I9z1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

19375

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringCopy NS_CStringSetDataRange NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

mozalloc

moz_free moz_xmalloc

wsock32

connect htons socket shutdown setsockopt send ioctlsocket closesocket

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

_malloc_crt _amsg_exit __CppXcptFilter ??1type_info@@UAE@XZ _initterm _initterm_e _crt_debugger_hook _onexit __dllonexit _calloc_crt _unlock __crtUnhandledException __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal free __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa memcmp _lock

DamFirefox/components2/DamMz38.dll

IMPHASH 4501c4c3109e843ee377e7cb3f70c779
SHA256 2874ec68b803e6a6518e4ec6087a3e86ae34b50ef0f577d746b198fb6cd80329
MD5 84e69a7486e2c60471fd39369fbdfa40
SHA1 eeb185e32bfba447426ee7fcd3295313898bc729
SHA512 28f83b63fb897756e1d02096e4e0028e53001a070bbdc42f7509100d19a9d6f6d1e8fb3094e747f2d566fc6668226bac9f6fe1560b4270b5885ff2ef3afad614
SSDEEP 768:sbdRuIBzOD4XCLNGlEW+xM8t33+njUo5pNK5EPO:sbdDBz0wC9r73KjUKpNkEPO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

19423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringSetDataRange NS_CStringCopy NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

mozalloc

moz_free moz_xmalloc

wsock32

connect htons socket shutdown setsockopt send ioctlsocket closesocket

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

__CppXcptFilter _amsg_exit _malloc_crt _initterm _initterm_e _crt_debugger_hook __crtUnhandledException ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa free memcmp _lock _unlock

DamFirefox/components2/DamMz39.dll

IMPHASH 4501c4c3109e843ee377e7cb3f70c779
SHA256 d666d01f07742429faf606dc8956ea544f303dcf1466ba7366523d5045481608
MD5 f7e596a9e395fede98dc94c1aa33a1c2
SHA1 8883f9c4c179e827fa772c9f17ef1dc20bc44a2f
SHA512 22be0d6de402081e7f121732aab49a1400068b5e9e933ba4554237e050d8d4659c176997ec0b92e6778116772b3978b893effe892512d5226e48244a448cac3f
SSDEEP 768:IbdRuIBzOD4XCLNGlEW+xM8t33+n5UoBt3NK5EPO:IbdDBz0wC9r73K5UuhNkEPO
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

19423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringSetDataRange NS_CStringCopy NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

mozalloc

moz_free moz_xmalloc

wsock32

connect htons socket shutdown setsockopt send ioctlsocket closesocket

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

__CppXcptFilter _amsg_exit _malloc_crt _initterm _initterm_e _crt_debugger_hook __crtUnhandledException ??1type_info@@UAE@XZ _onexit __dllonexit _calloc_crt __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa free memcmp _lock _unlock

DamFirefox/components2/DamMz40.dll

IMPHASH a0df857064a89f890cbebfd2982cc0f3
SHA256 f932fa592451f28348c439b8a095f86d5f65cc0d3c0178024b31b78cbf305330
MD5 8f7825b141c623a8a04a5fb6acb67fc1
SHA1 12f493fa013728abe338a8207b4aeaecc47467f9
SHA512 7bec54888572453e6236b1a147a7fb181c7e96cadd3d9331b04a302c39209d9ad9767270068c91b05e69ff7b47e4c9095af7ac44b61dad770840b3f357a23b04
SSDEEP 768:kZ4ROSnIf1j6f8vvNtOn/h0h9/dl0WhNKZcPh:kZ4ROz9j08v6/W/cGNccPh
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

19423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringCopy NS_CStringSetDataRange NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

mozglue

moz_xmalloc free

wsock32

connect htons socket shutdown setsockopt send ioctlsocket closesocket

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Syserror_map@std@@YAPBDH@Z ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Winerror_map@std@@YAPBDH@Z

msvcr120

_initterm_e _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _initterm ?terminate@@YAXXZ __clean_type_info_names_internal __dllonexit _calloc_crt _unlock _lock _malloc_crt _amsg_exit __CppXcptFilter ??1type_info@@UAE@XZ _except_handler4_common _onexit __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa memcmp

DamFirefox/components2/DamMz41.dll

IMPHASH 1b6d81ff75ea684dc48f8a101e2d8926
SHA256 3802b1640431efac59be5561822354dbffade70f8a9104c7ddbc2b9db214bb6c
MD5 9b3cc30a88d18fd93def36d966ff4df3
SHA1 87d6ec5129eccdb6fe3b7c5dd3655b2d1a70e639
SHA512 707125da68d49b450437f6ee240952dbc6516bfde98d113e1b671ee3e2faeb8051fd505ef542d13fdb94583ceef79b601e564a30d3e5ad183a955506582cfb8d
SSDEEP 768:8HHO8PIfq7AMvIOmNNO1j8uh6p+rQ1RTRI9vZENKlMxY6z:8HHOhi7JvhmkjvRrQ1IZZENQMxZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

20159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringCopy NS_CStringSetDataRange NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

wsock32

connect htons ioctlsocket send setsockopt shutdown socket closesocket

mozglue

moz_xmalloc free

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

_unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ __CppXcptFilter _amsg_exit _malloc_crt _initterm _initterm_e _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal _lock __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa memcmp

DamFirefox/components2/DamMz42p.dll

IMPHASH 1b6d81ff75ea684dc48f8a101e2d8926
SHA256 30eee80fbdfc830876ae5b8f1089e8a82fb57665dd40f2cbb4ab9e64ae05ad31
MD5 41430596e5ff1be775e4bd356c0a60b6
SHA1 78d22d2e11d27d44400359d9cf873a612f054064
SHA512 c9a60665177aa7b705802536e2788f1d739f19e80b52587bb83ffdc4295016b7c5c23d62f488d9e55d3a48a2d91d1cdf24a1cdb57c4d5712afeb1474f0441314
SSDEEP 768:VHHO8PIfq7AMvIOmNNO1j8uh6p+rQ1RTR69vIHNKlMxY6z:VHHOhi7JvhmkjvRrQ16ZIHNQMxZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

20159

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

xul

NS_CStringCopy NS_CStringSetDataRange NS_CStringGetData NS_UTF16ToCString NS_CStringSetData NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerFinish NS_StringContainerInit NS_GetServiceManager

wsock32

connect htons ioctlsocket send setsockopt shutdown socket closesocket

mozglue

moz_xmalloc free

kernel32

DisableThreadLibraryCalls GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent DecodePointer EncodePointer IsDebuggerPresent

ole32

CoCreateInstance

oleaut32

SysAllocString

msvcp120

?_Xout_of_range@std@@YAXPBD@Z ?_Syserror_map@std@@YAPBDH@Z ?_Winerror_map@std@@YAPBDH@Z ?_Xlength_error@std@@YAXPBD@Z ?_Xbad_alloc@std@@YAXXZ

msvcr120

_unlock _calloc_crt __dllonexit _onexit ??1type_info@@UAE@XZ __CppXcptFilter _amsg_exit _malloc_crt _initterm _initterm_e _crt_debugger_hook __crtUnhandledException __crtTerminateProcess _except_handler4_common ?terminate@@YAXXZ __clean_type_info_names_internal _lock __CxxFrameHandler3 _purecall memmove _CxxThrowException memcpy memset _itoa memcmp

DamFirefox/icon.png

SHA256 02dd748585580a138a6981c8ef149e498996c36994d54866bf99537e07b86a69
MD5 f0865dc561759f881789779385c99516
SHA1 f12aa1dc4f7bbc5eacdbfd3b448d415b228b9408
SHA512 e64212636c66b97ff7b58a02b008481c0f271f564dcbd677a7180b28deae20afe61f9c84132706f92f441edd0a75d8e187f360f1b36a75ad22f90c30f757ef3a
SSDEEP 96:fSMMcXp7SnbHRsNXdqoAU5dO6l8y6UNwhcr8ibOs2SwtwWoqyV:fSMMc5MD2dqoA/Ugcrzz2Sww7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DamFirefox/install.rdf

SHA256 a4c3b92b2e44f70d6841564cf91005217d4cdff07e1575fbf39388e5791481c0
MD5 9c5cddbfce7e9e6ac1f3908c71bc67b6
SHA1 a5d01c9f61523c03ea1bb15d3d2a6791d06b21c2
SHA512 cb67d9b3725a3fd161e01afa856f61cab27bff2ce1b6c872715b0968650f62c295f5d719e0443705fe250b41ee54732ec0c9efe4be040ebf8bafa8cd061a9a39
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/chrome.manifest

SHA256 95da3f1d92a641b093789004bc4f7e92e811b7c6a8fb2282dd81f5fbc959c564
MD5 09749731e24e778092c626078f2a0fd1
SHA1 0a8d8cdba91ae24879929a15eef654550d24b770
SHA512 590fbe578ba04956ad2bff5d2816e07620f956c0c3dfd3e20007d6689edd52edcb3d91803b3f7b5daec496b3c74d7850f6006831489342f94b26c11834cd713e
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/chrome/dammz.jar

SHA256 9108915be2351ef3500141fbadc6cd52bf449dd3c2d31c286a8d8156a3fa8c15
MD5 d949b17a76ac8c0f34326e31a0ab3104
SHA1 bc9a51475288ed7337a8b5d30c746d81747b9464
SHA512 79e3941476b45b48fa73b7723574c61b8279e17b5a94c713d588710ce51138a2f23abef50a8d3f8ee5383929c6544bdf4339a111ef5e847bf35bd029cf695a90
SSDEEP 96:yPG/ZVgQbp1c00FVu7ZxE/xKZgINzKrzD2/rpebdsOmjG9r:pPNbzUrOZxE/kTISzcbd/r
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/contents.rdf

SHA256 6a3d00b2bfff28aee12bc586390db91bb3b1a712be61648a843ff9f816681b8e
MD5 78877fb43b11be500774a45f4aec65f3
SHA1 0e6d0b9e7a0fa9d9e4507562fcd1b9aa90c258fb
SHA512 0dd669a0ffd49df434fc70e0faf4e12a2c308a02ebb485b6bd60a6bdd6b4945110860ff849ff9f7ae1a6facae925672810073c327c8398722601968373b54de0
MD5 SHA1 SHA512

