485fd9e0fa159847c99fae2d1463a838_JaffaCakes118

resource
485fd9e0fa159847c99fae2d1463a838_JaffaCakes118
unpack001/$PLUGINSDIR/ChameleonTomIE.exe
unpack002/uninstall.exe
unpack002/wit4ie.dll
unpack001/$PLUGINSDIR/InetLoadEx.dll
unpack001/$PLUGINSDIR/Processes.dll
unpack001/$PLUGINSDIR/Progress.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/blowfish.dll
unpack001/$PLUGINSDIR/nsisunz.dll
unpack001/$PLUGINSDIR/nswebgui.dll
unpack001/$R3/$PROGRAMFILES/ChameleonTom/UninstallChamTom.exe
unpack004/$PLUGINSDIR/Processes.dll
unpack004/$PLUGINSDIR/System.dll

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/$PLUGINSDIR/ChameleonTomIE.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/ChameleonTomIE.exe	nsis_installer_2
static1/unpack002/uninstall.exe	nsis_installer_1
static1/unpack002/uninstall.exe	nsis_installer_2
static1/unpack001/$R3/$PROGRAMFILES/ChameleonTom/UninstallChamTom.exe	nsis_installer_1
static1/unpack001/$R3/$PROGRAMFILES/ChameleonTom/UninstallChamTom.exe	nsis_installer_2

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 48eda05ebc3353d6a9386a9796a76c42395caa2ab9894936ee59484b17369fbf
MD5 485fd9e0fa159847c99fae2d1463a838
SHA1 e13d2db455d5c09738671cc906069b09a89d0655
SHA512 52cbf756b6d652b2b11d2b9c184d08d1b87afe596cedb26511ec0baaf5f3a6df16e0e6603b237604c1274953ae5605b7ae8b98b54281fd750e4add240a45e345
SSDEEP 12288:v0aOMEz2DmXYj1F9n5TBT3SXW3YoJ06N2xOqkaAqeUe532rGzduuSh:cEEbXYzogatKuGzduuSh
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Background.png

SHA256 1583bb4382dc48c125185d6467bcdeb59b4e3a2b98abe10a50cd420ff15f1e1f
MD5 e4161911c702bfe4f953a0c909075fcf
SHA1 d3e4b87f5cd405c634a786ff2a41def44790d01a
SHA512 046dbb7aa46e768c9b0b4e4160fbcdf2b469f85ce0d51346a21f52b33574761f0a07f691dc58dc0b65ca308f1df35e97df2d8046ffef28eef402e0cfd97ba263
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/ChameleonTomIE.exe

IMPHASH 82081664e680178d1ea8f9cb6ad940a7
SHA256 db11bb695712303ff8c9d0abe08810bdd0b046794c26f342f22706e24446442b
MD5 6ac6f46f4202ae21f46fd0068a962d3e
SHA1 9e286b8f0f87df399f7a386c672d8d1473620b73
SHA512 fb5906550c6de64b23deed80761ac7edc2bd0ee925656556dcd105aaeff3ebcc79cce849c70b8499ceae3f5be244e8dd0ea3cc6a12caa79e4e44243a57f3b3f0
SSDEEP 3072:F85FnEA0PNdJl45vHHtJICAohuq4sINZGMqEcyi5/rNB8iYUjt8A47:FgFEN9IHNuCAAunnG1RxLW7
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA ExitProcess GetCurrentProcess CopyFileA GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread LoadLibraryA CreateProcessA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion RemoveDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

ScreenToClient GetMessagePos CallWindowProcA IsWindowVisible LoadBitmapA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuA CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos CheckDlgButton GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA DialogBoxParamA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumValueA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

about.gif

SHA256 918c54162a050c21015cd72bd2c8e2f6fa67295b7434602a06af623868e16eee
MD5 7b2afe5672e3fb535af94532a44b4cc9
SHA1 b6bd7da79661009193efaf5aa59469712ca622e8
SHA512 9dd0a1638f1d58c4dce5bccbb48c2409431abb5f442c54edf6e3dcc0f2e5058c94ce312339ebef47d27807d5171ff29701c65d570d9757a88b5e59eb61a5f16f
MD5 SHA1 SHA512

