1bc877ccdae6e341b8a3ef1e3507be67_JaffaCakes118

resource
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/$TEMP/install_helper.exe
unpack004/$PLUGINSDIR/InstallOptions.dll
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/UAC.dll
unpack004/$PLUGINSDIR/nsDialogs.dll

resource	yara_rule
static1/unpack001/$TEMP/specialsavings.exe	nsis_installer_1
static1/unpack001/$TEMP/specialsavings.exe	nsis_installer_2

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 04a484c01214c519221232364f1b99e4aff0761a6fe9c2cfcbf0c84a246a1689
MD5 1bc877ccdae6e341b8a3ef1e3507be67
SHA1 1ed2c9ee14e3a4192bba9e4d0fe29524108cd23f
SHA512 d4a91366ea7a12a1dab839db45a33ebad96324a3c1dccb2b2bd6e6115c9dd5888d44637aae675c64600b73aff30683dac1acd00a16b3da333943b7337c75e97c
SSDEEP 49152:537DPQNxWCWMpiwy1rA91zjbb7aaM429BNgFH2LM:53nPQnW4tyS1zjn7aaM4CrgcLM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

d8:1b:39:56:aa:93:9c:91:53:78:c0:0d:8d:c2:43:c6:7c:b4:22:02

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

Jul 12, 2013

Minor OS version

0

Major OS version

5

Entry point

14467

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

415KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

516KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

346KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$APPDATA/SpecialSavings/SpecialSavings.crx

SHA256 59164dbb8a7dede962f647734b455ad933c31a2f1f3193f5b0e16eb02d08c93e
MD5 7329ef72e4ee49990a62c06ab6feb1e6
SHA1 3d2bf52f5d18ed79a90be2079a4b4271c216718a
SHA512 2479c8a12aa2a91a76c018bf7d9b6848026bd5a87a8a53d28ee29b35d5025ca16c4143672c3b9fc6315b4e367d778d545f9013395bea2f26b557b935afbdb53a
SSDEEP 1536:o5ffdWZrn72jcjVJzBOOKE8L5ysqmh4drU7:oZdWZrR3zlKEU5v/S4
MD5 SHA1 SHA512 SSDEEP

background.html

SHA256 2cffe15d6ffd8a4bdbfba8bcdda1e911660b62d795048bcd6c66004e9640d65c
MD5 d050b00c97d6287da7c1605c010b6b86
SHA1 1e9a3109b1505cd2ebfaf0d4f00cdbdf342b01f5
SHA512 feb6213e6a3e027e8a8cc15d6bcfa963098bd78bea1e251d6ee32ca89f642c4e967cfbf7d69adb70549c1b00b164a74b9707e63d79c43623bb32ef5099e8bddf
MD5 SHA1 SHA512

ci.bg.pack.js

SHA256 25eadfbb5612cb37faac27933bf655f285e37bd34b942017f073586695f1eec7
MD5 04a299b2da7d024a35e9dbea1e382d88
SHA1 35cbb5a7a0eeaa40dd611060756870b98cf8ed05
SHA512 fc63222b5485e079b807218828ca50387fa64a46cf510c0919b001eb0a545130baa7b8b7d29d794a5adc0e50eec0f6d0278bda9753b0442c666fc20543b5a941
SSDEEP 192:X63BZ08WUBeQCgocHt7fuH0t+0vT4ZtSo3Bq7skLWZJ2k7Ng3T/:q3B28RHt7fuHL0vUZIo3Bq7skLWZJ2k6
MD5 SHA1 SHA512 SSDEEP

ci.browser.helper.js

SHA256 0551edbd3a8c54a9cb86b91c0ef801a3062f8cb135927b29da6911010ad8862b
MD5 a6ed515dafa0695ec87e6d621fa8ec8a
SHA1 b46ec48830a11976e1da008dbaefc1a3ac5c9cfa
SHA512 c8b7c5b93d2cb7ba39e81efa7fa16774a75e47ed96ede604863a4d3e45a4e24ef5f1b4febabac3d2ea6ed24c2d49d05852d837679b0b835aa1cf8b79c362a80d
MD5 SHA1 SHA512

ci.content.pack.js

SHA256 c8b325486bd472a6890c9f0cc6cbc111df20f442442af51c1eff3286da211e2f
MD5 5e491154cbefed8685afd82e4a6b2ed4
SHA1 395cf450f2ff3fea0110ff7cd63500a0bb1edf29
SHA512 24fed845ced3be38622950c82913a2808c6780a94675d8f33027273637fe4d80da992de45950f46b8a762ccac433925eaf077eeb2d080c113f51261982e4243b
MD5 SHA1 SHA512

content.js

SHA256 723edadf07e76deef6be6e2d4edadd5da5d716f73eee4a0a12cd1caa4d95a512
MD5 024b82ece28f3870f3c7f6debf8f0cd5
SHA1 c48cb5732ebc2249e7fc4125fcde89bde18f1939
SHA512 df46d769b1ba9afaa896ee7d65fb5af668589b1c6504c85392614cb6657443c53afc36b44e46a61a38b3c614b4d59a0bd029f3ca6437c29b4cc289200b0f7cdd
MD5 SHA1 SHA512

icon128.png

SHA256 5b27f70f2db4ca9229d0951ad21a50e040f0286bbdbb2759d43b032117548a8e
MD5 cd1a63eb9a6e6e44bcd9e671ea50c6dc
SHA1 ef6a987f9eddf712845554f50834ff5b96bb2c8f
SHA512 91c735ddaeb968af8788a5e38f5b85ab468f69fc8d0141957ad5737618b92d8d66c7704d02400bd6dd4960872df353b1ddeb0f774e0ac55521cd4620c989acb0
SSDEEP 384:2ZiiC5uURrL8hf6pnBVYdASWn9tyV7/zzZ9il7prUtyGFJVrw9k1Bst:+WRLrnEiDLunjcwFVc9kHU
MD5 SHA1 SHA512 SSDEEP

icon16.png

SHA256 accad556b5212c1b2707a0611a65cf86c2d15ef830e6469c338565ec8fa8c195
MD5 f833bdbde94a30224cff42e49f76cc95
SHA1 41adf57694d558efe92461d901114a13c5591a81
SHA512 b96bf2caa7f30ae53f4ae980f682668a4cd677b07f5a9bd23746049f458ab2cf4f340457460eebafb9a8b1636cf1d6ff77643337f175d1f13a4d556dc91b0c04
MD5 SHA1 SHA512

icon48.png

SHA256 6c77f0cf1c2b32f334d26370812a4a033938cea2b87620c0d1193df5c1f53188
MD5 e9b8b97f328ecb7d9539d57c4feb5cf6
SHA1 07d6d390a5826b32267c8dd3065f8a42297bf0d1
SHA512 ee031b9d63afd4c6289107638006fb24b0bf0a4dfa22a36a6d28b4fcb4b656b27ca36744cc8399a7f4207b2e58fda200496e51e0d0fd5bfddb69a156dd3e190a
SSDEEP 192:KnflEg6ItuZ4MrMfYSagazrKLyNIZh/IZl4:K9OKuuQRgH+6n8u
MD5 SHA1 SHA512 SSDEEP

jquery-1.9.1.min.js

SHA256 c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
MD5 397754ba49e9e0cf4e7c190da78dda05
SHA1 ae49e56999d82802727455f0ba83b63acd90a22b
SHA512 8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb
SSDEEP 1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5 SHA1 SHA512 SSDEEP

jquery.uuid.js

SHA256 2b24135a3ee8e04aacae0ddd0b4735da1f551f88c0e03c9a7eba067840c38755
MD5 5cc17595bde76df6f193381785901b79
SHA1 7cef44ac25abd17e63410dc94bae0f7bad85c435
SHA512 145edaf2d16ca26394416d93c61b0a1da555556f60f0ee266f66f3bec1596c8368a9600998030ecfede1c51ff3e44e7abc8622f2963479872b78adb08f96bced
MD5 SHA1 SHA512

manifest.json

SHA256 40334ae9fdbfb273083680efb952dd68a8c53f433dedeb85daddd124190004a9
MD5 92456bd8da869b925e9dfd6aee51d615
SHA1 cddb2a4a336a8b19f30ea7727e12769c326728de
SHA512 cc38257004cab2e842733e75e742cecb31f1fca1ef22e66f06c92236f34517c5c88d3626fbaa240a3f991c08d7f26151b60742e018b3aa1cffa16c6d5349c05b
MD5 SHA1 SHA512

mz/background.js

SHA256 de507a9a3bd6ccb74eae7e1d489eb5013c463a8c2dc7e04544e1b2f4a996ba67
MD5 e0fd2443c49fa0c5f2a0a55e6dd2d552
SHA1 8254aa2b70c1ed0a8c6ef77d3b9791c2a3bf9cb7
SHA512 4dca2c945ec0a8f604a02d459b48579e6d58ead3395c93e23fbc1ec2702b1bb6f4c3561ac727f2ddbbca9a4e35f47d9a7c0147637f8de5f5cfdd57490d15c609
MD5 SHA1 SHA512