NSIS installer

installer

content/ctmn.js

SHA256 960659865e6667294e45c23e8dee6735d7bd5b9ee4c0ce8c570df952691aa453
MD5 590489becd8f72c2d976c63bf372958c
SHA1 237c31b1019c651984bedee69efcb7b035b9c2d2
SHA512 abb32b462ff3e3caba8bbaf2c6c3a5db1b43f7a71b6fc9d1becc3ea3a072ce517426f5adc1ab75dcce4d774cb63904f646e98fe61b5e431a37151bfb7f0ec4a0
MD5 SHA1 SHA512

NSIS installer

installer

content/ctmn.xul

SHA256 336b6bef3827cf38fc68cfea0199f066063e69c096775e8b4ca860b87f2ce2bd
MD5 0f58d1cd98cdcaf14d7d08f4b5854f45
SHA1 4a4ff20c15b6ff9c2034b14f65e536430be67d7c
SHA512 0df231437c726e44ace367a888742741c0b230cd3e69aa5e0cd22a95910bcf4a3d298e27fe1b96b996180ffaac9bca317fb0a5ea5e15f349384f2f42a693ff55
MD5 SHA1 SHA512

NSIS installer

installer

content/dam.css

SHA256 998415f333c2e4a09d66871008e543d1c62b9e6a359cc49f6486cabd45290a38
MD5 f9a910cfc7cd0ba71757cee4bc310448
SHA1 d8abf805660dada3fb71a496437ea8b3d303bd83
SHA512 230d72b8efc1a5764d714c3f8fb7e0180d290a8190f28cba43bbe0db745501dc42dca8f38fccf3c037a4c9c679d074cbe6ae8a2a875a865b4c412cf2b8fa70f9
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.gif

SHA256 ac8b5c79f6d16db89d5eaf76cc24567d01927aebcac559efaf95a76b4d89180f
MD5 9bb9833f428ca90c47d2094f112eb629
SHA1 94678f78c5c63bfdd76ba24037bf19cc0eedf639
SHA512 9b0a93ab617fe7d726b28c9cc5dd2cf5b3501e9bb954cd3d66328205450898d094da5974995a2d5ac619012158837e272f9955af99b34c6b9d956eb60dec202e
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.js

SHA256 b3385cb1a61b1ec4b3697c192c096eead4b76cd1f09a850093d7462ebe3fcfd4
MD5 ef87490c377ce4f02da0b2a37e71fde8
SHA1 907195d088fbc3c3957432b3265e5e0721bacbce
SHA512 83ffc3cfbe21777d7e8c239bb028d32f2355f240f97b3b2f7dd914d045f83f4c6282a7c223dad0aa87ec5dc3b454aa50002954082727db771e4091df3c71fa29
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.xul

SHA256 ac38a56004d27e4535a55015c5d9820f99c9bff0d53cc001718e48076158dff5
MD5 60315b830dbc4fb8f112e3a5d788dea3
SHA1 a42e0893aa78476521b24870925f31f3d9fe2ebb
SHA512 778d5f4899cce66457774ef7fa38d7bd3ab8e8bc884a3f62d786784580527c3c1f5db4a68f159f3b86c11823c174b472beae7f893bdbba985e7f494ac5fc826f
MD5 SHA1 SHA512

NSIS installer

installer

content/mg.gif

SHA256 eebb09bce65f74d7ebad485e2de3e97277e1c5afa5f8d70d15dcae8b8da14daf
MD5 3d820e6238d40ef3cd56c19de27ddcf6
SHA1 301df37e70a0b1d363aa196003061aa293a44ab5
SHA512 df1583f65c441b0ad47940e01faa93a542d27595bcf27f4c5b3ccb4456e2582456bcd168a44127175b6aaab0a2e343d304239dc6a166d7d1f7fba9340a0f5e04
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/components/dammz.dll

IMPHASH f3c35e06a4cfcd29c89dae37a49d17d0
SHA256 2e40a039072dc66c240d5c97bfbcafaed08aa55e1dee064ad5fc760e57eda7a5
MD5 8fbbb55a879335dc541c92557c80344e
SHA1 b9c08a1b6d681a170ef0c392ded9ea4fb6cfe7db
SHA512 0c40c31e87b553072f60cb2e48e3cd360e4b371e879641a3c6087c1b1f50c1623dd5a1b7cee67bcb3b5aebe22382e64f36c8bc76505e3f4294fbd59dda082648
SSDEEP 768:16qTssWDdMcphQ3TtF4GMwVGm4pQFSo6sm3:16fdMcG3TtFhn41o6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15325

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ole32

CoCreateInstance

oleaut32

SysAllocString

xpcom

NS_CStringContainerFinish NS_CStringContainerInit NS_StringContainerInit NS_UTF16ToCString NS_CStringGetData NS_StringContainerFinish NS_Alloc

msvcrt

??1type_info@@UAE@XZ ??0exception@@QAE@ABQBD@Z ??1exception@@UAE@XZ _CxxThrowException _EH_prolog ??0exception@@QAE@ABV0@@Z

kernel32

DeleteCriticalSection MultiByteToWideChar LoadLibraryA GetProcAddress GetOEMCP GetACP GetStringTypeW GetStringTypeA LCMapStringW GetCPInfo IsBadCodePtr IsBadReadPtr SetUnhandledExceptionFilter IsBadWritePtr VirtualAlloc RtlUnwind GetCommandLineA GetVersion HeapFree HeapAlloc GetCurrentThreadId TlsSetValue TlsAlloc TlsFree SetLastError TlsGetValue GetLastError ExitProcess TerminateProcess GetCurrentProcess HeapReAlloc HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection LCMapStringA

nspr4

PR_AtomicDecrement PR_AtomicIncrement

DamFirefox/old/components/idammz.xpt

SHA256 83b18856941ed685e642497dbf89337a9c01bb9d40a1bae94739b153d3f20b8e
MD5 a3839b2b4d93102e539f82f2f9e6fbd1
SHA1 d8f347c3a8a9c8a38f8cbd14cc3ab06c1eafc93c
SHA512 7435c3bbad7ceec2b62c958ad0a2c05502b99b8432404acba0f65ed3197447dba39244a2e729b0af5ee736af87cf8b0e5ca09fb8542dd6deed61516ec29f24bd
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex/META-INF/manifest.mf

SHA256 2c5b65e36c70642a5648b36d7af1886a461381503f2160514844a870dc370b53
MD5 6feb868c4b3d405394f6b5c1f77c2f29
SHA1 5149b87c8422f254697840386d2056b7004135c8
SHA512 263a2e420b0867c25645f49dddff1fa1c83c7e7dabf6c61e0f9670843a77da720ac688c2f540b8bd36e13b85f82248d698d4caa24cd7c0348c1ff8b1d5f272e1
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex/META-INF/mozilla.rsa

SHA256 4fa148b6ac26b7f4e50fd29c55068efc530d06bf135778dd5ba049fa370c1089
MD5 1c778a126b67272ae0c5fd22cddc7349
SHA1 e3f37f9dc4b4a3c4568610a5a605fa67af9b92e4
SHA512 d0c26d6e97dc4079e351b511a1aa64952d7dc03f55c3a70748007350ae588bd1807658649fc232a18fd0a24b75030c6220793b372df0d29974ee121929010e87
SSDEEP 96:8HYCP06+41UNGLpo0Hs3LlPtn40cTIM0a:8RP4+K0HaRPtn40cTIFa
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DamFirefox/old/ex/META-INF/mozilla.sf

SHA256 4da9c5475b48d8afe9deb0608e8967b6f7aa8f56af785cf26e4c8c14e594d91c
MD5 216b34e7d5ba6c51e43807a54e562e06
SHA1 5fe73052cdb9b181550b40154d48e67084c40991
SHA512 2d46e731b7ba5a6edaa716c9fdf74594a5bcc874e7ad86052abed58fb8b46e17c4e78cbac7f59cb5b3aeb4b6e14b0ddd1abfc3914ff0f68cb1061c9b8869db1c
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex/chrome.manifest

SHA256 e57e488700173b2fe669e5fc3f46cb5c70e55e8734c8a1a699cc56f6034252f5
MD5 0432e83873b456c3d46bbd05d4989c08
SHA1 00fad1a7965dc4cc87e05fac88f7a806aefaa601
SHA512 c85aa14d667ce0296cf00fcbd8c2e25dd161a0f8e164cd12d731f42b5e2d8248bccdaf4d4787a7f8b2fc9b5413e7e46bc152057a96ef77a8f709bd1a940a1d11
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex/chrome/dammz.jar

SHA256 c124e6fe84bef7e0bbaff4d029edf8ea161860501029e79ef1ff4e405d42b708
MD5 796f612f23b8ae2c7df2424aff206b09
SHA1 95d82aa5a3d33796e4669bd18617692c04b42afa
SHA512 90f6d3d0f290fc426cafcd2e13f088bbe5f034e339029d16292c7a9bda12cac626676f70a45d5442a73110e39c4f3d55eac5175c4acf63aacb71f701e013475d
SSDEEP 192:pPWBnkcBgxavAu3j4qMhRuz/36r92XuW2nKY:kDsgAu3jgzr92Xb2nKY
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/contents.rdf

SHA256 6a3d00b2bfff28aee12bc586390db91bb3b1a712be61648a843ff9f816681b8e
MD5 78877fb43b11be500774a45f4aec65f3
SHA1 0e6d0b9e7a0fa9d9e4507562fcd1b9aa90c258fb
SHA512 0dd669a0ffd49df434fc70e0faf4e12a2c308a02ebb485b6bd60a6bdd6b4945110860ff849ff9f7ae1a6facae925672810073c327c8398722601968373b54de0
MD5 SHA1 SHA512

NSIS installer

installer

content/ctmn.js

SHA256 56c6ea64ce0a791b31bb396e6fb12452d30b45b2a8368cff9bac01b11c4c901c
MD5 b709387bd846c303b6668ff871803818
SHA1 749e96067f3e7edd5fdcda6921c09c0aac1a608e
SHA512 6747f07224e2f7b89abca6dfd0d64c48d8f9f13e78a7e4144757e445582d680fece3951eee262f87d1a739e8d706c475eb8f4452ebecb4cc164eecc3dde64bea
SSDEEP 384:D9kWnIIXqarj6x6GXo8+SRp6uiUCEBxZpKBHEKdSQ0VFWgdej3vnaZ2NW4UM:y2/4U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

content/ctmn.xul

SHA256 8ee68768ea4181eeb65dc62b6a83c6f73c2502a287ed49bce14444bf200a8850
MD5 1df994e86056c527d81fae5610aa44ba
SHA1 34dffd14156ae60fb1b553c54a429f733c6db19a
SHA512 5204cbdee1f0afa8f5504080c0453abfe5294b82153a41c92970887111a42d39975e37e6aebe6f8ac05cc90d1e297cfb137a25e1b9107ad90836e38be36d27bb
MD5 SHA1 SHA512