NSIS installer

installer

ct.htm

SHA256 7e010420211279352d49aec140ba56bfccd99aa4a67550b95767331786e342c9
MD5 d3f42b1cc58d759c71d201816d5cc6b1
SHA1 5d66e3bdf3563ee55204137c14c65e7fe8141dd6
SHA512 d9624a2e44c1b26c2a46e91f8dfae4ddb4457cafb853b4231c3f5bcaaeec2829d33e52b2834185478d22a11f8cb5112cdb2fdc17cc49476533fd024da3a74757
MD5 SHA1 SHA512

polyglot

NSIS installer

installer

hoticon.ico

SHA256 39ddf5a649eff490eb36e4b57d683fce54bcd5cdf4fdd3e9528693e318d46728
MD5 26ed3ffe3cef3a2a5d8da5205c6f8100
SHA1 a44235f765c2544f812a275c810969078f930702
SHA512 50369f312d4719bd0658df840e71b08a3dce30cd10c445b12b88a02c6c3318fff184f4c46f24f2acea474f5ecc68cdfc651ce696c04f572a7a58ece79bb1f362
MD5 SHA1 SHA512

NSIS installer

installer

menu_en.htm

SHA256 85dda9f138c28df9392439c7f2535cd263ac751ca016e0e302ce1c92040ca5e0
MD5 9b3f1fadefb4823f9ff7d4e95235cc12
SHA1 35d62346a8529c464b340a541edc29e1d3c72f8e
SHA512 8e74494cf77bd1818190c4f91aa8afefbb185c4b7cdbe77ec7fd4d49b5296ec5a50097d34b0e731e5374f55a4a5c5235661b1f9e54609cb8058a7cfa0f7f4517
SSDEEP 192:4qGVd+MXRWKvrKJp/5nqpoqFy+XeBPDyt2Jo/OrlX6F3idUI2ATCs:4ZVd+SRBSuU62Jo/OrlX6F3yUIlTCs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

menu_ru.htm

SHA256 b2ebcff602d543d22b00cd860254a496daa6c73c2fa8d99c794ed7eda8205d0f
MD5 cc83539cc650c37cf1c8c375339bbcbb
SHA1 d1af7cd3c138aafcad03a172027193dadfd8f681
SHA512 2e07acf796d4653a9c5c172f10e186dcf2711144d1ba556860e6f344ad596d6bcd27db35017c5d9bb9733edaa2088e5fa8054520665fabea9798a8fc3eaedf16
SSDEEP 192:4q+Vd+MXRWKvrKJp/5nqpoqFy+XeBPDyt2J2vu1XiFnXtBWIg0T+s:4RVd+SRBSuU62J2vu1XiFnKItT+s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

uninstall.exe

IMPHASH 82081664e680178d1ea8f9cb6ad940a7
SHA256 6b9ade2208612a17824b35c002ce0223ac31ced224e66f84f0781ab8be82e07b
MD5 ab6f301fbec8e875706f56bf91741aa8
SHA1 af06afad8830356895719e9fe59ca0cb34abaae9
SHA512 8066ab37adc3e1212440b9c8d55d5e2784ec94f401261169b77ee239a8d710bd0a2aa1d25a9297a066ca2fea04fe9dadb2272d4d65064d833509a2a9168c631a
SSDEEP 768:+bAqMPUUDYXQYFnh2A9uxICjmtIh4dGkqEhMFBiihdJSMgd2iZQAm6kRRS+NoJRl:CM8ZbFnEA9uPI2TdJSMgdLeAyNl5+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA ExitProcess GetCurrentProcess CopyFileA GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread LoadLibraryA CreateProcessA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion RemoveDirectoryA CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

ScreenToClient GetMessagePos CallWindowProcA IsWindowVisible LoadBitmapA CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuA CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos CheckDlgButton GetClassInfoA CreateWindowExA SystemParametersInfoA RegisterClassA SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA LoadCursorA SetCursor GetWindowLongA GetSysColor CharNextA DialogBoxParamA ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderA SHGetPathFromIDListA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegEnumKeyA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegDeleteValueA RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumValueA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

wit4ie.dll

IMPHASH bd1c594f0c612cd55a39eaa395682201
SHA256 ac3f100228ea22017c2bf09796a046bbd3710cc3fa843b5ebc46a94d9d9bd2b0
MD5 6b4513d6395fc100d3bf98f3428286f2
SHA1 321ae2a5298f79c6f27ef99c4a4c913c4284d31f
SHA512 14a7b9ad09b45c6b5c13246dbedcf0915468dce26ced5851fe7d09c495812ae3cccee51d9716ef76e8a22423b32f31cc489f644dd904bafead257dea0618c9f2
SSDEEP 3072:M2MyXOs+ehSVySe6IyvDelAzaZXrRSakxtUKgDVotxiwiQpUhaMuyIxA0kKU:6yL0VV7u3bwakkKgDVoPiwwa9A+
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