mz/content.js

SHA256 f940c80a50a86e85ed80b71ab9999ef60d271047bbb2f265bc3b37b80ca0cd07
MD5 428a2d28a31908538f6b433d9150bd7e
SHA1 de9398a23f158a64cc1031eaef2e4e21ad040e72
SHA512 f55f53df0f91fce40b36fc0757144b2f4fa22d26d65720bb6a9e31ec541e813bc17170feecc61435621b117cb97228812f02e2751bcad4006c2ae4551e1d25e3
MD5 SHA1 SHA512

popup.js

SHA256 fcfcc47f8cfe687ebd6422500452ad38f3cfc2256b6de0de602984a1e7419cf6
MD5 72b6ae892f1252bbfda3a039a316aa88
SHA1 ec418db8da7413e24e17beeee58d8969fca77e45
SHA512 27c53ce01eecd50ba3195faa7e81afcbfd3e9804da9ab142fccf73dc5d6034826e6a2cffa8ee57fca297e0a4a3954989733765102baad4848985738d9152cc9b
MD5 SHA1 SHA512

settings.json

SHA256 6e5d07973481a8001ea4f44c2d4439047ef3a2c02e7885aae088291d81b2b7f8
MD5 d216dd1c04180286ea9eefc4ec5b1b77
SHA1 00bce75576f593496910470da632fe6b4909b6eb
SHA512 0156999c45338aa5db387863f5c911c0dac2bd801f0076beadf05568b6581a0401004462434e0eebc7463d4f3e7ddd5852ff044f17d7b504070959a3cc433988
MD5 SHA1 SHA512

specialsavings.rdf

SHA256 6e1293f6ceca42ff7d9d5d69c3d66b45a738d56ad97412fdc7cbdee419cea755
MD5 a83f1f8c2ea76e5a68204f2747ef616c
SHA1 10e7333cd2917a3f693b53527ac0e43aa3efebbd
SHA512 c2e2f5cd21275beb5989c9a2dac62c88504257777c284c269333933dc7ac5a30701f7029c9ebfbb76b058e73b7bfc3d04fd501dbe82a048a2a25353116b844f4
MD5 SHA1 SHA512

$APPDATA/SpecialSavings/chrome_install.exe

IMPHASH ab6d51b539c85117ff94d0a0d064de07
SHA256 0a7691f82e885a2ecca874524da7e605de3a183a153b578c5e936236432b8dc8
MD5 0a1dc567bd6b241e4fa7ef27f1eba05a
SHA1 7a5d74e35d161da9c1cda5e062007a96af28bd62
SHA512 bab6fa82b167add04fb1f2b2700c87daa9aa0f24269d99eb7996c95f9a040c7c436464d90ca24bd18889be6d884fc4a1dedf16f2784b626731129d3e784394ae
SSDEEP 24576:aZafNe7BcxzXbfymiOpxtLCwnkIeFOsUWQjRQ7BnZbRao5TWak:DfNeuxzXbfvbEGTbrWQjRgbRao5Tnk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

a5:79:d2:b7:5e:e5:ce:a0:9c:fc:62:f3:5f:3a:71:83:8f:cc:97:5d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

Feb 22, 2013

Minor OS version

1

Major OS version

5

Entry point

652729

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\projects\_cc\kerberos\release-2.3\output\MinSizeRel\chrome_install.pdb

kernel32

GetModuleHandleW CloseHandle ReadFile WriteFile GetFileSize WideCharToMultiByte MultiByteToWideChar DeleteFileW FindClose FindFirstFileW GetTempFileNameW CreateDirectoryW EnterCriticalSection LeaveCriticalSection HeapFree GetProcessHeap WaitForSingleObject HeapAlloc CreateEventA OpenEventA GetVolumeInformationW CopyFileW SetFilePointer CreateFileMappingW UnmapViewOfFile GetSystemTimeAsFileTime InitializeCriticalSection InterlockedCompareExchange GetVersionExW AreFileApisANSI SetEndOfFile FlushFileBuffers UnlockFile LockFile LockFileEx UnlockFileEx GetFileAttributesA DeleteFileA GetFileAttributesW GetFileAttributesExW LoadLibraryA LoadLibraryW FreeLibrary QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTime GetTempPathA GetTempPathW FormatMessageA FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileA GetSystemInfo MapViewOfFile FindNextFileW InitializeCriticalSectionAndSpinCount GetModuleHandleA GetCurrentThreadId GetVersion GetFileType GetStdHandle GlobalMemoryStatus GetVersionExA GetProcAddress SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetFileTime RaiseException HeapDestroy HeapReAlloc HeapSize InterlockedIncrement InterlockedDecrement GetStringTypeW InterlockedExchange EncodePointer DecodePointer TerminateProcess CreateToolhelp32Snapshot OpenProcess Process32NextW Process32FirstW RtlUnwind GetCommandLineW HeapSetInformation GetStartupInfoW ExitProcess SetConsoleCtrlHandler ReadConsoleInputA SetConsoleMode GetConsoleMode CreateDirectoryA SetEnvironmentVariableW GetCurrentDirectoryW SetCurrentDirectoryW LCMapStringW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetLocaleInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount HeapCreate IsProcessorFeaturePresent GetACP GetOEMCP IsValidCodePage GetTimeZoneInformation GetConsoleCP SetStdHandle GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CompareStringW SetEnvironmentVariableA WriteConsoleW SetEvent ResetEvent GetLastError CreateFileW FlushConsoleInputBuffer DeleteCriticalSection Sleep LocalFree FindResourceExW FindResourceW LoadResource LockResource GetCurrentProcess SizeofResource

shell32

SHGetSpecialFolderPathW CommandLineToArgvW

ole32

CoInitialize CoUninitialize

shlwapi

PathAppendW PathFileExistsW PathAddExtensionW PathStripToRootW PathRemoveExtensionW PathFindExtensionW

user32

GetUserObjectInformationW GetProcessWindowStation GetDesktopWindow MessageBoxA

advapi32

DeregisterEventSource RegCloseKey RegOpenKeyExW RegisterEventSourceA ReportEventA RegQueryValueExW

Name

.text

Size

798KB

Virtual Size

797KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

234KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

2B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsisunz.dll

IMPHASH 1b37562e8104552588ae892e11fcdff2
SHA256 c31b590cba443de87f0f4a81712f0883ac3b506f3868759d918d9a81f84ea922
MD5 bd97d86d8bd07ebdc8ec662a3f31dfd5
SHA1 5e2b3a1af5ee53ab6d1d6c2cb8127add39ee7e82
SHA512 4575d1ea0d1b2f74df74cad94eae7fdf31c513e5dc6d945e81e0873b99f94a5d81b1c385c71ab79a19e5bb6c00fc5fffec7a3bbfd60ad7de312cbb53d8bcce9a
SSDEEP 1536:uPmnCuZs9reYWvAHvXhxQdJeY3tMCo9NTJwd6aimHr5jr5T51NT:uPmnCuZs9KoPX6rA9Nl2Rrt51h
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

25724

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DeleteCriticalSection InitializeCriticalSection CreateDirectoryW lstrcpyW GetVersion lstrlenW lstrcatW LeaveCriticalSection EnterCriticalSection WideCharToMultiByte MultiByteToWideChar lstrcpynW lstrcmpiW lstrcmpW GlobalFree GlobalAlloc HeapSize LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree CloseHandle WriteFile GetConsoleCP GetConsoleMode RtlUnwind ReadFile SetHandleCount GetStdHandle GetFileType GetStartupInfoA SetFilePointer GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapAlloc VirtualAlloc HeapReAlloc SetStdHandle FlushFileBuffers WriteConsoleA GetConsoleOutputCP WriteConsoleW CreateFileW InitializeCriticalSectionAndSpinCount CreateFileA GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA SetEndOfFile GetProcessHeap GetLocaleInfoA

user32

MessageBoxW CharPrevW PeekMessageW TranslateMessage DispatchMessageW FindWindowExW GetDlgItem SendMessageW wsprintfW

$TEMP/$PROGRAMFILES/SpecialSavings/uninst.exe.nsis

SHA256 b43e761a53f138ce8874bef9b5e066c3fa295fb3d0040b085f9637953efce105
MD5 4bc80d678f3d4ab6ee51ce5e1f0ac92d
SHA1 a794dd1d68215fe9c1cf79c0db54e0c38982f868
SHA512 b9fa678ba71bf2f695910aac28808f65ee30bb7be74bf8d70ad83a70bbb72521014e0e62c35b5a807ebe951f4967f826e1fe7065cfcaaf07472c2f6698f0e308
SSDEEP 768:hivdrrf8YP15OSY5xkmCwqsxNtRgsSWkAVL:hilrrfJN5OSYLkmCXrsSWkcL
MD5 SHA1 SHA512 SSDEEP