NSIS installer

installer

content/dam.css

SHA256 998415f333c2e4a09d66871008e543d1c62b9e6a359cc49f6486cabd45290a38
MD5 f9a910cfc7cd0ba71757cee4bc310448
SHA1 d8abf805660dada3fb71a496437ea8b3d303bd83
SHA512 230d72b8efc1a5764d714c3f8fb7e0180d290a8190f28cba43bbe0db745501dc42dca8f38fccf3c037a4c9c679d074cbe6ae8a2a875a865b4c412cf2b8fa70f9
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.gif

SHA256 ac8b5c79f6d16db89d5eaf76cc24567d01927aebcac559efaf95a76b4d89180f
MD5 9bb9833f428ca90c47d2094f112eb629
SHA1 94678f78c5c63bfdd76ba24037bf19cc0eedf639
SHA512 9b0a93ab617fe7d726b28c9cc5dd2cf5b3501e9bb954cd3d66328205450898d094da5974995a2d5ac619012158837e272f9955af99b34c6b9d956eb60dec202e
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.js

SHA256 3d1eafba3cc0145e30e07447923eb6df4bbfbc2f906b57f8a964fca461a16cc3
MD5 330245fc3b1ac1d94f885561609f8555
SHA1 be7cbcd825afa9df17bda42740e68a671ead5484
SHA512 c066541f4d3399f3de6aa861b0c1f74ffb5099bc2bba1aa0699dacddad3048e43e219336565b79698c5beef6af8c25f0e44af5a93c53a27a8cb542d5eaa959ce
MD5 SHA1 SHA512

NSIS installer

installer

content/dl.xul

SHA256 322d8908ef0b3630a05db857aeb8bd2568cca5230627c8c46941eefe8e561f7e
MD5 46cd55fa35b7c047f812dbdb1c2de9c3
SHA1 a53fe5b07a89d232b2a51d22f18077843694c397
SHA512 161ddef696052cdbf8bbe41b0438d22b279110fe141bcfa19365082c61f4ab15a6501014698a42e73e4de5f4843cd0c9e6f0cbea0c6007b2b6f183e2a968a75c
MD5 SHA1 SHA512

NSIS installer

installer

content/mg.gif

SHA256 eebb09bce65f74d7ebad485e2de3e97277e1c5afa5f8d70d15dcae8b8da14daf
MD5 3d820e6238d40ef3cd56c19de27ddcf6
SHA1 301df37e70a0b1d363aa196003061aa293a44ab5
SHA512 df1583f65c441b0ad47940e01faa93a542d27595bcf27f4c5b3ccb4456e2582456bcd168a44127175b6aaab0a2e343d304239dc6a166d7d1f7fba9340a0f5e04
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex/icon.png

SHA256 02dd748585580a138a6981c8ef149e498996c36994d54866bf99537e07b86a69
MD5 f0865dc561759f881789779385c99516
SHA1 f12aa1dc4f7bbc5eacdbfd3b448d415b228b9408
SHA512 e64212636c66b97ff7b58a02b008481c0f271f564dcbd677a7180b28deae20afe61f9c84132706f92f441edd0a75d8e187f360f1b36a75ad22f90c30f757ef3a
SSDEEP 96:fSMMcXp7SnbHRsNXdqoAU5dO6l8y6UNwhcr8ibOs2SwtwWoqyV:fSMMc5MD2dqoA/Ugcrzz2Sww7
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DamFirefox/old/ex/install.rdf

SHA256 a4c3b92b2e44f70d6841564cf91005217d4cdff07e1575fbf39388e5791481c0
MD5 9c5cddbfce7e9e6ac1f3908c71bc67b6
SHA1 a5d01c9f61523c03ea1bb15d3d2a6791d06b21c2
SHA512 cb67d9b3725a3fd161e01afa856f61cab27bff2ce1b6c872715b0968650f62c295f5d719e0443705fe250b41ee54732ec0c9efe4be040ebf8bafa8cd061a9a39
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/ex3/Thumbs.db

SHA256 22fe12df23bb92e93357a7c88b7b7cabccaaba361faa5cb88cf7b4ef5d5a68de
MD5 49d1bd3a76ec8de188f1b83f8c2956ac
SHA1 e775e63bce26fdcbe46dc1d7f9b07b5f4c2c7192
SHA512 81850b893946bcc1518a492e19062832186b8297ebf3e785b751f64706af4f73d02275ec60471b0ef5f6e13d360e306fa0c5f2728e46f0e3219f0d40cf1364c0
SSDEEP 192:F/lZZnwichfFvFoyqgPuc4QvuHLtU4QOG:ZlnqFoybucHvuRU4Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DamFirefox/old/ex3/dam.zip

SHA256 946b7419e22b08cde5786a5dfa6b26b006500ff6e8edf6100a3d51beb1b0f785
MD5 f35da368dd2f405260fbd02c7e13c5b3
SHA1 4deac913c36c2a00339195ec0495565ac296095a
SHA512 e88fa52b68a975f2433da7d5ce9bb25ad190fa0b9920339d04b8da19428aed5b7061a9461cfb196a6a822082b562fdeef6dc3112c5f63b33ce820b0901d40fcd
SSDEEP 384:BAcyq88k9V5F9DKLBb74Dq9rkBKxlFthwB+uQeSFQWZ3iR/OLAo:aqYp2H9gMzooeSyWZqOMo
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DAM128.png

SHA256 62c492401b9d8d1fe130c4fb15c355083294708cea039f134eafd79b0f9c3574
MD5 4df82334a5a02e5c8ccb790debcc6a6b
SHA1 5a5ba8d246040d50498a530cfdf2c6019f028f43
SHA512 4ecd44f69b9a64f33a49a9373c89c1786b8fc1d5199f4b41c4a452850fda823ac57223765509c69b9178ad06f9bc05ce18911242c111a1da9255ad34b6a98cef
SSDEEP 192:zS2sth8ireJxCH7QigxiAuZvtv/eeqizaXDq17ignCyB03liG:m20eXioiL1sizaWggHB03lp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DAM16.png

SHA256 a3f3291a7b324d3a748b9c7da8a5b186b0f0828e2d0a3c02856cc547faa253ce
MD5 a18d3c39ed1a16925064ea7597651460
SHA1 2e1e28bf74eddcfe213a890450ebedbaa318294c
SHA512 6916d381361771ca259b77e3c31079964f3a1b7339eeda612090356c7b7deb6bf54dfe270124485cbcbb50bf165e22e06995f43785305a533a311e6d1df7b3f8
MD5 SHA1 SHA512

NSIS installer

installer

DAM48.png

SHA256 add8af097b89db3c59f9f9accd7268cf3ad002c89b90d244eb0ff5a865f21fa3
MD5 931a9b8995e5a281ef41b0e8c200ccf8
SHA1 04c779f15eda7533a96a6ec857600a44248d99e7
SHA512 5b5fce49c47b6887873ab517a4c3d935070ad82e83e66cced0598394a8e9dce56a4724a21db8af7fdd2aa26155be33a5754166d67fd367212a0d8edc9f170cfb
SSDEEP 96:fSJu+3G6n7bVl8AhBqwkHU/bEoUYAb7MC5/qi1uz0+LwhoT:fSJu+2cbH8/wkHU/bNdAnz5/qiQz9Ek
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

META-INF/manifest.mf

SHA256 b28ab6889325b7d66493c1b38f4a959f4c04f2fed220b71196c131b2bda117e4
MD5 abdc3c1933a20d331715c1534c535d4e
SHA1 cd6efbd2b868434410593941179890a111a1e148
SHA512 f00824cf738d53a83a31e58415a7bac9b9aeca1b464cf8f325e23ea7938aabd5441d3e887e1e253701ca337c6315e487a73d069910d24620a445d2537a6be952
MD5 SHA1 SHA512

NSIS installer

installer

META-INF/mozilla.rsa

SHA256 adcbb5c53407c49efc91ed21d22fa55df9ac684035632cda2963586c71b4b9ef
MD5 0a21b2a8c09c734998f0a31ce6ae7460
SHA1 f8555d5e2250999628ac543db5cb2c8bae8714d9
SHA512 3452b8741a528a8787ca64ca36e015542a5da3ae0a6b6e81b2bac4d323950a9cd6b341e1c047101ae7eb0f5df909aff9a851cc325b85a699aec1233b2b639325
SSDEEP 96:jqIQrDO2YFD+373WXZsnlXAX/KPEA6VpOLVz8:jEhQa37mXGnF7PBIE8
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

META-INF/mozilla.sf

SHA256 adad0bcbdb993cd367c9d8b1386ef2661aec13ed252ebca0af4d2ac2adacacff
MD5 edc730a8101accc7a1800256602cf55b
SHA1 6f2befbadc8e4f2b1272cf1730bf3a7ac2500751
SHA512 6cdd027fde60dbd730320b10b012e985730c210d50b4c13701f80fdecd1fcf9ea1675f1dac0b99bec6d7a0f733bd9844342a279d85da54209db96d35318d1e28
MD5 SHA1 SHA512

NSIS installer

installer

dam.js

SHA256 0ea3cbbfe2d188c123c3e1d64d2b066dbe27feb596ca924bf355d9ded61f38a4
MD5 4b5bf0cb2fc5a093b0d3bd0ecc54781f
SHA1 d93a6c938cc7a6f2f67209a410929b9950d81670
SHA512 2ab03cc54aa5a1d05663d7375ccc4f67fb8c348e7e5bc25324b62d6c4a0e6974e240823dcfd9161285fc4dca549bb7f2dd395db32983313cd0c69382dec828a7
SSDEEP 192:W2xvYPgyAqbSJk9Jz22x1E2SSQn7muhbNbdr+u/EDDI5COHcmRwnfGyNt30JAnx:YRmkHz5iSQ75/EDDI5tdR2G4t30JU
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 7fe4aec138b1707b326fbaa74580f5fcb92e6cfb4297073b97d75ba6236a0148
MD5 d36789d3675e341c55bf2eafd6158fff
SHA1 2138047131cd4f158911f72b3c8153e8a58f0855
SHA512 a4cfd39fc73d2ce1eccf9732ba38bb23a4c703f6a249e170bc5d8bb753cd58ada0d6716831100d35640e536f963b41da13ae6e6757f51bf97ad99fd30c74c2ce
MD5 SHA1 SHA512