90534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\ScriptedStar4\wit4ie\bin\wit4ie.pdb

kernel32

FlushInstructionCache GetCurrentProcess LoadLibraryW GetLastError SetLastError GetModuleFileNameW OutputDebugStringA GetCurrentThreadId CloseHandle CreateProcessW InitializeCriticalSection DeleteCriticalSection lstrcmpiW LoadLibraryExW FreeLibrary MultiByteToWideChar SizeofResource LoadResource FindResourceW SetThreadLocale GetThreadLocale HeapAlloc LeaveCriticalSection HeapFree CreateDirectoryW GetEnvironmentVariableW SetEndOfFile CreateFileA GetLocaleInfoA GetStringTypeW GetStringTypeA EnterCriticalSection RaiseException GetVersion GetFileAttributesW GetModuleHandleA lstrlenA OutputDebugStringW DebugBreak OpenMutexW GetModuleHandleW GetProcAddress WideCharToMultiByte InterlockedIncrement InterlockedDecrement lstrlenW GetProcessHeap LCMapStringW LCMapStringA CreateFileW WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA SetFilePointer GetStartupInfoA GetFileType SetHandleCount ReadFile ExitProcess Sleep GetModuleFileNameA GetStdHandle IsValidCodePage GetOEMCP SetStdHandle InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime InterlockedCompareExchange LoadLibraryA IsProcessorFeaturePresent VirtualFree VirtualAlloc RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA HeapCreate HeapDestroy HeapReAlloc HeapSize TlsGetValue TlsAlloc TlsSetValue TlsFree WriteFile GetConsoleCP GetConsoleMode GetCPInfo GetACP GetCurrentProcessId

user32

LoadStringW wvsprintfW CharNextW MessageBoxW SetWindowLongW IsWindow LoadCursorW CallWindowProcW GetWindowLongW DefWindowProcW SendMessageTimeoutW FindWindowExW CreateWindowExW GetClassInfoExW RegisterClassExW DestroyWindow UnregisterClassA

advapi32

GetSidIdentifierAuthority IsValidSid GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken GetTokenInformation RegQueryInfoKeyW RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegSetValueExW RegQueryValueExW RegOpenKeyExW RegCloseKey RegDeleteKeyW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CLSIDFromProgID CoCreateInstance

oleaut32

VarBstrCmp RegisterTypeLi UnRegisterTypeLi LoadTypeLi LoadRegTypeLi DispCallFunc SysStringLen VarUI4FromStr SysStringByteLen SysAllocStringByteLen VariantChangeType VariantCopy SysAllocString VariantClear VariantInit SysFreeString

shlwapi

PathFileExistsW PathRemoveFileSpecW

witapi.js

SHA256 0ba8e2c65037d111bb1aa1fd6568e7b0a065a8ac766bd10f249426b7dbfc06db
MD5 a0276100dd67f8d0952b782ecf4fce0a
SHA1 d79aebfd34a75a2311afc59b6666629a922ecc76
SHA512 16ecb4328d8e5eec73e475b314ec471f6d42343a511c58ceae8e17c9ca8db28770a81ae61fab7bd84cd8a5778110a9549900e835134437f46c12e6d7b1997d08
SSDEEP 384:N8iSegr+WP1OOH6/omq/qJBkk+pDMKF1Kcs9SH8M:N8iLgrxP19alqrksAKFIB9SH8M
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

witmain.js

SHA256 2fb5e0d7008fa78c37da29b467283f3b2aa1761442b17663ac75795b04efe86d
MD5 60619580e4127e6414707989c8d5eead
SHA1 1f2582256a51532fef70a623012acc099000652d
SHA512 8c158251e97640f47c9176abe9d7ed70f13872320c3f7bd517c134fdd3cf9acf8d3e17e56be38337810f6c929a9b57aea3021fe0bfd8e73fa20282139bfc11fd
SSDEEP 768:Yn184eKEWFvNUHcaoHwX3sVkHGTbHaGRLp49IdJ:M184eKZFFUHcao6sOTGRLp49IX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/Components.html

SHA256 02c9a76d1b012a133e4ac5e95a2a29fc1c608c4a7245b4886ce89aa07f2c1797
MD5 dbe2a173b32bc4132c30a386c8b41237
SHA1 303bf844136af8866f3c2c0901665b1024d71d53
SHA512 3398710971eaaa44fbdfdbbcfa1fa96f60e6fb7676d6521f853013be17bdb691f1cae6e933b2aa85378b7d30c5a3a0a34e55bdde9e63ac69c6afbb948f127572
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Confirmation.html