$TEMP/SpecialSavings.xpi

SHA256 e9f9bf5fe3617e39a6b51a97617ec311141b3f574e4f871295891e72281faa58
MD5 f481196780c93408abb19dc0bd57c3bd
SHA1 2172dc1d7b5a61250a19bb6af147441bb37da5c2
SHA512 8fdb88f6d6ff9f4f62d0acee6b27168943d7f3456104bf8f9cbf9bbcb1468137b14b50782710395b2f5290fb50ef1e01dedc237fb6ed2432e3e3e947e16fa33d
SSDEEP 1536:IA0CcsnWZrn72jckVJ/BDShZt4jO6A/m8CDWeztgBoX:IFnsnWZrRK/Q14jUm8ChMoX
MD5 SHA1 SHA512 SSDEEP

chrome.manifest

SHA256 248a8f7dda87661055bb0edb877da6127aa99a48b14a5d16a194ca60405bc1b1
MD5 12afdcecabf6ca9a64387677b2451925
SHA1 3aea5d4a8da2a1547e16c092b8b1ea9de59282f2
SHA512 8f681e02a538d0fb5cdb3f53e0111925ca89b5721e5d84e86a923ba28f2cb43cd1ae4183b05d691570b9de15993dd275974f2529c9d1b777897d21e136395341
MD5 SHA1 SHA512

chrome/content/background.html

SHA256 373fafb49216bd341a8517e9836364001240323410a109933eba77c158b4eff3
MD5 01129decafb3b274f13331448125b482
SHA1 239bada95abb067b680d079c54b59d22d89cfd90
SHA512 5b62d19cafd15fe814ff6036debeb43986a16235da77029cd4ab6027651ef608f1715905783e9b4395cd7c8a4588da71652a696ee5b6aaea6895df478598d314
MD5 SHA1 SHA512

chrome/content/button.xml

SHA256 1e02f8c27b087fd7879cbe13c4c39f864b8bbeda113fc240b585657b6e6ccb4c
MD5 598cfaf5bc644b07d585a268185ce11c
SHA1 8722311f7ab3b9c1d45fef854846336b18d67979
SHA512 0c217d99b1f3686c8504f7a68751040296469114447237f8bc9d1a60dae77439476994f6b80b679bd0bb1b6b07ccbe4542ecfeffa9e430ed7278deac28714e55
MD5 SHA1 SHA512

chrome/content/config.js

SHA256 1e3ddf4b15635b00dc85923250b61a8144d905b6f3083799c2c1e66b2983f069
MD5 59d75c145b2644b425d91e6d359f90fd
SHA1 5a8b7068791979aa1f98c52203294b852ee5ec33
SHA512 516ec5b7859f066d77856c67e15cc80f225f017fcf6f9ecaf158bd046b6bbed3832e18a44cce0abc016c4e032aeaeee6475b2dd4c6b5d633e05412f3fc85231d
MD5 SHA1 SHA512

chrome/content/content.js

SHA256 723edadf07e76deef6be6e2d4edadd5da5d716f73eee4a0a12cd1caa4d95a512
MD5 024b82ece28f3870f3c7f6debf8f0cd5
SHA1 c48cb5732ebc2249e7fc4125fcde89bde18f1939
SHA512 df46d769b1ba9afaa896ee7d65fb5af668589b1c6504c85392614cb6657443c53afc36b44e46a61a38b3c614b4d59a0bd029f3ca6437c29b4cc289200b0f7cdd
MD5 SHA1 SHA512

chrome/content/framework.js

SHA256 9b176561f3e01d0126b83b99b299183dbf97b19e95f19d5e129e86fd719ab101
MD5 f6ff25e0a511a9ca548946a402a87216
SHA1 bf77e2834c66a18d3c2e1b2a8df7e7a3aa2e4e41
SHA512 60edda471391f0b836d9518f5127c318b14c0367ca9d76240a20236a5935be3b9f6cb24463e0d086c1674989fefc86f7927bd314ab0394eb32846d5c7aa6d6fb
SSDEEP 384:fC3VTRM6mM7j9nNs0hw8qgKVe51g3hiqiQVuiZyuEWRBijfKW6Y5:f0VXN/w9gKM5146QVVyNWfijfx6E
MD5 SHA1 SHA512 SSDEEP

chrome/content/framework.png

SHA256 b177fb7f488b3b59c7cb776f301d3fd25b49d6a7d3f55e06875f2086a0b09d5a
MD5 45f983c9b5c6510c3782b9619f7053ef
SHA1 637d8350b7e99c372a208c36b8e5e20de5fa1d8a
SHA512 e82ccbc500c341c02e9c5a56fee64a4d2e35261f9405aa29d1eafb8f5aedb6de335ddbb258e62f43290508b9cab409d44051c3a61ef268f8c666b36f2ae3e69f
MD5 SHA1 SHA512

chrome/content/framework.xul

SHA256 1327ba8862d12b56d1437eaa3f20c61f05df0125aec54a7946a07cd2a03e3572
MD5 2f17cf5d6528ce454a25751d15be6763
SHA1 965b2e3321dab30241cb138be1ed23ec8b168925
SHA512 3bb1ec03d2c283b55003efe97f8bab85366b13a5a5c235c09fd9c36b38b2b7020fd0b9f16c0b8ca145e13f10a46367313ff16bddb50422fcb4850dcf716f0d22
MD5 SHA1 SHA512

polyglot

chrome/content/icon128.png

SHA256 5b27f70f2db4ca9229d0951ad21a50e040f0286bbdbb2759d43b032117548a8e
MD5 cd1a63eb9a6e6e44bcd9e671ea50c6dc
SHA1 ef6a987f9eddf712845554f50834ff5b96bb2c8f
SHA512 91c735ddaeb968af8788a5e38f5b85ab468f69fc8d0141957ad5737618b92d8d66c7704d02400bd6dd4960872df353b1ddeb0f774e0ac55521cd4620c989acb0
SSDEEP 384:2ZiiC5uURrL8hf6pnBVYdASWn9tyV7/zzZ9il7prUtyGFJVrw9k1Bst:+WRLrnEiDLunjcwFVc9kHU
MD5 SHA1 SHA512 SSDEEP

chrome/content/icon16.png

SHA256 accad556b5212c1b2707a0611a65cf86c2d15ef830e6469c338565ec8fa8c195
MD5 f833bdbde94a30224cff42e49f76cc95
SHA1 41adf57694d558efe92461d901114a13c5591a81
SHA512 b96bf2caa7f30ae53f4ae980f682668a4cd677b07f5a9bd23746049f458ab2cf4f340457460eebafb9a8b1636cf1d6ff77643337f175d1f13a4d556dc91b0c04
MD5 SHA1 SHA512

chrome/content/icon48.png

SHA256 6c77f0cf1c2b32f334d26370812a4a033938cea2b87620c0d1193df5c1f53188
MD5 e9b8b97f328ecb7d9539d57c4feb5cf6
SHA1 07d6d390a5826b32267c8dd3065f8a42297bf0d1
SHA512 ee031b9d63afd4c6289107638006fb24b0bf0a4dfa22a36a6d28b4fcb4b656b27ca36744cc8399a7f4207b2e58fda200496e51e0d0fd5bfddb69a156dd3e190a
SSDEEP 192:KnflEg6ItuZ4MrMfYSagazrKLyNIZh/IZl4:K9OKuuQRgH+6n8u
MD5 SHA1 SHA512 SSDEEP

chrome/content/jquery-1.9.1.min.js

SHA256 c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
MD5 397754ba49e9e0cf4e7c190da78dda05
SHA1 ae49e56999d82802727455f0ba83b63acd90a22b
SHA512 8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb
SSDEEP 1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5 SHA1 SHA512 SSDEEP

chrome/content/mz/background.js

SHA256 5f66886bdb7f38ae0d47255fdf3ff7d29f7a26bafedb928b914e5b00e88542f7
MD5 90d1af3cd5677b18048ee64f509ea9fd
SHA1 72316440e12729195da10c60696d17ba9630e45a
SHA512 7081254a06b851c6966fad221902a5ffa365f4a4c32299d657843d8a0a07054568ada032f475a508bbfcdc4c01f5d5e0d03cb2af73ebdfa2338105f7fae3f9d3
MD5 SHA1 SHA512

chrome/content/mz/content.js

SHA256 f940c80a50a86e85ed80b71ab9999ef60d271047bbb2f265bc3b37b80ca0cd07
MD5 428a2d28a31908538f6b433d9150bd7e
SHA1 de9398a23f158a64cc1031eaef2e4e21ad040e72
SHA512 f55f53df0f91fce40b36fc0757144b2f4fa22d26d65720bb6a9e31ec541e813bc17170feecc61435621b117cb97228812f02e2751bcad4006c2ae4551e1d25e3
MD5 SHA1 SHA512