NSIS installer

installer

DamFirefox/old/install.rdf

SHA256 8cb17316251e6a3b65aa973089b933df37b52617ffe55de2b673b53ca8585c17
MD5 62cce57986b3976d657b11136a60d985
SHA1 09f9652674b18932270c525d34edb38041ce7400
SHA512 545302cad66e554aee7a2d263db0132c85877b6e38a03ca97ad909bb9490f857bddfd6ee30cb69260964a13b88609c9c7f406e1051844da380ac5955008f9041
MD5 SHA1 SHA512

NSIS installer

installer

DamLinkHandler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 16c65138a398e626cb4e3c5440b89fb8c9c8c08fed7292c0b67a481f6fc6c1f5
MD5 d37ae62d7ae1d1d29742b37b5e5a65ec
SHA1 52ca247535c8d2df65d1072370a2b7ab320b11f9
SHA512 30771626d02c6380ff6ea0022eccc09e9d142f7b819036cf3a0ea9eb9fea24b9c6a7404af9964d5f82aa7cfb26ca4320114ad91bd94469808a0509f6c8460f74
SSDEEP 768:oTQLCgRs/4QZ7OAilKvsHBXv2e7jfsrXQcunWoyjGZx/EQpTFx:/ns9yBfXv2ePfsrXQWooGwQzx
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

47086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DownloadAcceleratorManager.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 1d4d500bacc5dbc232d162dffe25287571a049082c554fb07d920733f5336f7e
MD5 c9a97774f133b25b2c5db91d5b34bac2
SHA1 55091d710765145164295c5f77fc93d76f957677
SHA512 a2e54b471d897d38ae366a2e5f1061a6c05236cdf7af1058e31f893039541799924de25adbfe412253fc568cf7730aaa3153eff8604f3c17bc7d43abad14c2e9
SSDEEP 24576:Vd77TF5YDnVuV5yrUn0Lh6iMrMUSVTra7w1:95uuIUn0YQTr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1175038

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

DownloadAcceleratorManager.exe.config

SHA256 f4ffcc01ea1c06be63c18d343187ccb5f2f5885f1780218780f92214415e9c74
MD5 7ed00198dff303eefb49e046562b5b7d
SHA1 f2a14ec5d2b7717061b77769067f93295f1fbc8b
SHA512 71a2e8769e28a7dfe6d387bf3bfb0961af69d5bda7b6acc37ad6095581f02254e8d3be5b9583dfb39e34566f37c4fc54aa08f39e68ed705485519e7096b35ef9
MD5 SHA1 SHA512

NSIS installer

installer

Interop.SHDocVw.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd3102b63b94b0cce1d0a7982a6db5a6c468e809f53070559a09ba6761ffa174
MD5 50f0b757cc707d4a438c02da19e350da
SHA1 bb5bcc63d4708b3037466abbbdd38f248fbffda2
SHA512 151743e9b3af7fbe24a5f9237b8f07161834518336b1df8fe00691906b5ec8fc96a5d654d464a68290e8611a51ddc33429cf6f26ffa6858fa932f6461b55dc81
SSDEEP 3072:6Tm5EBv6r4BO/MFCzwpWHkNPLbSVoDuxU/6Ng7WpsXilYT+BEPKdQLm5cncKJZtI:6Tm5EBv6r4BO/MFCzwpWHkNPLbSVoDu7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

122638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

MediaGrabber.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 9927c743ba8ce0ce8b59983693a7242cf9ca46d93630cf5c36fdde32e96cb150
MD5 0e617f91a119dfad00de19adc57231f4
SHA1 74b5d97612740d8f90f6f199f543ef2df1c3832e
SHA512 a17b1c1a0e91e4b657b8cf144af91b693eb723ec1ece96cdf9992178df353b4da545155fddd779330ade21d899fcce0502289ed6b0da1dcfa191a9fddd6406f0
SSDEEP 6144:M0VVUKp4c8LhdC1392hOj8+XcAHTXWRbxlQnM:zPUKDKdq2hOjfckXSxyM
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

f7:24:11:e7:84:de:17:68:fb:83:3b:98:8f:4a:96:82:c0:52:ab:a2

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

280062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

MediaGrabber.exe.config

SHA256 f4ffcc01ea1c06be63c18d343187ccb5f2f5885f1780218780f92214415e9c74
MD5 7ed00198dff303eefb49e046562b5b7d
SHA1 f2a14ec5d2b7717061b77769067f93295f1fbc8b
SHA512 71a2e8769e28a7dfe6d387bf3bfb0961af69d5bda7b6acc37ad6095581f02254e8d3be5b9583dfb39e34566f37c4fc54aa08f39e68ed705485519e7096b35ef9
MD5 SHA1 SHA512

NSIS installer

installer

MgDll.dll

IMPHASH 582f9e04b7d123889ecd3f1ad464872c
SHA256 aadbe6b2c922171514b079af82a8834f5f67c99fb2a63647fbc6f7eab5577d57
MD5 669d533037c01034bb9ca06a0b62590c
SHA1 c9fa18476066a1da2a532767ffba2f62645f71fe
SHA512 f1e26d841f483aaef39ae77980e8d2042e993a4ca0785799e4b310aa0c6ee2e1d3ea35bf57a127a65855845da079b1534947ebf32422d09cfa83d81f0ac9ccc6
SSDEEP 768:b05lu1MwMuzFbjVT6U4ljMSrrqaUc4576riWh/c:b0KFjVT6/lvrec4576riWh0
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

13:e5:f0:b6:bc:46:ce:26:7c:e9:cb:de:8c:61:4c:d2:3f:82:2f:70

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

12079

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

NpDam.dll

IMPHASH e45f57938a52104a61867be79f0b5b9e
SHA256 72e445cab3fcc013e6f67b04f4991bce352ee4ad91ea9bfd7fb6db89a2369fe2
MD5 11d7fc4112583844d597662755944897
SHA1 eb262c7ecef36aa2b3b18ab89fc7e1e654f90217
SHA512 06d817e9d551da0c7fdb3f363bd3afd1e0ad4e55ae9e0cd7f4d9cfdd870cec18e796d33027676031a992f1dc372e661c8c7104e4cf5210c8ffee08dd8268f0b9
SSDEEP 1536:WPT50tdtI5Woll1XMWWF8J65jZJv8Ke0YpskEsqHUriWhN6:Wu5oqWj6
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

0c:83:49:63:31:4b:6d:4f:00:2c:33:19:75:6d:0d:17:1c:3b:15:eb

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

6226

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCPInfo GetACP GetOEMCP GetProcAddress LoadLibraryA MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW lstrlenA CreateThread CloseHandle HeapReAlloc VirtualAlloc LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetCommandLineA GetVersion HeapFree HeapAlloc ExitProcess TerminateProcess GetCurrentProcess GetCurrentThreadId TlsSetValue TlsAlloc TlsFree TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree WriteFile RtlUnwind

user32

GetClientRect LoadBitmapA RegisterClassExA CreateWindowExA MoveWindow LoadCursorA BeginPaint DefWindowProcA DrawTextA EndPaint UnregisterClassA

gdi32

SelectObject Rectangle CreateSolidBrush CreateRectRgn FillRgn GetObjectA CreateCompatibleDC GetMapMode SetMapMode BitBlt SetBkMode GetStockObject

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysAllocString

Rsc/Img/DAMchrome.gif

SHA256 9bc8519317c429122c88d116bcbeeae0b097fd321bc103d9f25e5be1083f8118
MD5 5373dbab08547a0f0d9daf87bb86d9a2
SHA1 18f18b7774e225bf0ec574175065fcf4abf09149
SHA512 0d5898f004cc17340f6c9308584119bc27556bf5011fe55422af8643a5adb4791e6dd748ec4d13b83b57e8e6e5bac4801d1c9a2a61dc5cef269179cb9dafdfa1
SSDEEP 768:CXnFXIojjV/xGN9m6lK/UOxvRePQi1tMOarwNwi+Sfor11t4S6zlmAOoo:QR91xGN9mjUOhYtMOarfX3OSAmA+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rsc/Img/DAMfirefox.gif

SHA256 9520ba714da28958015dbdefc5cff31c392e7f6b5c66e5d2df4c4c48f7e58223
MD5 d7a4d039966466bdbbb2dedb6026c582
SHA1 2fa913238de077e63543742f75d8193c20a85349
SHA512 262398a377bd72d081b64291960374b802394bdcc96025f260f08889011ed6ae6a024176cf35e5e3cb44c6ad2d039c08f0ac9221b7caec4135cc7970f707361c
SSDEEP 768:/SaXtBaLWHxWAfOzQdKh4/jgiqQWsJWcEN3bsRK/sKDwmlldgh2nJd:qmL0AYg7gin/JWcEhbsRKtlldm2nv
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rsc/Img/about.gif

SHA256 f4b7933ab46cec0d72576f7ba84f5848b42fd65b0bfe73507d1d8f115018f353
MD5 6e11143129683a2be7f2871103f204f6
SHA1 597acd3398b9ec4668340355a59951a6da91d96a
SHA512 b438cd116ade0b2715b43d4c8d47ba8c7750656f960c8e94765381416bfdfe94edb02c9fadb2bdb12ce1b4b190c4728697e74ad97a58831b06bfb4cc21d964fd
SSDEEP 96:S4ln+gGxHMnsqOtCXwRm3A5RDZJPyc/+L4iwWojBKTe6MAgYhz1yJ:FOx2pw0Q7ZHmuETxoYnw
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rsc/Img/mgrabber.gif

SHA256 13d54c1d654f531d18fec7b7533a38585cd2cd60c1d72d74e39af279505df3f2
MD5 b688d20d75588d7893339d611b0363ed
SHA1 f609c5ec347b0dffa94ba40635966e7b6dc3ef6b
SHA512 3f493fea0d08ed9e88f3f03bf371cf656e5b4ee8b64dcd5f85eb54137c9359d54d2cedd22943fb2a3cdacb7fd91892c8f886a267773e0e047fe403e3a7e3ba38
SSDEEP 384:cspjUUl3J6KFS1RMgHWzrnDmeXipTRX8NEnWKBUoiu:c2Ua3JVo/JWzvmXJhgEnWKBTt
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Rsc/Img/ultimate.gif