SHA256 0de9b6c025ad8da5dcda86652f455edcac12737a8975acd770af18ac32c0beea
MD5 191aceafbad365636cb7643c203626a0
SHA1 eb6c68d54d6a000106ef98333e70a67095eb0012
SHA512 4c3b2bda77ab2d52812acd5250b0fbec7f7be756d3e28ccb9e1c401177e682ca1f020de61b3311635829825365db222000555284502f8598332fa48fa5b4fcbe
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Final.html

SHA256 222816c721c2d70a4af59e86840155c61c13d72faae90bb12f5fa6573542b1c5
MD5 939e3484e47b322c467a6a0f59b23d91
SHA1 f3a315beb9b37736ba7bb4fc15189f3a04d2296f
SHA512 2150dfda6b5d74885bf6c79820bc5ebf1fc3b53c2df39a9da326377182d4a5dc75ac84e9fa75b3ce59cbf681cd751ced68bcc57a7b1a59454e5262d144497ba3
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/InetLoadEx.dll

IMPHASH 999c0f7645164521b950b822906fa062
SHA256 73f4a1529acf2ea56d4db9ed8134bed0498cea38903105f7c2af8cc7d11b8db3
MD5 9fae574b1004bb0650eebba3d8040c59
SHA1 541583ec14af05915b8efefe520edd4f25914c9a
SHA512 ab25c429301f2d8a2da6b7c2a222c4028ad8e393c67dde83606762a8ba49c6c49460538624a799969dd0b3c810623d7e471c65a390e8661228a621580d7d54c7
SSDEEP 768:WFKaQrcF+ntygjX/+qEg469TRphsguCtPQpcQaa5jZ19K:WIaQrs0kgjx9TRsg1ox5H
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

13699

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

wininet

InternetOpenA InternetCrackUrlA InternetConnectA InternetGetLastResponseInfoA FtpOpenFileA HttpOpenRequestA InternetSetOptionA HttpAddRequestHeadersA HttpSendRequestA InternetQueryOptionA HttpQueryInfoA InternetSetFilePointer InternetErrorDlg InternetCloseHandle InternetReadFile

comctl32

ord17

kernel32

HeapSize RtlUnwind InitializeCriticalSectionAndSpinCount HeapReAlloc VirtualAlloc HeapAlloc GlobalFree lstrcpyA lstrcpynA GlobalAlloc lstrcmpA lstrlenA MulDiv WriteFile GetLastError DeleteFileA CloseHandle SleepEx lstrcatA CreateFileA lstrcmpiA GetProcAddress LoadLibraryA GetModuleHandleA TerminateThread WaitForSingleObject CreateThread EnterCriticalSection LeaveCriticalSection GetStringTypeW GetStringTypeA LCMapStringW MultiByteToWideChar LCMapStringA GetCurrentProcessId GetTickCount QueryPerformanceCounter VirtualFree HeapDestroy HeapCreate GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetModuleFileNameA GetLocaleInfoA DeleteCriticalSection GetStartupInfoA GetFileType GetStdHandle SetHandleCount ExitProcess Sleep HeapFree GetSystemTimeAsFileTime GetCurrentThreadId GetCommandLineA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError

user32

FindWindowExA CreateDialogParamA IsWindow IsDialogMessageA GetMessageA TranslateMessage DispatchMessageA LoadIconA SetDlgItemTextA SendDlgItemMessageA MessageBoxA RegisterWindowMessageA SetWindowLongA wsprintfA SetWindowTextA GetWindowTextA RedrawWindow GetDlgItem GetFocus IsWindowVisible ShowWindow GetClientRect GetWindowRect CreateWindowExA GetWindowLongA SendMessageA EnableWindow DestroyWindow PostMessageA CallWindowProcA ScreenToClient SetTimer

$PLUGINSDIR/Install.html

SHA256 84bba2ca5aeef4fb742f1a30f8006c712a5a2d46e5d163c9da8eeed61d1004dd
MD5 746152806d63b105414333920dff74a7
SHA1 db442fba9da8136a6278aa6b1045a7ff0e4ac580
SHA512 e19f02c805966a29a9f9aa58065894ce333a20994e73315d9d559fc0cb714d71cf66ebb70fcca6675d38d10597067570a95d9a306f4d28c78cd0a3273fff9fb2
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/Processes.dll

IMPHASH f5edecae12589e705677a6e272ad0394
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Progress.dll

IMPHASH a69514795c7cde48357cbe091be0aadc
SHA256 61d8f9eba68cc6e2a83ec6d1689b2aa45e06bc32e13cdfcec8b593a14bc8bf70
MD5 15e01578481287bbcf32d2217f1b5246
SHA1 67a7d05bb2f8b33980867d3352280fa0cd0b4e9f
SHA512 9a83832faf20eaef5043f69d468bfe032d790274df25bae73bce4f7830ac83587d7e23dba531bff04951cbed67399386d9ea4337002a99d8cf61de3f8e33b674
SSDEEP 768:WCFSITRx/imU5IBAczjPj+NbHHFJUzWwrhABjknWgiLLhfv09jaYhdb5P8mDnbK:+8xzUKBZo0zWWhskjiLwR/5P3b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