chrome/content/options.xul

SHA256 4d4b18be6fa8d245b37eeccfdc29304443322a6701abe715782943e3f7764bf5
MD5 71b296548ae94eb42e4ade335a78a75b
SHA1 be7f3f0ea23092d54cb5563a632ee8c0b9a82c83
SHA512 1dbbb40eccf630d09f0505a93bf3601410a1a22c76688b7f60fa9d36cafa7d7387c9885999366afbfc0411d71e1c9c3261b99e968e0035daec2fd2959b367d67
MD5 SHA1 SHA512

polyglot

chrome/content/settings.json

SHA256 36e0494ea7c9bd565a58c746944b461ad8e38de3ea4d3f796599b44677182b2e
MD5 e9bb4b9b215f3d8dff63eec2255c7262
SHA1 e42d1fb8db1ea30e05b93c3bfee75022b14f4b56
SHA512 9e212be3bbb19c110d89a162608010ad6ca451d9cde34433cae2c06c91ff931ebc67251232f5cba61f3f4760864b30067e56c786124514cfc8803d7efdff0d0e
MD5 SHA1 SHA512

chrome/skin/framework.css

SHA256 031d0baf4c52792ba17a42ebe50d13a83546335abbc5b73e1f9c9aec8aa6c7e9
MD5 da1dc42d4adc8d05b6ae9782a6826f14
SHA1 b08766e2692469bd2566e650e97a9d98b7d6a650
SHA512 0f1fbfc61673cd73cf3945d520a5a09f7922845a3aac131e3d0d447f749e563ba9c557538e4a85cf8492e5645d3bbb2f4d8a70f3d6584c7103159ca737a05384
MD5 SHA1 SHA512

install.rdf

SHA256 b69efca1f9a0bdc438dc33d14af4c585b36b10cd4ecd6a1117ab3605a9acb2d5
MD5 591e0322cfe525d3e0a1f5f15be55c36
SHA1 308cf6cb9ccc551707b4db65b90ff19b2e0f88bc
SHA512 5713536b209a17e5fca61f1521dfbcfc96bc8239085492464c090413e30598d136917f4d178284b5cea706cafe14cc259150b928f832cec5bd339a803b455e37
MD5 SHA1 SHA512

$TEMP/install_helper.exe

IMPHASH 694b9d244136a4e2d6e5fc4b5c18dfcb
SHA256 cb77ca5b69283cfbf26e33d8ffb6ca660d73fcd03b76a34be79b03c8e6f523c3
MD5 307d74fb9401929ba53200706aa92013
SHA1 1aa7b5436c9b740b986dfea8b6f5826a26e169b4
SHA512 641de0fcd91aa4dfecc29c9e96ec974d68c9f5caeb1ababeaae85051999ded2506d87ed3d5e6315394aa65b36d03752a43bf38d085a2ecbb50460cb9b560e4fb
SSDEEP 12288:vn7fh9mnHWfbk/y6Obeqi+LKc4hfzLYoFgtFZysUS1SiS7tcZA0lBuMHrXOOvn3H:P7iS+y6ObeqB4hf/YegtFnUChS7tc60Z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

438775

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\bisovman\Documents\Visual Studio 2010\Projects\install_helper\Release\install_helper.pdb

kernel32

FindResourceW FindResourceExW LocalFree GetCurrentProcess GetCurrentThread lstrlenW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCommandLineW OpenProcess TerminateProcess Sleep InitializeCriticalSection InterlockedCompareExchange DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetVersionExW AreFileApisANSI SetFilePointer WriteFile SetEndOfFile FlushFileBuffers UnlockFile LockFile LockFileEx LoadResource GetFileAttributesA DeleteFileA GetFileAttributesW GetFileAttributesExW LoadLibraryA LoadLibraryW FreeLibrary QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTime GetSystemTimeAsFileTime UnmapViewOfFile GetTempPathA GetTempPathW FormatMessageA FormatMessageW GetFullPathNameA GetFullPathNameW GetDiskFreeSpaceA GetDiskFreeSpaceW CreateFileA GetSystemInfo MapViewOfFile CreateFileMappingW LockResource SizeofResource RaiseException lstrlenA FindClose FindNextFileW FindFirstFileW GetPrivateProfileStringW GetPrivateProfileSectionNamesW DeleteFileW GetFileSize GetLastError ReadFile GetModuleHandleW GetProcAddress CreateFileW CloseHandle MultiByteToWideChar WideCharToMultiByte UnlockFileEx CompareStringW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP GetStringTypeW RtlUnwind GetTimeZoneInformation GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW IsProcessorFeaturePresent HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InitializeCriticalSectionAndSpinCount VirtualProtect VirtualAlloc VirtualQuery HeapSetInformation GetStartupInfoW EncodePointer DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess GetStdHandle GetModuleFileNameW HeapCreate GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId LCMapStringW SetEnvironmentVariableA

advapi32

OpenProcessToken RegSetValueExW RegCreateKeyExW DeleteAce SetSecurityInfo GetSecurityInfo OpenThreadToken GetTokenInformation GetAce GetAclInformation AddAce InitializeAcl IsValidSid GetLengthSid ConvertSidToStringSidW RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

CommandLineToArgvW

ole32

StringFromGUID2 CoCreateInstance CLSIDFromString CoUninitialize CoInitialize

oleaut32

VarCmp VariantInit VariantClear VariantCopy SysFreeString SysAllocString

shlwapi

PathIsDirectoryW StrCmpW PathFindFileNameW PathFileExistsW PathAppendW

$TEMP/specialsavings.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 f334a60acf4122dd88458219f26c3baaf014c3ad423133f0a5c67224e2f285ba
MD5 fa56e0c29bb3375bbcf81afe9c83483c
SHA1 ff902db3d753694cb321a150db87d9fc9b20681b
SHA512 6889b13480fb69e7cafbcbb601cd43d8aac89fc11f6aad0eb2030d8ddf5f24e43edde410cb1e495763726836708da15cc29d5191e3769e81c9c4740c50d85c20
SSDEEP 24576:smw3hYhGT9fXzI4Odl2PgEqh0uSSO96Kii6gnFaSxUSPYI7cIto:sB3hjaz2PgEI0uG9oMFaB7I7cL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8e:31:50:6f:bd:1e:ab:93:0c:2f:84:41:fe:7d:fe:af:33:fa:28:fc

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

0

Major OS version

4

Entry point

12491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH ee75cece63794fa22feebed80a358b16
SHA256 c24c005daa7f5578c4372b38d1be6be5e27ef3ba2cdb9b67fee15cac406eba62
MD5 29858669d7da388d1e62b4fd5337af12
SHA1 756b94898429a9025a04ae227f060952f1149a5f
SHA512 6f4d538f2fe0681f357bab73f633943c539ddc1451efa1d1bb76d70bb47aa68a05849e36ae405cc4664598a8194227fa7053de6dbce7d6c52a20301293b3c85f
SSDEEP 384:RlNMjIH4DnFnyJ0Dt5ZtmVWsSLr4z9VwzU:RlqMYzFnD/tmQFLrSw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11275

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetVersionExA lstrcmpiA GetCurrentThreadId GetProcAddress GetCommandLineA UnmapViewOfFile WaitForSingleObject GetCurrentProcessId SetEvent lstrlenA SetCurrentDirectoryA MapViewOfFile Sleep OpenProcess GetExitCodeProcess GetExitCodeThread CreateThread CreateFileMappingA CreateEventA GlobalAlloc CreateProcessA GetLastError MultiByteToWideChar FormatMessageA LocalFree GlobalFree CloseHandle GetModuleFileNameA lstrcatA GetPrivateProfileIntA GetPrivateProfileStringA DuplicateHandle LoadLibraryA

user32

GetClassNameA SetWindowsHookExA DispatchMessageA TranslateMessage IsDialogMessageA PeekMessageA MsgWaitForMultipleObjects DefWindowProcA PostMessageA SetForegroundWindow CreateWindowExA GetWindowThreadProcessId CallWindowProcA SetWindowPos GetWindowRect UnhookWindowsHookEx CallNextHookEx CharNextA DialogBoxParamA SendMessageW MessageBoxA EndDialog SetWindowLongA LoadImageA GetWindowLongA EnableWindow ShowWindow wsprintfA GetDlgItem SendMessageA LoadStringA DestroyWindow

advapi32

GetUserNameA OpenSCManagerA GetTokenInformation OpenProcessToken FreeSid CloseServiceHandle EqualSid AllocateAndInitializeSid OpenThreadToken AdjustTokenPrivileges LookupPrivilegeValueA QueryServiceStatus OpenServiceA

shell32

ShellExecuteExA

ole32

CoInitialize

$PLUGINSDIR/help_page.ini

SHA256 61870e9f7ee81d620f5838e34354c9fd708954803a25a81f0742c05367dc0cb1
MD5 461ec509cb30563d17485067b7309b7b
SHA1 decf333032c06faecb57a946b0fef5b26b3482ed
SHA512 b6a2e42d552e055c9c18662045380f77504b83d459b255f1b695cbd37bf9d3a8de40213002b19d6334645a92fe527d5ae11a67fc01e43b9a2e1e16b83cbf6ee2
MD5 SHA1 SHA512