SHA256 438d3424897fd93756983f460ed7a76591607f828ce313e55b901438a9d5c4d2
MD5 8c9c6523611bc5f93b28842f9a3370aa
SHA1 07535fb53760f6e01e8a48ed39ac1c3ea4fb6f95
SHA512 fdd7ced3bca0e02f9554eef360e34214f674bc5377c31c5706513f2f5906827022433d5b5f0520809d35edb87d30ddec8633ce153f13e73339e5fa7a679a54b6
SSDEEP 192:gm18fHy6Jjx1GdGfXS/6tuq2jkVWfNT+7MYEaeUzBNVy9ZROX+Gihw:g/fHy6hx1ZfXkkCkVWk7nVVznVy9ZR3c
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

WRCsetup.exe

IMPHASH 4f67aeda01a0484282e8c59006b0b352
SHA256 619307eacbb8603fdb6816a633cf4a7526c89376e478580121812f29d86e4df4
MD5 06256226575762b15fc6ad07c3ad5690
SHA1 a2c448dd469b91f521009eebea2b0cf9815ee2c8
SHA512 98c0d39343bb7f43a8eb9c9620e48d8708d83f4495810d9d2023ce6706555f3a7784dceefc64188c1b5957340e6962062be2db2b15c8c4401306160e016f9c78
SSDEEP 24576:goJg8eVlSY6jXBYBDa3b0Sy5jMdwx8U2/EOUYN+HoXT7MrdsuoU:gni9MDaLLy5jNTROUc+IfGWdU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

8d:44:95:5c:5b:e6:02:d0:87:ac:e8:10:20:01:df:eb:60:cf:e4:ae

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Minor OS version

0

Major OS version

4

Entry point

12991

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA ReadFile GetFileAttributesA SetFileAttributesA ExitProcess SetEnvironmentVariableA GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion GetCurrentProcess GetFullPathNameA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress CloseHandle SetCurrentDirectoryA MoveFileA CompareFileTime GetShortPathNameA SearchPathA lstrcmpiA SetFileTime lstrcmpA ExpandEnvironmentStringsA lstrcpynA SetErrorMode GlobalFree FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GetExitCodeProcess WaitForSingleObject GlobalAlloc

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteKeyA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyExA RegEnumValueA RegDeleteValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/Dialer.dll

IMPHASH 1f1fddd20def884fc86e064d8f2333ae
SHA256 12d83a9f3ccecd272b80378da2b3d02466e6710f49656a94ac1b6978dab8a061
MD5 524704d4b1aa595eb3533bb372ffad94
SHA1 50164fb0e215684a6319b5d53869833302ecf7f5
SHA512 9dbc57aafa05c1689d27a81df0e828d2fffd58c1228bad2266e379eb316971168e49dde59e67c62938965f761b9e00345c97e3b53f1e50b30d64c769219531ff
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/DotNetChecker.dll

IMPHASH eb50afd0a71d03e52fd6e17407e6715d
SHA256 45e15d319084e019d4db5a3081533ba8c032308cf35384abf8b65ddbac6c5f9d
MD5 e02ed575cffbc793af912c5541c7ffb3
SHA1 1fd8f5ed9417b3804c1fbd18340eba4d09326f60
SHA512 76804c9df7f97dc50ff375d1f1d972f2d20b57e2c543986a47de61fc2a0ec87225bc22d69ef31a37a12ecec46e477595184a964587ef469d6b0698cd71ebb5f8
SSDEEP 1536:bg5jFZGXKkwO1V2+XDlM7IVNBNN4GS0CPrAm0dgKQUDs0OsWPIcdngsi9eJ:byCC7iN4rrPhKQngsi9eJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

6

Entry point

11854

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\WK\NsisDotNetChecker\plugin\Release\DotNetChecker.pdb

kernel32

LoadLibraryExW GetProcAddress RaiseException CreateFileW LoadLibraryW GetSystemInfo FreeLibrary SetErrorMode lstrcpynW GlobalAlloc WideCharToMultiByte MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameA HeapFree HeapAlloc GetStringTypeW GetACP LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStdHandle GetFileType HeapSize HeapReAlloc SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx CloseHandle WriteConsoleW DecodePointer

user32

GetSystemMetrics wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

$PLUGINSDIR/InstallOptions.dll

IMPHASH 610235b90207a63ccf481f0d4375d329
SHA256 fe19353288a08a5d2640a9c022424a1d20e4909a351f2114423e087313a40d7c
MD5 3e277798b9d8f48806fbb5ebfd4990db
SHA1 d1ab343c5792bc99599ec7acba506e8ba7e05969
SHA512 84c9d4e2e6872277bffb0e10b292c8c384d475ad163fd0a47ca924a3c79077dfde880f535a171660f73265792554129161d079a10057d44e28e2d57ebc477e92
SSDEEP 192:d4n3T5aK+dHCMR1aQR9RuZl3WWmU7WYZsw1JpVGnrjsK72dwF7dBOne:Wn3T5KdHCMRD/R1cOnrjs+BO
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10722

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetPrivateProfileIntA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileStringA SetCurrentDirectoryA GetModuleHandleA lstrcmpiA WritePrivateProfileStringA lstrcatA lstrcpynA GlobalFree lstrlenA lstrcpyA GlobalUnlock GlobalAlloc GlobalLock

user32

MapWindowPoints PtInRect CloseClipboard LoadCursorA GetDlgCtrlID OpenClipboard GetClientRect SetWindowRgn DrawFocusRect LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow DrawTextA SetCursor EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA CallWindowProcA PostMessageA MessageBoxA GetSysColor CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetWindowLongA EnableMenuItem GetSystemMenu GetClipboardData LoadIconA

gdi32

DeleteObject CombineRgn SetTextColor GetDIBits SelectObject CreateRectRgn GetObjectA CreateCompatibleDC

shell32

SHBrowseForFolderA SHGetPathFromIDListA ShellExecuteA SHGetDesktopFolder

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 fa4ab1d6f79fd677433a31ada7806373a789d34328da46ccb0449bbf347bd73e
MD5 3f176d1ee13b0d7d6bd92e1c7a0b9bae
SHA1 fe582246792774c2c9dd15639ffa0aca90d6fd0b
SHA512 0a69124819b7568d0dea4e9e85ce8fe61c7ba697c934e3a95e2dcfb9f252b1d9da7faf8774b6e8efd614885507acc94987733eba09a2f5e7098b774dfc8524b6
SSDEEP 192:OPtkumJX7zB22kGwfy0mtVgkCPOsX1un:/702k5qpdsXQn
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9995

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 2457671c10c5aa708d9619798ec0139c
SHA256 6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
MD5 acfb66ee6fc1f4266229ec6098fe1740
SHA1 e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA512 bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP 192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA SetLastError CloseHandle GlobalFree LocalFree FormatMessageA MultiByteToWideChar GetLastError CreateProcessA GlobalAlloc lstrlenA GetVersionExA LoadLibraryA lstrcatA GetProcAddress lstrcpynA GetExitCodeProcess WaitForSingleObject lstrcmpiA lstrcpyA GetCurrentProcess GetCurrentThread GetCurrentProcessId Sleep CreateThread GetStartupInfoA GetCommandLineA GetPrivateProfileIntA GetPrivateProfileStringA FreeLibrary GetModuleHandleA

user32

EnableWindow GetWindowLongA DestroyWindow LoadImageA SetWindowLongA EndDialog MessageBoxA SendMessageW DialogBoxParamA CharNextA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA SetWindowTextA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/makensis.ini

SHA256 ae10f55e6eee0c64ad9dc5ab9998ed8dde13f3ea050913b66cc5350db7a6385e
MD5 ce819cc71c59c4f69933159285e8e727
SHA1 c1ef04ebd08a47b794e831c149baaf525a91fd87
SHA512 091b9b7f730d79041648332fed6925d3c0d7baf53c6388b08fe2d90c2b6ad89e61a7e68461b1f114521b63c62887103bde66ec615cee42a3a5f4e5c1ff5cc2d6
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 acc505e51af2910309fd92afd742d853d1d52751c52a26cabcc05a738c377c96
MD5 2fb0cd24d2642464959ecca1e283d9f2
SHA1 f9159e67c46ed0d2809bbcd48546b1509b755f3b
SHA512 fed463369c71b56594ea7796d706fbefd8c591b86d9ef083efa7c2c227ff3da60fdb2a891f1d23dd0de1cb86a3e12f8e39ab0172e015bd3925a8f214693fdb31
SSDEEP 768:2TBLTFTRQyMfCmF+44444iFo4SDYg444p24GL4Y44O444OU44444q4444494444s:SRTFTRQy5pkl6k/5P
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/nsisdl.dll

IMPHASH 35098e8775f91723e90a28745ef6495b
SHA256 9de492995d2180635aa3194b88ce6dd94e0c2b001af5952a73d4a84fbc32b6ab
MD5 41f557e065b405f94d0ece8b5727233b
SHA1 c6d1704eefbdfe0a7d4a03c65acc70cdde883598
SHA512 43b35b2366ba54593087c8c9127da5acc8efb45ebb84603138027692877173294b7478f8c6308ed9b168813c7b6d5f2b8dd261b75e58d0c97440baa4d0fbe493
SSDEEP 384:4ck76gi51kE5aYOMLDC4UnDp9B0Jc5HNw2rE:4ck76gibLCMLDLCx04HNVrE
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/registry.dll

IMPHASH cd53277eaa7bbb8fb5b2b678274dcb4e
SHA256 ae53f8e00574a87dd243fdf344141417cfe2af318c6c5e363a030d727a6c75d1
MD5 24a7a119e289f1b5b69f3d6cf258db7c
SHA1 fec84298f9819adf155fcf4e9e57dd402636c177
SHA512 fdbbedcc877bf020a5965f6ba8586ade48cfbe03ac0af8190a8acf077fb294ffd6b5a7ae49870bff8cacd9e33d591be63b5b3d5c2e432c640212bdcd0c602861
SSDEEP 384:Bl1fUuJHxreh2OatbswPCr64oLchV0oLQYYfVB:BlBzHxrehKbswK2TchDLQZfVB
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5428

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Browser/Images/Thumbs.db

SHA256 6e383d3020cb88d27944fcb5b5ddbbbb3e04b6cbf2a2274dec5c6117a47ef2dd
MD5 b11c4fb518289599e69b5ca4b38fbf94
SHA1 eaf26d89639971b384b54eff26ecac9f7c5ece4d
SHA512 e1c19ce2788ae430765815c21d87341501fbc6d850bb5a9aecd75c577defec1c7878aab62e1224fb5add077d6117d78f4921efed23881d1d5672c5325ec3eb2b
SSDEEP 384:LYO+2GVJkCVf+lILx2nlSuRgRXpCH+Ok2PYoPvwRq+:8L2kOCVmlyZuRACefMYoPvw8+
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Browser/Images/copy.gif