10443

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

Sleep GlobalFree CloseHandle RaiseException RtlUnwind ExitThread GetCurrentThreadId GetLastError CreateThread GetCommandLineA HeapAlloc HeapFree TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleA GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement ExitProcess HeapSize SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc WriteFile SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CreateFileA FlushFileBuffers

user32

SendMessageA SetWindowTextA

$PLUGINSDIR/Register.html

SHA256 ae58fdd1ee8f76df9096451a6478f859b0d79a0c5a90abe612c6dbab2d249c98
MD5 9e98a5ed249763fc62459d9137d712ee
SHA1 0fefb6aa793b98b5e8eab3339dfaea70036e64ed
SHA512 0875240c0ca0ae108f31f2b9e12ee79d7940596e2660a6022a1a02543388b31bf929bd9f6ec8b15a2ac9f1298bda1353f1dd50a54edc50a567b3082387b26a8e
SSDEEP 192:zDEyoZbgnNAa6x9Q2vOXQyuv48238xglTWlNr33G+y2SeSpUHCh:6g++2mG48238xkT4rm+ygHE
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/background.jpg

SHA256 5b1d0a2d3cd8c2f2d31ae21a22271e400294f90d59c505abb1674b9224c348cd
MD5 80f0455b47cca82e844ad95c49ee6627
SHA1 caf558ebc381867497c9e8b11558df6ef539b164
SHA512 262f4e1f80dedbafb064ca2a8e07360d1d6750700655fde563d12e8307b109b936eb7aa65167b635d85664fc9901925746dbc2767159895975f22683ab2ba2b2
SSDEEP 3072:FnlKkUBxQXZQcQM3uG7qUmh3zm5ufTZaKW6UX:FlKk7XZQcRyxDXbAKJUX
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/bg-container.gif

SHA256 30453d83b91257058dee756974c6998a9128a816b4ed4bd1f770ecc12f033a07
MD5 e85c3a6d7c172a5fb09c4add97d29a8e
SHA1 582f5a094ccebcd216326c793a02038b76801c24
SHA512 bb4d78c07c415af2d106c8dac730207523b9c7d5d97063fa76a648636d9a89909859cd2598706ceb3de26cdc1fd8cfb161952180aaa441bc66d256738fd77cdd
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bg-grey-wrapper.gif

SHA256 f0d1c5f3183c92f3cb3e75197ecbd67efaf5cc7b1fc688f1972685c6a8eeaa5e
MD5 a71b61cef264c24c3ac16149bf295d82
SHA1 94b72b744eed33e42471a2a07cb977f11067bf7e
SHA512 024d8180285d512bfc1e22244be03286e36608f0c6b740f0bc2466a64da361c5d505770f5be70bc99d6e83e3f0d5fc7acfbf717c08c818d7c688c29fa291db1d
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/bg.jpg

SHA256 31a994cdae76d7f59818d9c83c279d66e9417a0a1a657f781b6426a77ae252ca
MD5 559f10d4c1b23316c525542346b36643
SHA1 b3a15032d460a362c937c8dfcdaa18fd0cfc66d6
SHA512 435b467584980dcd854443ceabb0d13bd55e04d76745544432d8e2bb37b350929b0753e47c0b8a5bcaf7ce015afba8ddc04f7aa4b905baf507db852cb10c21f5
SSDEEP 384:aqQgfye/T+0eOLnJ8GzO0Thn/CRg9o+g2ApEsZJJGeuKSKYNg7YYTrFp2MIsJZKi:aNgJygJ8GzOFSKYyNTRp2nsJZKi
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/blowfish.dll

IMPHASH 8ef047e6217a2c4c5df9deca3b97460c
SHA256 d54c8582863c079996c4f1113b1c106204773ad9ea2ae831ba2b33b45bafdfa8
MD5 926e4475c00fb5254c32c876921b77d0
SHA1 8a55bc8b6e49021a4abbd441783c41d5e019798b
SHA512 53f389e1a967c123ed591c7650cf6d3140abf1012dcac90faf2327e68558949eb2b19905098bd14ab3a9811d23f98466f88418d992ca6373f94afae56a285bd8
SSDEEP 768:iqdVHQr1iIxqXiURXB+tzjjrrzhzlRryN+SaYhba3mrf+C7jWk1MLfoMR38:iawr1iIIXYplRrOk4f7HML1R3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