$PLUGINSDIR/ie9install.bmp

SHA256 0a9d0d5fbf648ed51fd70cdd759a808fb7fde87e2c9020c216908dd8915239c1
MD5 6834549ac60d5d9423d4a5aa2c043888
SHA1 1d43587c2dd5ce2352b87ab11ebbe686f71785a1
SHA512 87297100873cbaa131afa827aaddc8b49a4fe715c38422ea1180c42cefecfde8f5cffa273f50d28ac19e3497f5235747d19d186e00593dda04b52986668310ed
SSDEEP 192:lzV/cKcfNx/9OWxQ/8yKI7H2BH+ekga71PMRF:mhkgs1MR
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 1e2884056e655f2b7bc5a904e352fc80
SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
MD5 c10e04dd4ad4277d5adc951bb331c777
SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7410

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AddonsFramework.Typelib.dll

IMPHASH 840770e3d4f0dd959779a45e1f36a662
SHA256 58530b53c1b036a15976268e8781977a6e1afceb86730eca1a90903a0a73bef2
MD5 58ab9bc3bf635dc862b100f7da59ba0c
SHA1 7894830cc3d6ecab6b1d761059ce61b61a813feb
SHA512 4f04c472d456a987bbc87402d74a4c8d450da9490272c5a581e77f7d682dcd14c1d8044c74e4873e0ee2da668143c61a9af6b4ed753c4599ef769c050cbde133
SSDEEP 1536:KAkcq5+MYFshf2usQSkoLBl8f26VZKrVkji+/b/VJT:sbYShfGQ+LB+f26SQr3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

0f:94:bf:c8:af:d5:22:7c:60:ec:74:a1:5d:37:59:f5:7e:a1:f3:e9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

1

Major OS version

5

Entry point

22760

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\Release\AddonsFramework.pdb

kernel32

FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW SetThreadLocale GetModuleFileNameW InitializeCriticalSectionAndSpinCount DeleteCriticalSection InterlockedIncrement InterlockedDecrement lstrcmpiW GetModuleHandleW GetProcAddress GetLastError LeaveCriticalSection EnterCriticalSection RaiseException GetThreadLocale lstrlenW GetStringTypeW LCMapStringW LoadLibraryW GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte HeapAlloc HeapFree RtlUnwind EncodePointer DecodePointer GetCurrentThreadId GetCommandLineA ExitProcess WriteFile GetStdHandle HeapCreate HeapDestroy UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError HeapReAlloc HeapSize IsProcessorFeaturePresent GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep SetHandleCount GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW

user32

CharNextW

advapi32

RegQueryInfoKeyW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegOpenKeyExW RegEnumKeyExW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree StringFromGUID2 CoCreateInstance

oleaut32

VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

BackgroundHost.exe

IMPHASH 1c8c3c5249da7d2ccc3fd07a354803d1
SHA256 e93d5e99dd6cc97c43012d092516eb581280d4410d9c760432b39920c32180dd
MD5 25f435f4e776fdfb50e0cb13b9137599
SHA1 e8790b8bf00263f80c8d70b331a6e8a636397bdd
SHA512 ba7e9402696a684168f70c9c09a335a9bc33d4670f9c99f636f3f90c58f6948b6bc7298bd130aade9844c154f4d71f2d710535593eff59e41725bd6908911461
SSDEEP 12288:X9sa2wJqkBQgJZ8l2Q5xBG3wlb6fHJ8TOBKp5hWi9LxTB8WEj6v:X9B2wJFUhxGAdKpYO4p5dTBdx
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

c3:d7:ed:11:63:9c:08:aa:15:6d:e8:58:3d:ef:3a:4e:ed:d5:43:8a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

1

Major OS version

5

Entry point

328833

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\Release\BackgroundHost.pdb

gdiplus

GdipDeletePen GdipCreatePath GdipDeletePath GdipClosePathFigure GdipAddPathLineI GdipAddPathArcI GdipGetImageGraphicsContext GdipCreatePen1 GdipSetSmoothingMode GdipDrawPath GdipGraphicsClear GdipFillPath GdipDisposeImage GdipCloneImage GdipCreateBitmapFromScan0 GdipAlloc GdipFree GdipCloneBrush GdipDeleteBrush GdipCreateSolidFill GdiplusStartup GdiplusShutdown GdipDeleteGraphics GdipCreateHBITMAPFromBitmap

wininet

HttpSendRequestW InternetReadFileExW HttpOpenRequestW InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetCloseHandle

kernel32

GetOEMCP GetACP IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetModuleFileNameW GetCommandLineW EnterCriticalSection LeaveCriticalSection GetModuleHandleW Sleep GetProcAddress lstrlenW GetLastError FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW SetLastError LoadLibraryExW OutputDebugStringA LoadLibraryW GetModuleHandleA GetFileAttributesW GetVersion lstrcmpiW LockResource FindResourceExW CloseHandle CreateThread CreateEventW WaitForSingleObject RaiseException GetCurrentThreadId DeleteCriticalSection SetEvent InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement GlobalUnlock GlobalLock GlobalAlloc lstrcmpW IsValidCodePage FlushInstructionCache GetCurrentProcess GlobalFree GlobalHandle lstrlenA IsBadWritePtr InitializeCriticalSection IsWow64Process ReadFile CreateFileW WideCharToMultiByte LocalFree LocalAlloc HeapAlloc GetProcessHeap HeapFree WriteFile GetTempFileNameW GetTempPathW FormatMessageW HeapSize InterlockedCompareExchange InterlockedPushEntrySList IsProcessorFeaturePresent VirtualFree VirtualAlloc InterlockedPopEntrySList InterlockedExchange EncodePointer DecodePointer RtlUnwind VirtualProtect GetSystemInfo VirtualQuery HeapSetInformation GetStartupInfoW LCMapStringW GetCPInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThread HeapCreate ExitProcess GetStdHandle GetLocaleInfoW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount HeapDestroy GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetConsoleCtrlHandler SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers MulDiv HeapReAlloc

user32

MonitorFromRect GetMonitorInfoW OffsetRect PostMessageW SetFocus SendMessageW GetWindowTextLengthW GetWindowTextW SetWindowTextW GetClassInfoExW RegisterClassExW DestroyWindow LoadCursorW IsWindow CallWindowProcW GetWindowLongW SetWindowLongW DefWindowProcW PostThreadMessageW GetMessageW TranslateMessage DispatchMessageW CharUpperW MonitorFromWindow GetWindowRect SetWindowPos DestroyAcceleratorTable GetSysColor GetWindow GetFocus IsChild FillRect BeginPaint GetClientRect RedrawWindow GetClassNameW GetParent GetDesktopWindow ReleaseDC GetDC CreateAcceleratorTableW MoveWindow ClientToScreen ScreenToClient ReleaseCapture SetCapture InvalidateRect GetForegroundWindow FindWindowExW CharLowerBuffW GetWindowDC UnregisterClassA ShowWindow DialogBoxIndirectParamW SendDlgItemMessageW MapDialogRect SetWindowContextHelpId EndDialog MapWindowPoints MessageBoxW CreateDialogIndirectParamW CreateWindowExW GetDlgItem RegisterWindowMessageW InvalidateRgn CharNextW PostQuitMessage EndPaint UpdateLayeredWindow

gdi32

GetStockObject GetObjectW GetDeviceCaps CreateSolidBrush DeleteObject CreateCompatibleBitmap CreateCompatibleDC SelectObject DeleteDC BitBlt

advapi32

RegDeleteKeyW IsValidSid GetSidIdentifierAuthority OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegQueryValueExW RegEnumKeyExW RegDeleteValueW RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryInfoKeyW RegOpenKeyExW

ole32

StringFromGUID2 CoCreateGuid CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CoRegisterClassObject CoRevokeClassObject CoAddRefServerProcess CoReleaseServerProcess StringFromCLSID OleUninitialize CreateStreamOnHGlobal OleInitialize CoGetClassObject CLSIDFromProgID CLSIDFromString OleLockRunning

oleaut32

VarBstrFromR4 SysStringLen VarBstrCmp VarUI1FromStr VarUI2FromStr VarUI8FromStr VarI1FromStr VarI2FromStr VarI4FromStr VarI8FromStr VarR4FromStr VarR8FromStr VarBoolFromStr VarDecFromStr VarBstrFromUI1 VarBstrFromUI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromI1 VarBstrFromI2 RegisterTypeLi VarBstrFromR8 VarBstrFromBool VarBstrFromDec VariantChangeType OleCreateFontIndirect VariantCopy SysAllocStringByteLen SysStringByteLen SysAllocStringLen VariantClear VariantInit DispCallFunc LoadRegTypeLi VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString

shlwapi

UrlCreateFromPathW PathRemoveFileSpecW

urlmon

ObtainUserAgentString

BackgroundHost64.exe

IMPHASH ff0cb84b0b999fafe4516e8e5da36703
SHA256 d78b3249933f4810bf7835b362568a42afeef773a307b964e90ba6d5a09fe372
MD5 bc8dbcf85683b26fe92fc641d2fde44d
SHA1 3c38cf077639ea32f0fe47aaabf8e78538857279
SHA512 ec7f0197cf1c104e8a92eaaf0134b2cf9cbd15183951d503daf6bd3915e50a42f6812400aaa3270a415f39124b3e9a2115bd301ac292ddabb1476582dda2d1ff
SSDEEP 6144:tGfaF9cy25QMWehhbhPWrNN5TVo/xUGhA+quBR9ppOLacTnprIjPh3TZo573ah1u:wfFUehh1/+0ALyN6an2EIph1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