SHA256 18eb6d2472f8b7d985f315f13992523352faf8a3eabda89ff0f6e995a1334274
MD5 60c5887d20b1d865cf2fbeefc2f7b433
SHA1 8e4b3ba9a3c9eb86e89a9360b412696c12aab9ca
SHA512 05d7b38d1c327c781455b66b5a4bbd33030fcac407cb7ee5df222594cd609bc13d6453df73d2a7d881e7487ced9aaed5facaf6a692a344eb5fc299098ce0a348
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/download.gif

SHA256 cacd2237806d0a2a1f737efba9252b88bd9dc90184cb6a2f03d9cba7e50cd3fe
MD5 3bce075da3a0a79354f0c48444b6c81d
SHA1 3a690c6cb0a0594c2f7df17514a14ebab2df0fc0
SHA512 31aac0a4bf4282526259a00c4ea200b5048f10dbc605580d72209ebc6eefa232bba089860d3c7761f92e7fa3443c4b3a570fb4f1015e0bdaab4e8e516e9c293c
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/exit.gif

SHA256 2c423c69f91ac29a8a1d10bebc12e98cffabdeaedeb84ef968341d0c947549bf
MD5 8c8a8018f19ab2f8fb7235d95c33237d
SHA1 edf132d91ef47c1bbc99106bfbffd1e1d97ef669
SHA512 1fa0e578ff37a5795e0937bc820ef2ae2a2aab100d62290d987a55d03d0e47199540434224dad3f087e64c6e9f38e223080241f72766c639ae0ce098fd077f16
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/explore.gif

SHA256 ec9de68630f10caf52364bc2267423b42f56a6221a5c04f2105630e8294536f1
MD5 7aa6a450fc60c3586f76ca810b1f2a94
SHA1 fcd3dc255eafc5e436852ec85ca426fad3c9694b
SHA512 59cb8a0d0f2be59c8f984e2471740286cae5b0e974e440d5c26c8972e2393fb12acfcf5ab996dc622a37b2a0b4560522ca2caa20813edb98997b8c6cffd46e83
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/hd.gif

SHA256 ffb9db50fa332ff3e9034540afe77b71db1bdeb327622d94cf3071914472bff8
MD5 15175e806f66b156f5b7d420287986aa
SHA1 808472f2c17cc3c5752657683a49c281219142d2
SHA512 074582d621e6dbdf13379aa79c9007f8bff34112ea983c1718af96c857acb761f49e37903e4e8436860524a169d59232416e95b566c63ddd8c6b6b7232d556ba
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/help.gif

SHA256 0faf00bc0912b7e6580e4e14bfa24213bf29e6a9b1cf12875631df25a7e0c906
MD5 a5c41d75603436cd7c5ff5506f6a9a0f
SHA1 ad5cf106d70177a1a009bddff8099324270fc4c7
SHA512 e19328c0ce572d5afe32cae92c66b9f6bfb9100e71ff15968c6874604a8e451033c2ec221cf85863c8e46daa701c5d35626b0c703a34c27b208572ec64fafe74
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/logo.gif

SHA256 b0384b74853e96d22cf19fbcc56ab44c06710d0b4d3b96a61baa73e543c76636
MD5 785b28856564f38595410dd99e95af2b
SHA1 03f1480024d184a1b7be714284f32ddb1fde9c4d
SHA512 9269c85993f82ff37c1ea443e3cd819c7a9ffc0ffec559bd0e28f6e196e2be13068cfa1154ea025ee735138910688b72ea406b79167023631d64554b09200b39
SSDEEP 96:sCx59YOjGGY22z3hfLKEzhERpmgVFkDAXqzeY7iJIOKcoGpPTJStrbUsJ:OG4hTnemgEze+iJfJowLctB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

Browser/Images/mirror.gif

SHA256 4e52f87738152d81e134e8d7ffe6e30de169ea9241a2103d3ba74dc3cbc726cc
MD5 2d7717358a0d06e24758b1b159963856
SHA1 ed575598beebf02deaf9e872fb0e287a6f5bc353
SHA512 1ced766eac8ac2a9afffc3b97e0f66499459fd5c87b34264ae350afa475519b3e358e135c24102d9b239edb8f5d464e404cb9e1a367d4880d77f3bd56c7d13f3
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/open.gif

SHA256 8838751ab5105067aab66af7b6b21a5391f8e013e0dbafdf4c17a95e9128ec89
MD5 ccd7361bc58fcc94f010360033d6576b
SHA1 13ac34c508c632c5c70401071dd722eb1a6889c8
SHA512 e7561cf7062bd2a50465ba02778345bdaf351f5319cd1340c2cdc611c7e2f1e957c9eb0152e35cac50e547dcf508d198a7fc9e9895c2ebab7959a5d6ffdfebc5
MD5 SHA1 SHA512

NSIS installer

installer

Browser/Images/search.gif

SHA256 2ebc068c5f5a3fe6e496a4800fcfa87c137c491272e8f2ed2c6d1751e24e3359
MD5 079793a3ec488db6ac297adf093d13ce
SHA1 be06ffe0bd4188dffbc15c882f9b8fa617da7f4b
SHA512 9320df1e1c04bca2dc4808db11b32cfc689db634546b6e0037a9bb6f4fde54f323fc08c5b0264e233ec39f38b9bba86b391e92957fd3da7e7344e345e4a7ded4
MD5 SHA1 SHA512

NSIS installer

installer

Browser/welcome.htm

SHA256 eed6c5dcb6391fd24a4ea8c75eac40d75bc902b82a7fd9aca26dd3616a8f7668
MD5 8c5877bbeefcc9ed14b4add1c2a47bce
SHA1 2553a05428b6a12b5de0a79f320dc94531308895
SHA512 55a3c1a056a52eec5cf6f45074c0d800833899597eac5ca1f7aed756c2fc6aa550048265664affae30a5fc06a8416cb46d4e3e9c360794b33425494ed862b218
MD5 SHA1 SHA512

NSIS installer

installer

Interop.SHDocVw.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 92284e1efac3b672b771c5b0e6dc98cb47f0f72a7515c57dccdc6377abcf6bad
MD5 8ccb83ce1aa58cde54bfb57fc20103d3
SHA1 97462dc9aeebea2e1f7f55ad6129dc48cdc4952e
SHA512 aacf5ad4f58417677009cc7054f9ae437a64d789465172e097c140164307b5675c10a06e6fdffb06547fcc5305141608ebcec5cd0cecbc2d7c18d2ea3c37a8f2
SSDEEP 3072:tTm5EBv6r4BO/MFCzwpWHkNPLbSVoDuxU/6Ng7WpsXilYT+BEPKdQLm5cnRKJZt0:tTm5EBv6r4BO/MFCzwpWHkNPLbSVoDui
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

122638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Website Ripper Copier.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 19d7fc24e2fe0aa138e8084ff2a31e4e249263382bbe37924c7cc7631f90b4c3
MD5 44c05bd9572ca7bdcf3bf141eb40d89b
SHA1 d4a676ad1f4d9adcdfc1677ee57f8071c1a2a899
SHA512 2829be6545de3f9e465453c3aef17248469da5d97c36af2e56dae211daa2fa9f15179a5aa5a78fceb63f03f08dd340e1d7373f25b689fea5e323023aa68c9214
SSDEEP 24576:5HrAOwbUyllw7KGZpaBgLnRIo1HcvEy8ohpUwST9yBBjZXn4ItJVxdrOeZpCbmxA:5LAHUnj5DKENohpUh9yBBjD2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

8f:85:92:e2:1e:5b:55:0e:44:a2:28:1d:25:2f:97:9a:57:a4:61:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

2427102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Website Ripper Copier.exe.config

SHA256 474402089c08f2ae11ca7ee08cb64828f8bdd88407c0e63a09f2150ee55d386e
MD5 9aae4086520d67c5ff9f05d29f38bc6f
SHA1 a2f991ab0ac16e5dd3a2a387a0965428cd17bbe2
SHA512 0b16dbdce717ac7d3b8b817ca611a5c7046eea373cda3644a7653ef50233d75103f807f47cad1170cd2682c65a0522509ce24b0a2c3ccf57e08810def19fc462
MD5 SHA1 SHA512

NSIS installer

installer

help.chm

SHA256 be89d65b933a3ac418972e9a5965d9c93068e994328bdcb0e48b9ff00142e217
MD5 b1731407db55d5704d3e57fef603b753
SHA1 947f68142b3066d9883e538f4e84e400bba0bf23
SHA512 c414b3ae0888a24e078bc0c59d35e9c7f7b7f554be21882efbfcacd2ccad9f556f333eda782226d7cd703d5269ade2f94bf4b0b51216d81841a9997cfbf94d97
SSDEEP 6144:Vlk/+pd+gY1mBpvn2qD1d27I+Zof71Kam0Q:Hk/+egYmTOiy7B6RPm0Q
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

icon.ico

SHA256 8e6cf07850a2c169eaa311a4c99e805827cb95b140ea7dda4d631a2d9db2e62f
MD5 63d769b0974302a91bc5129966d4dde1
SHA1 5a120bf1378cce1aff0a4507dd8a4ba09e483f25
SHA512 2ec75b1d9f9603da4ad55f71d4dff40ac706115649d50497e17108aaaa2a311f3ac0e35bb8c6357f21539f80f9986c9ab4ec67707e8b68b426a52c7a9c05c90a
SSDEEP 96:JoHIT5qF+kdLMaTRSDZ2Ot3FKRs4Tl5j0+0YV59UgloCP7OMY/bhlAhE+qave5FX:JF5qF7dXO8pl5jH0s5zY/bhlMq8eL+U
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninstall.exe.nsis