24576

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Program Files\NSIS\Plugins\blowfish.pdb

$PLUGINSDIR/button-active.gif

SHA256 f60d341ca84248ba2e6e91c88190249a4f198558b5feab4d4fdaa2a693b358bc
MD5 88fca2603bcb5c39b9592625b1a14212
SHA1 2691188ffb42fc83e9d8faf9fa50d0b77429c3ca
SHA512 041fb89f2762db3e4383dbc749f0299cb36279572409c84df7814af3467cd58639bc438b2dcb93c9902e4a6a116c4c39169f0653ee2cc0da8adeecfa80ea1723
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/button-inactive.gif

SHA256 92a42a96e3f20a54a3f21ff94973c50330b94681df0519bb07c65e8b04f9510c
MD5 84a29d451ea13a9d22fc2bb3bbb87fbd
SHA1 c14773baba7b5eb0edd12336f401183b6a09a335
SHA512 6072c6e77c13f4092fddc4df841b6dbe66227e0b7c53e75c8c45238338f335ac6783b89e7a186e7b18451873a28286bc5d774f7b132802ef194ea9ad2171b643
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/button.gif

SHA256 9bfa60dc79d7fe820f65e928a1047a04ca65934fa09025e474cc142665e2ad00
MD5 6f5e5fdd7270519a55c71fe2e0971a7c
SHA1 1890cbe5d64d155370d77adc81bfe964772089b0
SHA512 0dbf4ae2a02509760ba6be736f81af4c9119bee452428c03d5ca6bb5329c343a45d74b4df8bb0944acf69bbaf4fac71c02d083c480aba962909bf9d8162dde16
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/button2.gif

SHA256 c75898eccd0ecae4246cb4d3e9417bafabdd2ad91f75bee970b7b4dbacbc566c
MD5 119fd647b952ccb3781d0116fee4b493
SHA1 afa2bed69fe5b41bfca1ba461fece2a1f7661068
SHA512 44c91df769668c951b3c35e54bd2a172dd235e62054b0730d0e38461ac28fe7afe5b7158669f070835b700f8b4ba786fc66c5874d90c8cb9e05fd5fb6e057138
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/chameleon.xpi

SHA256 ec9db81f81cfd1f56d3882e5ecfec497f00a19bb0c8aa21620977220ba4ace18
MD5 9db4a61d35c440f767cf06f8c0d4c0a1
SHA1 cdb393dd4ea092f60ab0c49ac3406f25c207fdb0
SHA512 0bb987117805608a8d45d649cb40c1a17428a500959597d0948de9477207325c2852d4bec093bfeb2d1e314e661c72f92cc7635dd2c4e778e993cb257aa965a5
SSDEEP 768:2PNqF0yPNLPNY4q7M8QtVnFHeQFI/cUd2vbNt6siz7df5PDCjs1i:AI0c1qM/DHeZcS2vuVhPDCjsM
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome.manifest

SHA256 027cc8bcc3291fd6447e344a1a78628ff74792c21f01f106f40edd14408fcdc0
MD5 664660493a2247c75af5bbbe43e8393b
SHA1 f73ca54bb066fb8532880eac6ac93c8e4daa7af3
SHA512 2e0b43774e10cf4ab30e6c9ae4640c8f46305c2180cd1c0bd4196f7bc154bb519ce63c035ab11916f2a747024ce042abe62b6937e211b53a648263bef311615e
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/Logo.png

SHA256 1c5ac4c45d0411a50276b2a9bcf73fc11b6e1c3218fdeb3fd9558ee9db634841
MD5 f726204e5387138176ea79046028b3eb
SHA1 d1319903dc64f0075dd668be4532da09c29468c4
SHA512 cc8c3c73cec4bf08264f764bbd016165ab5ca31b049a353ee520fdcfe75e7682a895e2f358b3356c941f18d2753c8630b7bf49bd38f9b8380e54276d643b019d
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/about.gif

SHA256 918c54162a050c21015cd72bd2c8e2f6fa67295b7434602a06af623868e16eee
MD5 7b2afe5672e3fb535af94532a44b4cc9
SHA1 b6bd7da79661009193efaf5aa59469712ca622e8
SHA512 9dd0a1638f1d58c4dce5bccbb48c2409431abb5f442c54edf6e3dcc0f2e5058c94ce312339ebef47d27807d5171ff29701c65d570d9757a88b5e59eb61a5f16f
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/baloon.gif