PE Signature issue

Digest

39:d4:d6:3c:e2:77:71:7a:f5:61:69:4a:22:5d:83:95:98:fa:bc:5a

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

2

Major OS version

5

Entry point

211780

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\x64\Release\BackgroundHost.pdb

gdiplus

GdipDeletePath GdipDeleteGraphics GdipDisposeImage GdipCreateBitmapFromScan0 GdipCreateHBITMAPFromBitmap GdipCreateSolidFill GdipClosePathFigure GdipCreatePath GdipAddPathArcI GdipGetImageGraphicsContext GdipSetSmoothingMode GdipDrawPath GdipGraphicsClear GdipFillPath GdipDeletePen GdipCreatePen1 GdipDeleteBrush GdiplusShutdown GdiplusStartup GdipAddPathLineI

wininet

HttpSendRequestW InternetReadFileExW HttpOpenRequestW InternetConnectW InternetSetStatusCallbackW InternetOpenW InternetCloseHandle

kernel32

FlsGetValue IsValidCodePage GetOEMCP GetACP TerminateProcess RtlCaptureContext lstrlenW RaiseException GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetProcAddress GetModuleHandleW lstrcmpiW EnterCriticalSection LeaveCriticalSection CloseHandle WaitForSingleObject GetModuleFileNameW Sleep GetCurrentThreadId CreateThread CreateEventW SetEvent FreeLibrary MultiByteToWideChar LoadLibraryExW GetCommandLineW FlushInstructionCache GetCurrentProcess GlobalAlloc SetLastError lstrcmpW MulDiv GlobalUnlock GlobalLock GlobalFree GlobalHandle FlsSetValue IsBadWritePtr InitializeCriticalSection LoadLibraryW WideCharToMultiByte ReadFile CreateFileW GetVersion LocalFree LocalAlloc HeapAlloc GetProcessHeap HeapFree GetTempFileNameW GetTempPathW WriteFile FormatMessageW HeapReAlloc HeapDestroy VirtualFree VirtualAlloc InterlockedPopEntrySList EncodePointer DecodePointer RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx VirtualProtect SetThreadStackGuarantee GetSystemInfo VirtualQuery GetStartupInfoW LCMapStringW GetCPInfo ExitProcess GetStdHandle HeapSetInformation HeapCreate UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind FlsFree FlsAlloc GetLocaleInfoW GetStringTypeW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleW FlushFileBuffers lstrlenA InterlockedPushEntrySList

user32

CreateWindowExW MonitorFromRect OffsetRect RegisterClassExW MessageBoxW GetWindowRect MonitorFromWindow GetMonitorInfoW DestroyWindow LoadCursorW GetClassInfoExW GetSysColor SetFocus SetWindowPos PostMessageW SendMessageW GetWindowLongPtrW DefWindowProcW SetWindowLongPtrW CallWindowProcW PostThreadMessageW GetMessageW TranslateMessage GetWindowLongW SetWindowLongW MoveWindow GetClientRect ClientToScreen ScreenToClient GetDC ReleaseDC InvalidateRect InvalidateRgn RedrawWindow IsChild GetParent GetDlgItem GetClassNameW ReleaseCapture FillRect EndPaint BeginPaint GetDesktopWindow DestroyAcceleratorTable GetWindow GetFocus CreateAcceleratorTableW GetForegroundWindow UnregisterClassA CharLowerBuffW UpdateLayeredWindow ShowWindow GetWindowDC MapDialogRect SetWindowContextHelpId EndDialog MapWindowPoints SendDlgItemMessageW CreateDialogIndirectParamW RegisterWindowMessageW GetWindowTextLengthW GetWindowTextW IsWindow SetWindowTextW DispatchMessageW PostQuitMessage CharUpperW CharNextW SetCapture FindWindowExW

gdi32

GetStockObject GetObjectW CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC DeleteObject SelectObject

advapi32

RegDeleteValueW IsValidSid GetSidIdentifierAuthority OpenProcessToken GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority RegQueryValueExW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegCreateKeyExW RegDeleteKeyW RegCloseKey RegSetValueExW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoRevokeClassObject CoRegisterClassObject CoTaskMemFree CoInitialize CoUninitialize StringFromGUID2 CoCreateInstance CoAddRefServerProcess CoReleaseServerProcess CoCreateGuid OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal OleInitialize OleUninitialize StringFromCLSID

oleaut32

VarR4FromStr SysFreeString VarBstrCmp VarBstrFromUI1 VarBstrFromUI2 VarBstrFromI4 VarBstrFromI8 VarBstrFromI1 VarBstrFromI2 VarBstrFromR4 VarBstrFromR8 VarBstrFromBool VarBstrFromDec VarUI1FromStr VarUI2FromStr VarUI8FromStr VarI1FromStr VarI2FromStr VarI4FromStr VarI8FromStr SysStringLen VarR8FromStr VarBoolFromStr VarDecFromStr VariantChangeType OleCreateFontIndirect SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantCopy LoadRegTypeLi DispCallFunc VariantClear VariantInit VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString

shlwapi

UrlCreateFromPathW PathRemoveFileSpecW

urlmon

ObtainUserAgentString

BackgroundHostPS.dll

IMPHASH 20d5a18b2d271ffadea9b0347c016e57
SHA256 af1b8e0368713a51a91d7039d9fb267bc69b8f92cadf5f3f6dc2d1afc983b82b
MD5 0da00a0378496d8df64a62a685286cf4
SHA1 172fd5d2e2d3572389fcde96bdee74d8c20c80ea
SHA512 c73a36b8549d674dd4e3b85864fb20d0a2370a307417492062ec7637c1498194ffac25d6a444122a4090b209a55fb3e69d3118451490282eb9f4933940b4f27a
SSDEEP 768:aMU2H3xnzLQupqQ2SpDhWPVOMBIzYxVNUk1wci6JBrxSWUmaJajxFD9x:aMTBvL5WPVOM26fwyJdzUmaJajjJx
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

e8:33:3a:17:39:a7:e5:b5:e4:7f:f6:ef:2f:42:06:ab:05:57:9c:56

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

0

Major OS version

5

Entry point

9063

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

DisableThreadLibraryCalls HeapSize LCMapStringW LCMapStringA GetStringTypeW MultiByteToWideChar GetStringTypeA GetLocaleInfoA GetCurrentThreadId GetCommandLineA GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc WriteFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount RtlUnwind

rpcrt4

NdrDllUnregisterProxy NdrDllRegisterProxy NdrCStdStubBuffer2_Release NdrDllCanUnloadNow NdrDllGetClassObject NdrOleAllocate NdrOleFree IUnknown_QueryInterface_Proxy IUnknown_AddRef_Proxy IUnknown_Release_Proxy NdrStubForwardingFunction NdrStubCall2

ButtonSite.dll

IMPHASH c7781083fab6265e8f6f166dfd5ce0f0
SHA256 967ca12fa5fdfdaae83d0d319ce9f961f1c918bbe6559c158e956c99bb4af527
MD5 b762295d0b9e836ca8136dd502f46853
SHA1 6997ffbf0cd9f1ff50ecc39006fd3f2d9c285fcd
SHA512 60ad86d7254c583abac5ed24996b04f4b84c51ee85e9866b8c7a3d74f72732d01a6471a3297bfc12107141872d0b89dd2222860ff3892bd2a42c002eb9380b63
SSDEEP 6144:LI51RDk3fvc6tEdAseh90vLyvHIN7PYW8r1:LIPy38AEdAsehTgNjYpZ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