SHA256 431c93512e78ffd74148b58090cfa8b1e07e16f67a1399698fb10865454d5052
MD5 4ca96267792a2566eef0f462d48c44a3
SHA1 ed37089ae68a6ce0200369c4a4330c38f5b83b28
SHA512 e9d78fabd19814ef1557f389c0f1166c1d3156c719319e5dab2f84fbe1bc19984109c6e3ded1ac5344504dc52db1eace65400ddb73cab5eb4700091cd25f91ad
SSDEEP 384:dqNjUoHbCOEMgGpKEOIa61vplpOzB9fSwStoAM1W94/SgIBk8Ww6jkbZ6gxC:dq9Z7CIaqlA9cwv5/1IG8WwF6gs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

addAllUrls.htm

SHA256 b7f4e3947812f19271d39ff60ba29a4eea3d50c08490f43986ec90f2bc4911c5
MD5 6dd0e1a1a45635fbb4a716fed735b5bf
SHA1 22d6668838fdca5a05b59b997bddeea37f2b9a08
SHA512 8387d609e6f1969b28ce1cb1ab64704f399e668e994a775d06763ad8acdb2d615836591fbb56c6e4b1f69728e03301723b262d86e68108a6f611063ebaad4b38
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

addUrl.htm

SHA256 343db14f926f80a0128a4256838c1239bd5d9b0183a57972b31ba322de61b0d5
MD5 9ae1f23d5c3bd7a8f9827118a1f1a432
SHA1 8c23b2666ae2db7591225a456e22ff1d4fd93624
SHA512 1050bb0dfec9624de4d5bfeed66415399a11343c9c6494ea3c2ad14f72dc7812656d337a013496fc1c72ece8401b1c273248999a6fbaae06d7f776c691cca583
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

bi.dat

SHA256 e08b2a6204f5773220c4943e18632c3f32b6f20aeb4410dcc93845434738fe36
MD5 c35c1a4ac7ce599a91fac26fe57c3654
SHA1 f6bc6a8509fa69d5ec819bc75f0f97231deeb938
SHA512 348d595a08a294e3fa5aeb7a9f1d4c01d77c0057e6da5cd3db16bd7f06c25f0d326b9bec73dff031db37a7c01a44fb8f694ecdd37bf2cae1c31c60ff0d4791bb
MD5 SHA1 SHA512

NSIS installer

installer

cap.htm

SHA256 bc9ab80974436f8e46c6fbdb704f346e16555b732e29a9a577d2faf1ea883909
MD5 7af425e4c0610da09df11f2cdf13d3e2
SHA1 886ad992911a71e36fca2a8bef932c78f29f20d5
SHA512 2446bd8dfda003b8473d02bab3abbe180863a3c74e28a2958d03aeb0a0e92f694b34354ec96a38635de0a58259a46167b7fdc666b701e2de8735939282c85ef0
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

dam.crx

SHA256 ca9fd372f6840599d2454ebd8a24e423cf6c6ef8c5db824aeab6a846bc78645c
MD5 77cdca059e3d68802e25c356741dcb96
SHA1 024ef35dfcd03f04136cb4d2afabcc0ec376b81a
SHA512 3200f7076a222c3721a0c6776e7613f01780b2dad91e2b999a82ef1930946d995711deed9744f0424ad4f152be2664b4abb59375cb26974067a2fc2def3e20bf
SSDEEP 384:2ZK00ZHQhwB+uQeSFQWZ3iR/1g4D29rkBKxlFqH:2ZD2oeSyWZq109gMzqH
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DAM128.png

SHA256 62c492401b9d8d1fe130c4fb15c355083294708cea039f134eafd79b0f9c3574
MD5 4df82334a5a02e5c8ccb790debcc6a6b
SHA1 5a5ba8d246040d50498a530cfdf2c6019f028f43
SHA512 4ecd44f69b9a64f33a49a9373c89c1786b8fc1d5199f4b41c4a452850fda823ac57223765509c69b9178ad06f9bc05ce18911242c111a1da9255ad34b6a98cef
SSDEEP 192:zS2sth8ireJxCH7QigxiAuZvtv/eeqizaXDq17ignCyB03liG:m20eXioiL1sizaWggHB03lp
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

DAM16.png

SHA256 a3f3291a7b324d3a748b9c7da8a5b186b0f0828e2d0a3c02856cc547faa253ce
MD5 a18d3c39ed1a16925064ea7597651460
SHA1 2e1e28bf74eddcfe213a890450ebedbaa318294c
SHA512 6916d381361771ca259b77e3c31079964f3a1b7339eeda612090356c7b7deb6bf54dfe270124485cbcbb50bf165e22e06995f43785305a533a311e6d1df7b3f8
MD5 SHA1 SHA512

NSIS installer

installer

DAM48.png

SHA256 add8af097b89db3c59f9f9accd7268cf3ad002c89b90d244eb0ff5a865f21fa3
MD5 931a9b8995e5a281ef41b0e8c200ccf8
SHA1 04c779f15eda7533a96a6ec857600a44248d99e7
SHA512 5b5fce49c47b6887873ab517a4c3d935070ad82e83e66cced0598394a8e9dce56a4724a21db8af7fdd2aa26155be33a5754166d67fd367212a0d8edc9f170cfb
SSDEEP 96:fSJu+3G6n7bVl8AhBqwkHU/bEoUYAb7MC5/qi1uz0+LwhoT:fSJu+2cbH8/wkHU/bNdAnz5/qiQz9Ek
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

dam.js

SHA256 ec4df3964e36ac087b80cdc744ea89b5dc1667aeab67b3c92909f8afbeb8909b
MD5 774bf63f5fd0696d3f9220badf27b6b0
SHA1 b9704263d7e4159cc1ffb779387686e31e0c133c
SHA512 e8a3788882b2d241cbe20404321f22259d9f1df7a2116e8a6449c33b00f9791a4ad59b1a2450f642aa444ee441684a8e9dc483518239c4c43f35524799b3ba1a
SSDEEP 192:MzqMtANArvD324/VXOvw8+AaBe9Cl9y971HKKL1P6bZN4pXbJdKUK:cD3zlOvw8PaRyVybZNcMB
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

manifest.json

SHA256 2ef2246b5e4f5227191d469743dab57ba7df988ac9785d9b1e1b46791945187f
MD5 244b3ec0d0e35718d539fc3784136259
SHA1 6304921d0bd8da352a9faed0db136d2efabc6714
SHA512 6abd989e9c057d9fc15f6e25912e7df5eddf6b78a76a8780860131c7df649d2612d141b307b84b9c992f15ff89601a36ec101064443f8d547ba3d5632410df8c
MD5 SHA1 SHA512

NSIS installer

installer

damfhp.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 30c922879f8ec97f3d613c4a8e8ef2cb2b534d323d3b76a477159c83598d45b8
MD5 da809ac20816ff3435aa7b903c71bd98
SHA1 d052d6a4786e7bb3ec96528c376203b07aac3cb8
SHA512 c66452300f007818613204c70c601fc40e2cd00ac378926366ee2ab5fef6325909c477a80edb4da4fa27b283b47239604211ce738835a7866a744dbcfcd0d831
SSDEEP 1536:0CsBhM24OCJIyQXnCkn6POWnosPsoFTInBvNyKuSZ7zAwotQEgNriWhj:0nhM2owqnpUyYUwok75
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

70:0f:37:2a:16:30:ca:5e:f8:c3:b2:99:8c:f9:a4:e0:33:d5:0c:bf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

95422

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

damfhp.exe.config

SHA256 f4ffcc01ea1c06be63c18d343187ccb5f2f5885f1780218780f92214415e9c74
MD5 7ed00198dff303eefb49e046562b5b7d
SHA1 f2a14ec5d2b7717061b77769067f93295f1fbc8b
SHA512 71a2e8769e28a7dfe6d387bf3bfb0961af69d5bda7b6acc37ad6095581f02254e8d3be5b9583dfb39e34566f37c4fc54aa08f39e68ed705485519e7096b35ef9
MD5 SHA1 SHA512

NSIS installer

installer

damhlpr.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 464f31a0707a9ac8eaa65f124463588057a88ef9ad795df7f351b3713db51b2d
MD5 565c8d375151e990ff3c7e94482e15c0
SHA1 f382fac6289e47be85ef583334786970f59a2843
SHA512 8c722be4f6018ff2ee388a4f8ea05d58295fcbb886de5a28c8605933fd9868ceb9e940780cfff0f64bf1b46c7b48fbec72a44f1038fb6a6ba072519f2a63f427
SSDEEP 1536:RVj9GiMGLz6yYsLyveTvxheQH2ZTZt4+gFDs3riWhk:RVgiR6r6yShLWZFt4TFDs5W
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

85:fc:c1:0f:19:3e:d5:fe:19:92:bc:95:17:48:13:79:b9:33:c8:15

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

88030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

damhlpr.exe.config

SHA256 f4ffcc01ea1c06be63c18d343187ccb5f2f5885f1780218780f92214415e9c74
MD5 7ed00198dff303eefb49e046562b5b7d
SHA1 f2a14ec5d2b7717061b77769067f93295f1fbc8b
SHA512 71a2e8769e28a7dfe6d387bf3bfb0961af69d5bda7b6acc37ad6095581f02254e8d3be5b9583dfb39e34566f37c4fc54aa08f39e68ed705485519e7096b35ef9
MD5 SHA1 SHA512

NSIS installer

installer

damhlprf.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b9c04118e41d72fa64a8a45e6fbe4b7b92b6800b6cfc3bd33ab1f31302e0aafe
MD5 f6e6f0ba9e6ef23fe62be3c5e9dae52c
SHA1 8689c6b47df7c962f23fa44404fefd239a67e9c8
SHA512 66983d33789a72538b1a6c15aecc6c7249f8df9ef96eedc5556fcb7b810cee9ec35cabbec587bea1344315f8213054fb703cb6471e85330ce877aae13db66e97
SSDEEP 1536:i7KlFotJjm0e7JTOL/+0mB9rV72VEVzHB1Z6KUPkVgRriWhT:iIWt3IJT8+0mBeuB1Z6K0kuXt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

Digest

5c:b0:af:cb:1f:e6:04:3d:12:9c:a8:a7:e7:15:7b:26:bf:0f:af:37

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Chains

Jul 26, 2017

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Subject

CN=COMODO SHA-1 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

16:88:f0:39:25:5e:63:8e:69:14:39:07:e6:33:0b

Issuer

CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 31, 2015 - Jul 9, 2019

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 30, 2000 - May 30, 2020

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 9, 2013 - May 8, 2028

Subject

CN=Tensons Corporation,O=Tensons Corporation,POSTALCODE=11223,STREET=PO Box 230092,L=Brooklyn,ST=NY,C=US

Serial Number

b9:11:cc:70:38:ea:83:2d:7c:fb:12:52:5a:fc:c7:a4

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Sep 22, 2014 - Sep 21, 2017

Minor OS version

0

Major OS version

4

Entry point

87550

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

damhlprf.exe.config

SHA256 f4ffcc01ea1c06be63c18d343187ccb5f2f5885f1780218780f92214415e9c74
MD5 7ed00198dff303eefb49e046562b5b7d
SHA1 f2a14ec5d2b7717061b77769067f93295f1fbc8b
SHA512 71a2e8769e28a7dfe6d387bf3bfb0961af69d5bda7b6acc37ad6095581f02254e8d3be5b9583dfb39e34566f37c4fc54aa08f39e68ed705485519e7096b35ef9
MD5 SHA1 SHA512