SHA256 eb66ad349d02f484f8fe7467e9b2c4de7e2a8d099bcbec98bcea4bc4214f624e
MD5 3c9f8046c027e92d436d11286883053f
SHA1 adc9c94bf71571b961ba2162c81f251267fbf6ca
SHA512 a7d6349519223b5751a5d6347305b90c9fe903e9cc9df8bb3c7ebe10ab6ec43408dc3abf96d0198e2d829d3450f10bfe8701be2f20bf2ce6a05c10fe95b3a54c
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/hoticon.ico

SHA256 39ddf5a649eff490eb36e4b57d683fce54bcd5cdf4fdd3e9528693e318d46728
MD5 26ed3ffe3cef3a2a5d8da5205c6f8100
SHA1 a44235f765c2544f812a275c810969078f930702
SHA512 50369f312d4719bd0658df840e71b08a3dce30cd10c445b12b88a02c6c3318fff184f4c46f24f2acea474f5ecc68cdfc651ce696c04f572a7a58ece79bb1f362
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/logo_big.gif

SHA256 918c54162a050c21015cd72bd2c8e2f6fa67295b7434602a06af623868e16eee
MD5 7b2afe5672e3fb535af94532a44b4cc9
SHA1 b6bd7da79661009193efaf5aa59469712ca622e8
SHA512 9dd0a1638f1d58c4dce5bccbb48c2409431abb5f442c54edf6e3dcc0f2e5058c94ce312339ebef47d27807d5171ff29701c65d570d9757a88b5e59eb61a5f16f
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/logo_small.gif

SHA256 918c54162a050c21015cd72bd2c8e2f6fa67295b7434602a06af623868e16eee
MD5 7b2afe5672e3fb535af94532a44b4cc9
SHA1 b6bd7da79661009193efaf5aa59469712ca622e8
SHA512 9dd0a1638f1d58c4dce5bccbb48c2409431abb5f442c54edf6e3dcc0f2e5058c94ce312339ebef47d27807d5171ff29701c65d570d9757a88b5e59eb61a5f16f
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/menu_en.htm

SHA256 48981ae9dd1ca88d166a60d22de964930f261c27db1070f563d684cd9ea2f2ae
MD5 65e2d54159a402d5dca7fe5473b707bf
SHA1 00f5cf44200de155c15f2a66cfcb4f0652c8851e
SHA512 12db9fe3c03d595ef84b9cb2de2da5b39be0979f50055bfb0666fdb8c33479de79d66402b9221dd9409fefdc97ebf0f57ae87474275319d38aa16106ce72c25e
SSDEEP 192:4qGVd+MXRWKvrKJp/5nqpoqFy+XeBPDyt2Jo/OrlX6F3idUI2cTCs:4ZVd+SRBSuU62Jo/OrlX6F3yUI3TCs
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome/content/menu_ru.htm

SHA256 974bd152bbbf1c6ca753de17998a136dae24361979de63663c657c9e13d2aaf2
MD5 22353ccbfa14ea6efa561c2ef2917f6d
SHA1 68ce44ecd695b0ec7db618f70defab80cda70493
SHA512 9cd7b20254a88446cfeadf3956090eeac7e56d3bfaacdb32e22f0e4f61444819ea2aaf04d9c7280c2417d560337d96ec1cbe7f4fc6e9b7da79806c5ea5cd20f0
SSDEEP 192:4q+Vd+MXRWKvrKJp/5nqpoqFy+XeBPDyt2J2vu1XiFnXtBWIgOT+s:4RVd+SRBSuU62J2vu1XiFnKI9T+s
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome/content/normalicon.ico

SHA256 39ddf5a649eff490eb36e4b57d683fce54bcd5cdf4fdd3e9528693e318d46728
MD5 26ed3ffe3cef3a2a5d8da5205c6f8100
SHA1 a44235f765c2544f812a275c810969078f930702
SHA512 50369f312d4719bd0658df840e71b08a3dce30cd10c445b12b88a02c6c3318fff184f4c46f24f2acea474f5ecc68cdfc651ce696c04f572a7a58ece79bb1f362
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/style.css

SHA256 2c6ba1caf73789fc997e0cc8996b036f33fe3e128f7bab68a1b4f31285e538c8
MD5 c3322526427b5f79e9ef67745b549dbc
SHA1 332ce7846c78d4cea2301db5caedbc417b44f78a
SHA512 544df177068123439ee1f945316300b130b0675c9ad50b78671a7ca880799920757318609fc17e6f21ca997862a0f83b200f59cef12f2f4d49b1b3ce937eca71
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/style.xul