09:bd:5a:10:8c:88:a6:df:a3:8b:25:76:05:5a:1c:34:35:1b:a3:68

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

1

Major OS version

5

Entry point

131714

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\Release\ButtonSite.pdb

comctl32

ImageList_GetImageCount ImageList_SetImageCount ImageList_ReplaceIcon

uxtheme

IsThemeActive

kernel32

SetEvent CreateEventW DeleteCriticalSection GetVersion OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile InitializeCriticalSectionAndSpinCount GetCurrentProcessId FreeLibrary LoadLibraryExW InterlockedIncrement InterlockedDecrement MultiByteToWideChar lstrlenW RaiseException SetThreadLocale GetThreadLocale lstrcmpiW InitializeCriticalSection WideCharToMultiByte CreateFileW WaitForSingleObject ReadFile LocalAlloc HeapAlloc GetProcessHeap HeapFree GetConsoleMode GetConsoleCP SetFilePointer IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount GetStringTypeW HeapCreate IsValidCodePage GetOEMCP GetACP CreateThread GetModuleFileNameW GetProcAddress GetModuleHandleW CloseHandle GetLastError LeaveCriticalSection EnterCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource FlushInstructionCache GetModuleHandleExW GetCurrentProcess SetStdHandle WriteConsoleW LoadLibraryW GetLocaleInfoW FlushFileBuffers GetStdHandle WriteFile SetLastError TlsFree TlsSetValue TlsGetValue TlsAlloc ExitProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCPInfo LCMapStringW RtlUnwind GetCommandLineA GetCurrentThreadId Sleep DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange LoadLibraryA InterlockedExchange

user32

SendMessageW SetWindowLongW LoadIconW FindWindowExW PostMessageW GetWindow DefWindowProcW CharLowerBuffW MapWindowPoints CharNextW KillTimer GetWindowThreadProcessId GetMessageW PeekMessageW PostThreadMessageW CallWindowProcW SetTimer GetWindowLongW InvalidateRect LoadImageW DestroyIcon IsWindow

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW OpenProcessToken

ole32

CoTaskMemAlloc CoInitialize CoUninitialize CoTaskMemFree CoTaskMemRealloc StringFromGUID2 CoCreateInstance

oleaut32

SysStringByteLen SysAllocStringByteLen VariantChangeType VariantInit VariantClear RegisterTypeLi VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysStringLen SysAllocString SysFreeString

shlwapi

PathRemoveFileSpecW

ButtonSite64.dll

IMPHASH bc41371be477c74c95f5ce0cb5458ae6
SHA256 4801d103997383998ef128217938b786e7e645f2353ccc5a419ec4907877bd8a
MD5 44498e8954a87d0b5cd2e3f83307e531
SHA1 161576502bfecc87888e8a709575ca897673790d
SHA512 dfb6d046edb6236629c1a2d4d69be373ed60b8e1e4855cad415badf5fac0657b5ab24a591dc831158a491c586229b7065b064bd9d1c0e68c2969002a8b4adc0e
SSDEEP 6144:b8Q937yMdHVNGB72MWhy+ym3q1TAKp7zEf2FbIi+EHoyvHIN7PYW86:TyMXwH3mUH+irgNjYp6
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x64 arch:x64

PE Signature issue

Digest

99:5e:1b:d0:e7:44:70:d4:a4:d4:83:04:1b:47:ca:55:63:3f:52:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

2

Major OS version

5

Entry point

93656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\x64\Release\ButtonSite.pdb

comctl32

ImageList_GetImageCount ImageList_SetImageCount ImageList_ReplaceIcon

uxtheme

IsThemeActive

kernel32

SetEvent CreateEventW DeleteCriticalSection GetVersion OpenProcess VirtualAllocEx WriteProcessMemory VirtualFreeEx CreateRemoteThread CreateFileMappingW OpenFileMappingW MapViewOfFile UnmapViewOfFile InitializeCriticalSectionAndSpinCount GetCurrentProcessId FreeLibrary LoadLibraryExW MultiByteToWideChar lstrlenW RaiseException SetThreadLocale GetThreadLocale lstrcmpiW InitializeCriticalSection WideCharToMultiByte CreateFileW WaitForSingleObject ReadFile LocalAlloc HeapAlloc GetProcessHeap HeapFree GetConsoleMode GetConsoleCP SetFilePointer IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount GetStringTypeW HeapCreate HeapSetInformation IsValidCodePage GetOEMCP CreateThread GetModuleFileNameW GetProcAddress GetModuleHandleW CloseHandle GetLastError LeaveCriticalSection EnterCriticalSection FindResourceExW FindResourceW LoadResource LockResource SizeofResource FlushInstructionCache GetModuleHandleExW GetCurrentProcess SetStdHandle WriteConsoleW LoadLibraryW GetACP GetLocaleInfoW GetStdHandle FlushFileBuffers WriteFile FlsAlloc SetLastError FlsFree FlsGetValue ExitProcess RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCPInfo LCMapStringW RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader GetCommandLineA FlsSetValue GetCurrentThreadId Sleep DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree InterlockedPushEntrySList LoadLibraryA

user32

SendMessageW SetWindowLongPtrW LoadIconW FindWindowExW PostMessageW GetWindow DefWindowProcW CharLowerBuffW MapWindowPoints CharNextW KillTimer GetWindowThreadProcessId GetMessageW PeekMessageW PostThreadMessageW CallWindowProcW SetTimer GetWindowLongPtrW InvalidateRect LoadImageW DestroyIcon IsWindow

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExW RegSetValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegQueryInfoKeyW RegCreateKeyExW OpenProcessToken

ole32

CoTaskMemAlloc CoInitialize CoUninitialize CoTaskMemRealloc CoCreateInstance StringFromGUID2 CoTaskMemFree

oleaut32

SysStringByteLen SysAllocStringByteLen VariantChangeType VariantInit VariantClear RegisterTypeLi VarUI4FromStr UnRegisterTypeLi LoadTypeLi SysStringLen SysAllocString SysFreeString

shlwapi

PathRemoveFileSpecW

ScriptHost.dll

IMPHASH c6d1f7ea900941682121319c13d44a1a
SHA256 4f0cb78047456f9fe345303a32f9bc6d2b16ef2e7241e9868d83ba480c26d89f
MD5 816bdea9ac91c88c7b1f374c7e5a74c8
SHA1 532967fe6e5c86600ba9d585f40595df49a71507
SHA512 45e10a9ca34192e31ac0ccd04739cb490316a7932031212a95322bbe74e298f3a7ff8c89ddd2c3eb135b7d4f374cfcf7b3b9a6fde437c3b22e21db327d6d4d70
SSDEEP 6144:ywoBTY/RRMnJIrk8DRYH20Di3O2u/KT3Qxl8Ao4UrQ9/UcvAEDiKHJTD2+o:rETWRRWJck+OHJDAO2u/KT3Qxl8AzAQI
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

ac:c9:b9:cb:8b:2e:13:bd:c7:75:41:8d:9b:ac:14:bb:04:c8:0f:c6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PurpleTech Software Inc,O=PurpleTech Software Inc,L=Beaverton,ST=OR,C=US

Chains

May 3, 2024

Minor OS version

1

Major OS version

5

Entry point

213076

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\Products\AddonsFramework\Internet Explorer\Release\ScriptHost.pdb

kernel32

SetThreadLocale GetThreadLocale FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW LoadLibraryExW lstrcmpiW LockResource FindResourceExW GetTickCount CreateMutexW WideCharToMultiByte lstrlenA OutputDebugStringW InitializeCriticalSection LoadLibraryW IsWow64Process CloseHandle ReadFile CreateFileW GetVersion LocalFree LocalAlloc HeapAlloc GetModuleHandleW HeapFree FlushFileBuffers WriteConsoleW SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameA GetStartupInfoW GetFileType SetHandleCount LCMapStringW GetLocaleInfoW GetProcAddress SetLastError GetCurrentProcess FlushInstructionCache GetCurrentThreadId LeaveCriticalSection EnterCriticalSection GetModuleFileNameW lstrlenW InitializeCriticalSectionAndSpinCount InterlockedIncrement GetLastError RaiseException DeleteCriticalSection InterlockedDecrement GetProcessHeap GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo GetStdHandle WriteFile HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsGetValue TlsAlloc ExitProcess Sleep GetCommandLineA VirtualQuery GetSystemInfo VirtualProtect RtlUnwind DecodePointer EncodePointer HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange TlsFree TerminateProcess TlsSetValue

user32

SetTimer KillTimer IsWindow SetWindowLongW CreateWindowExW GetClassInfoExW LoadCursorW RegisterClassExW CharNextW IsWindowVisible GetClassNameW FindWindowExW SetForegroundWindow SetFocus keybd_event CharLowerBuffW CallWindowProcW GetWindowLongW DestroyWindow DefWindowProcW GetTopWindow GetWindow IsChild UnregisterClassA