NSIS installer

installer

dhl

SHA256 f5b162769af1a5e14ddd3ddd801b7eb7b9fb0b584325e77be1f9d03fb61850dc
MD5 455df8bf3c9f5e1ad0c7d9b0548c67c0
SHA1 56c813db3487535693a410aa5e40133bf8c48d79
SHA512 39d12ac1fae220c016c7326f89a30862b3e481b19f5051d7a880168467e284ccbdabde6982444d3c1ce282df5c1a2c4de9c5d41b6ed91a7b80083d762963f0a5
MD5 SHA1 SHA512

NSIS installer

installer

dhlf

SHA256 3558bb554bd841fdb1275d2d39b6c133e9f83a4684c01dc53c2583f3eaa6ff9b
MD5 c6d1cc9af5ca243483e30f5bd2f73129
SHA1 17dd82f4132847e854733c02febee7d17ab692d8
SHA512 98f06b1a8c5e0b8d00af6110e538f1448f07f5ea21882147701b61a9f997dc2bc44ba06b11f191d6f2431f6e8fa9df92e5401cd5532a1b0a116cc421c3f2022d
MD5 SHA1 SHA512

NSIS installer

installer

help.chm

SHA256 d351a2e98da687096d531796503481dad67c5c356d66dc4e55c4a864103ec7b9
MD5 07e4f3d66e7b30a5bb7fab51a749a818
SHA1 329a842b77a29b3aff96284c2055c180ce21edc8
SHA512 7efe7a5c3ccdcd8c84ff04f090dba7602dd683a53a96daaf4a762c9857380b8f4109dffa22f8676141c433a63e4a8578b343be51e4d8e45ad61ad8e9c8e86299
SSDEEP 1536:CLKaBbSJLlXhy3t9B+JIHzWqnigCcNd4Ycjx1CkAtKyG4zUWoThm:C/cxyV+DqixcNd4Yw1C3t9j+m
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

reset.reg

SHA256 30345397a0d489b1be0b93bc1865fc6bf943757af1210988dea1c7a0503ed499
MD5 cc504eb51a793caf0a1852ebaf3c9dcf
SHA1 8119be5a2e6c18a4ae083b8d8bdc11250fc4cd51
SHA512 e54e47a6c1d30a470866487968f92d8b08df18b015b66b363553970ceec4c0ace938a92d71ab958f1aff4191dbc59cbb2dc569d756188864426cce0b6b98ebd3
MD5 SHA1 SHA512

NSIS installer

installer

runMg.htm

SHA256 24de1a19f395e66b582291021ea386d750957181d80b741a1691287349549b48
MD5 2395bdf7aa289abf9f34b434780e4aef
SHA1 88037c56d142a1374967c98ad0175d2fb2abde7e
SHA512 6bccde84e6af09ec233565fd53851031124efe7fce6e4c85391fbb9d889911a00d33835c7bca85a80dd5c602251d0db85bb18cd82335ba5ba21fa80239c2303a
MD5 SHA1 SHA512

NSIS installer

installer

uninstall.exe

IMPHASH 57e98d9a5a72c8d7ad8fb7a6a58b3daf
SHA256 7968410ab36967046654d3383f3996050b6bd744a3579478acfefe5be6d1f9ab
MD5 5d6cdf5404bc81ba017c0b4f8a415cd7
SHA1 d32b8773af40d0a6fb4c88651b9e34ecbae1933c
SHA512 06b589ddc7e88d2c505e99568d60ea33841b30ed2daccce28a0e1a5b42d91377440813dbfcab8f7f8374db501039d989be5747ed9476fdad2dd0bf89e3942777
SSDEEP 1536:YdYREHv9Um7hsdyczLT9qhWnMrU3FYS5kZUmmBfo5z:YduevnSQcrUhWn/R5kmBg5z
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEnvironmentVariableA CreateFileA GetFileSize GetModuleFileNameA ReadFile GetCurrentProcess CopyFileA Sleep GetTickCount GetWindowsDirectoryA GetTempPathA GetCommandLineA lstrlenA GetVersion SetErrorMode lstrcpynA ExitProcess SetCurrentDirectoryA GlobalLock CreateThread GetLastError CreateDirectoryA CreateProcessA RemoveDirectoryA GetTempFileNameA WriteFile lstrcpyA MoveFileExA lstrcatA GetSystemDirectoryA GetProcAddress GetExitCodeProcess WaitForSingleObject CompareFileTime SetFileAttributesA GetFileAttributesA GetShortPathNameA MoveFileA GetFullPathNameA SetFileTime SearchPathA CloseHandle lstrcmpiA GlobalUnlock GetDiskFreeSpaceA lstrcmpA FindFirstFileA FindNextFileA DeleteFileA SetFilePointer GetPrivateProfileStringA FindClose MultiByteToWideChar FreeLibrary MulDiv WritePrivateProfileStringA LoadLibraryExA GetModuleHandleA GlobalAlloc GlobalFree ExpandEnvironmentStringsA

user32

ScreenToClient GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard PostQuitMessage GetWindowRect EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA ReleaseDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndDialog RegisterClassA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx GetDC CreateDialogParamA SetTimer GetDlgItem SetWindowLongA SetForegroundWindow LoadImageA IsWindow SendMessageTimeoutA FindWindowExA OpenClipboard TrackPopupMenu AppendMenuA EndPaint DestroyWindow wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation ShellExecuteExA SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA SHFileOperationA

advapi32

AdjustTokenPrivileges RegCreateKeyExA RegOpenKeyExA SetFileSecurityA OpenProcessToken LookupPrivilegeValueA RegEnumValueA RegDeleteKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_AddMasked ImageList_Destroy ord17

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 153027ec3b10bcea606b777657dd3402
SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
MD5 99f345cf51b6c3c317d20a81acb11012
SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5818

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 8c8a576201f68de1a3f26fc723b9f30f
SHA256 a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 b0c77267f13b2f87c084fd86ef51ccfc
SHA1 f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
SHA512 f2b57a2eea00f52a3c7080f4b5f2bb85a7a9b9f16d12da8f8ff673824556c62a0f742b72be0fd82a2612a4b6dbd7e0fdc27065212da703c2f7e28d199696f66e
SSDEEP 192:4PtkiQJr7jHYT87RfwXQ6YSYtOuVDi7IsFW14Ll8CO:H78TQIgGCDp14LGC
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 2457671c10c5aa708d9619798ec0139c
SHA256 6d7e8070fa09cc4bb66fb99c2b88d0f5419602fa64a519437f430d9378300b1e
MD5 acfb66ee6fc1f4266229ec6098fe1740
SHA1 e1aeb31b11996015d7f17308e2f2bbe69d4e1476
SHA512 bf0b5b22c57c08c88b4cbdd75bdf0c8eac433d42b4d163349391b71bc44d913e4d0e28e0826a7c27b418e6d2aa37c08c90577b56baa946a8f129486fbe01c303
SSDEEP 192:u9ALVfpLcFB5yoMINGXZ8YJJS6gGi21FNZRfUOPwiAGQMAW5s+2oA5D8t8A:SAL/S0xIkZ8CL7hfUOPGMAW5BkDod
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14098

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA SetLastError CloseHandle GlobalFree LocalFree FormatMessageA MultiByteToWideChar GetLastError CreateProcessA GlobalAlloc lstrlenA GetVersionExA LoadLibraryA lstrcatA GetProcAddress lstrcpynA GetExitCodeProcess WaitForSingleObject lstrcmpiA lstrcpyA GetCurrentProcess GetCurrentThread GetCurrentProcessId Sleep CreateThread GetStartupInfoA GetCommandLineA GetPrivateProfileIntA GetPrivateProfileStringA FreeLibrary GetModuleHandleA

user32

EnableWindow GetWindowLongA DestroyWindow LoadImageA SetWindowLongA EndDialog MessageBoxA SendMessageW DialogBoxParamA CharNextA SendMessageTimeoutA WaitForInputIdle DefWindowProcA PostMessageA GetLastActivePopup PostQuitMessage SetForegroundWindow DispatchMessageA GetMessageA CreateWindowExA RegisterClassA UnregisterClassA GetWindowTextA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects IsWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA SetWindowTextA

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoInitialize CoUninitialize

$PLUGINSDIR/modern-header.bmp

SHA256 687888aa7f5f1507076297ff186a1a931a5a2e76b61f1a6f9bc2596dada887fc
MD5 ad9d0d9af9ddc968f2081999bce22881
SHA1 a4914d2f0d7726f4bd49d5f74679d26f34f007b6
SHA512 dd5cb37d8b31b59b4ce321996dd02412ce4e063ef8cf85dc96642ee137f99cbdfedbb9b8a60650b477ffffa78c8ded63ba6129ecfe34430f4a6b65c95588c49a
SSDEEP 384:U2/qSGGP/vF7VdG/vVEkT3Q0/wB2QjTIjgZW6fXMKE9nMzMwF8IhzEPVlm:MqNX0V9vAIjg7XMrGzND
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$TEMP/setupc.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 55e37ec9db608c9dd898e3fd23975503e079a6f5ab82e0f9106014851ea2411f
MD5 62738e8892a6d7b05cbb3b8a192afe9b
SHA1 6546f3fc2b4d1301bbc57ea98e57ebdabcc4b9cd
SHA512 b88a231bfaad80f9c50dead56287d4e2bd445d5471267dcf39805c42abe692225696f7afbafa4fbbf0b4046de38e6f9edf03bed24f039a6d054a29aed4951762
SSDEEP 96:yoQGbu/vta8ksNuLikA70kfj73dteDNdxpCueczNt:af/1a8buLi3eDNdnCPm
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

DAMsetup.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

$PLUGINSDIR/Dialer.dll

kernel32

user32

generic

$PLUGINSDIR/DotNetChecker.dll

kernel32

user32

advapi32

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/StdUtils.dll

msvcrt

shlwapi

crypt32

kernel32

user32

advapi32

shell32

ole32

oleaut32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

advapi32

shell32

ole32

generic

$PLUGINSDIR/customPage002.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/makensis.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsisdl.dll

kernel32

user32

advapi32

wsock32

generic

$PLUGINSDIR/registry.dll

kernel32

user32

advapi32

generic

$TEMP/setupc.exe

mscoree

dotnet

DamBho.dll

PE Signature issue

mscoree

dotnet

DamFirefox/chrome.manifest

DamFirefox/chrome/dammz.jar

content/contents.rdf