advapi32

GetSidSubAuthorityCount IsValidSid GetSidIdentifierAuthority OpenProcessToken GetTokenInformation GetSidSubAuthority RegQueryValueExW RegDeleteValueW RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegOpenKeyExW RegSetValueExW RegCreateKeyExW RegCloseKey

ole32

CoInitializeEx CoCreateInstance CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoTaskMemRealloc CLSIDFromProgID CoInitialize CoUninitialize

oleaut32

VarBstrFromUI2 VarBstrFromUI1 VarDecFromStr VarBoolFromStr VarR8FromStr VarR4FromStr VarI8FromStr VarI4FromStr VarI2FromStr VarI1FromStr VarUI8FromStr VarUI2FromStr VarUI1FromStr VariantCopy VarBstrFromI8 VarBstrFromI1 VarBstrFromI2 VarBstrFromR4 VarBstrFromR8 VarBstrFromBool VarBstrFromDec DispCallFunc VariantChangeType SysStringByteLen SysAllocStringByteLen VariantClear VariantInit VarUI4FromStr UnRegisterTypeLi RegisterTypeLi VarBstrCmp SysAllocStringLen SysStringLen LoadTypeLi LoadRegTypeLi SysAllocString SysFreeString VarBstrFromI4

shlwapi

PathRemoveFileSpecW UrlCreateFromPathW

background.html

SHA256 5eb1be0517819521570f32d3e69e9fcbd928c390131c7267ffc5077c4040b2cc
MD5 3c3ba9f10e8f555505b0e5a4407ef43a
SHA1 dcb018a3b61f54be63ac11d0a2ac50de2f6ec1e9
SHA512 5483df4d0ead1939e9db765964cd11e9bd19e770e7a609c2ab7fbb9880eb7f9dd0dfccfc5e6e30d649091abd85e48684efc7a2a10ac135d30720a8195b39a07b
MD5 SHA1 SHA512

polyglot

config.xml

SHA256 f5b8e26bb93ca1f9030b3f840e92df2a0508adbd69b7c464fa3bf1aaec5cda64
MD5 ee2f25dc37dd6751c2a461a2221211ca
SHA1 c964f8fe9744c66aca98332958d4901af2c90eeb
SHA512 dd7f0cc8bee45b23b401c6fe78830f7b144c43a0275a33cf8e5f805dc47237d7476ab8ea702190f83fdb5ca011d8b165046dcbfd37cda4539fc1210a8e816bcd
MD5 SHA1 SHA512

content.js

SHA256 723edadf07e76deef6be6e2d4edadd5da5d716f73eee4a0a12cd1caa4d95a512
MD5 024b82ece28f3870f3c7f6debf8f0cd5
SHA1 c48cb5732ebc2249e7fc4125fcde89bde18f1939
SHA512 df46d769b1ba9afaa896ee7d65fb5af668589b1c6504c85392614cb6657443c53afc36b44e46a61a38b3c614b4d59a0bd029f3ca6437c29b4cc289200b0f7cdd
MD5 SHA1 SHA512

icon128.png

SHA256 5b27f70f2db4ca9229d0951ad21a50e040f0286bbdbb2759d43b032117548a8e
MD5 cd1a63eb9a6e6e44bcd9e671ea50c6dc
SHA1 ef6a987f9eddf712845554f50834ff5b96bb2c8f
SHA512 91c735ddaeb968af8788a5e38f5b85ab468f69fc8d0141957ad5737618b92d8d66c7704d02400bd6dd4960872df353b1ddeb0f774e0ac55521cd4620c989acb0
SSDEEP 384:2ZiiC5uURrL8hf6pnBVYdASWn9tyV7/zzZ9il7prUtyGFJVrw9k1Bst:+WRLrnEiDLunjcwFVc9kHU
MD5 SHA1 SHA512 SSDEEP

icon16.png

SHA256 accad556b5212c1b2707a0611a65cf86c2d15ef830e6469c338565ec8fa8c195
MD5 f833bdbde94a30224cff42e49f76cc95
SHA1 41adf57694d558efe92461d901114a13c5591a81
SHA512 b96bf2caa7f30ae53f4ae980f682668a4cd677b07f5a9bd23746049f458ab2cf4f340457460eebafb9a8b1636cf1d6ff77643337f175d1f13a4d556dc91b0c04
MD5 SHA1 SHA512

icon48.png

SHA256 6c77f0cf1c2b32f334d26370812a4a033938cea2b87620c0d1193df5c1f53188
MD5 e9b8b97f328ecb7d9539d57c4feb5cf6
SHA1 07d6d390a5826b32267c8dd3065f8a42297bf0d1
SHA512 ee031b9d63afd4c6289107638006fb24b0bf0a4dfa22a36a6d28b4fcb4b656b27ca36744cc8399a7f4207b2e58fda200496e51e0d0fd5bfddb69a156dd3e190a
SSDEEP 192:KnflEg6ItuZ4MrMfYSagazrKLyNIZh/IZl4:K9OKuuQRgH+6n8u
MD5 SHA1 SHA512 SSDEEP

jquery-1.9.1.min.js

SHA256 c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
MD5 397754ba49e9e0cf4e7c190da78dda05
SHA1 ae49e56999d82802727455f0ba83b63acd90a22b
SHA512 8c64754f77507ab2c24a6fc818419b9dd3f0ceccc9065290e41afdbee0743f0da2cb13b2fbb00afa525c082f1e697cb3ffd76ef9b902cb81d7c41ca1c641dffb
SSDEEP 1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5 SHA1 SHA512 SSDEEP

json2.min.js

SHA256 841ed7c82cdc456b0ae903abd2c2d10632a33e80d4e6c7aced0531c442a1094e
MD5 fcc3c5f30afb210a14a095ac65e598de
SHA1 d7fb6636c20fe0526641263daa57912f27d5a2c4
SHA512 cdde13667b1597e920463b55231ddb8efd4904650f3358eea887b9c4fcc00c1ad114e95d8c1704629376005c3a40f6eab96e0972aa2ac12326513b86ac47548d
MD5 SHA1 SHA512

mz/background.js

SHA256 5f66886bdb7f38ae0d47255fdf3ff7d29f7a26bafedb928b914e5b00e88542f7
MD5 90d1af3cd5677b18048ee64f509ea9fd
SHA1 72316440e12729195da10c60696d17ba9630e45a
SHA512 7081254a06b851c6966fad221902a5ffa365f4a4c32299d657843d8a0a07054568ada032f475a508bbfcdc4c01f5d5e0d03cb2af73ebdfa2338105f7fae3f9d3
MD5 SHA1 SHA512

mz/content.js

SHA256 f940c80a50a86e85ed80b71ab9999ef60d271047bbb2f265bc3b37b80ca0cd07
MD5 428a2d28a31908538f6b433d9150bd7e
SHA1 de9398a23f158a64cc1031eaef2e4e21ad040e72
SHA512 f55f53df0f91fce40b36fc0757144b2f4fa22d26d65720bb6a9e31ec541e813bc17170feecc61435621b117cb97228812f02e2751bcad4006c2ae4551e1d25e3
MD5 SHA1 SHA512

uninstall.exe.nsis

SHA256 a7d6d02ab70ae918b5ceaa0b76d78173cd409d7260f2330115b6debe4ad5abe8
MD5 5b507784ed6288ab3c55ba451543c335
SHA1 c3173d98e8ba6c005004386cc1e8bf61154a919d
SHA512 09646a7e234ae55ca9a9f9bfd5ffba73d122acb9da1e702f3d8cbd3384d461714345ad16dbe806756656ce69c96438052848eb91a077cf87e0b0a4212aac7bdb
SSDEEP 768:4BUbuC2jHc7bhoO0AVuOSKf4yVacdQFsGcwUUtlE:4BrCj/LnVZz4lcdf6UUjE
MD5 SHA1 SHA512 SSDEEP

updater.js

SHA256 f77fe3883a98d33825969329f0ebf1b3d4347144de06436167fdd9c5b7b46c69
MD5 24879bcbc5b1f218f7f7cf120ba6a5d4
SHA1 a957388e857bf7575fa57b306ba24e34b5980504
SHA512 f26fa58d3f49c67194e65ef10484a6bded6c979900f99c92c073183e4937ee2a5f870072be09d50a8f609d006c58d2179204dd3bb103bab582846ac33e7ea298
MD5 SHA1 SHA512

updaterWrapper.js

SHA256 3d60c603e5a1c07c0b1c10fe9d1433fb08ace0de8eb731b82f3f16f34422d834
MD5 602867ead9102eb65e073acb061faf96
SHA1 53a41eb2035bb94cd6566b1940aa02d68c8ba381
SHA512 7a4986163b44676bbf75691418dd24eaf3e60a3193f51e2d84f79ec44f44790d156f39efea05a1a2eee0858938a9cd1597d55755f2e6f971e64e0622d4e29b3f
MD5 SHA1 SHA512

Sharing

General

Malware Config

Signatures

File Explorer