SHA256 d5045992681dc3ff622e36ece6a864b6d89e8755e9b62bb9e721c27e258e209a
MD5 408273fe7ef8843c0a8543c15172a612
SHA1 19562f5a70b8b75d1917eab57edd3e86694e2540
SHA512 aa0409f4465f24376228ce56446574bf2e9582a44e7a08f307893ebce18c1d2d283a0dfcdac6517722369ebbc26ecc15d3959a19c9a832d0c7bded11d3ec2e55
MD5 SHA1 SHA512

NSIS installer

installer

chrome/content/witapi.js

SHA256 57f89b2ad7698c8a771406c0826e97627117cbc3984e38428d28acb75a4f32f6
MD5 e767978404b489f19768de20fc7eea05
SHA1 54093accfd9a8003e6c0cbc2197bb030483012f1
SHA512 28762c5c0a589c9656142057144835d8bd0abb923d80f149cf91c0157596dafc0b972fab8d042526f5aed8046399c52c13072cc3dc79f5e33de2dea1bb91edfb
SSDEEP 1536:uTAYl0sRIqn/i9VQL9wJQxNkFSmmKH0lX:usYl0OKzw3
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

chrome/content/witmain.js

SHA256 634e6ce2ddf69dcb3444b8c30607d2f04181390d7795be130c054cd11ae957b4
MD5 e001f084e56a819729f8b964db321c7e
SHA1 9b7c604f3f2fb2f5eea23eea0c35b4699e9ef6f5
SHA512 e62ad783272b67c92430dd6997fa24b74b83d43274f8ff9d8c6eb1556a08d1a766aa9ea949450030770ed2f246e6fcbe88b8abdcfca044507b9c223b1d6b8445
SSDEEP 768:Yn184eKEWFvNUHcaoHwX3sgfnZUoxeDMVZQLye:M184eKZFFUHcao6sXDMVZre
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

install.rdf

SHA256 1fdf569ec7a704bb57e912dc3ac37b5423a2f5cde65b9de5c8c0d23bca5c3b4e
MD5 73365d9239cdda254404282d106a61ca
SHA1 1dc105fa33aee8af37fdc8965955253d9bb6a365
SHA512 860b884c2e1d38c7fe0c31b047990c4ed427a996d8cf05c8fb3b01a5170a467ba60cbb58ed556682df52b57f02004b7af31621e53e2b3f078b0a004f35fa18e5
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/check.gif

SHA256 730196c4104deb2d2dbf4c9200b8d3239ce2363674c58ff35658d7641022f7fa
MD5 8bace84e05615e4a9ee95c179385b1d9
SHA1 9d9a7b87f4d3846b02a812946d35decdd57d6028
SHA512 49aa1aa5c66cb70606964b4d95711f1c15a5cd9d90eace9360b9ec700215141e212163e801eaefe3490af1f6b41f3d2e9b0cd892de11410eda7c4231ebfb3f88
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/nsisunz.dll

IMPHASH 0f92772da9c737d2bac38919e9863980
SHA256 6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d
MD5 5f13dbc378792f23e598079fc1e4422b
SHA1 5813c05802f15930aa860b8363af2b58426c8adf
SHA512 9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5
SSDEEP 384:KExN66Yf2xL5Q4IsjuUjUZfqRDpImexpf88FwHxXvjX3hwlHt6oIfESxSHoOO8n9:O2x64GcVpI3xC8ynToIf1SIOhW4
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

17930

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nswebgui.dll

IMPHASH 8bf8bda2787bf4acaa6b0939cff192da
SHA256 204199949dabc9708cd1e8f0fa40f37d7889f04b0b1b072599a8481bd97bede0
MD5 dcf180c820c7eca0409eca7c32e12cb2
SHA1 655984847eb8c4a244742ce99316bae8a0cc7515
SHA512 9efbe1af3488278f9888708503d4cb2b505d57e63626c4261583d870ae7a04d1002ac24599fc7cfeb3bf7a718177d5645e8227ea48f63e98e540340b3ab7f420
SSDEEP 1536:1uU2lRxPLYWgK3hvC0JBzXuy/Mq6/5Cl3qmgwgzoNSChxk3DxWry2X3g6Ab5yue6:F2dzY9SJHJBz/Ea3vNSCX3HgTb5Z
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

5

Entry point

78259

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress DisableThreadLibraryCalls LoadLibraryA GetModuleFileNameA GetModuleHandleA LoadLibraryExA DeleteCriticalSection OutputDebugStringA GetVersion lstrcmpA lstrcpynA HeapAlloc GetCurrentProcess HeapFree GlobalLock GetProcessHeap GlobalAlloc LeaveCriticalSection MulDiv GlobalUnlock FlushInstructionCache EnterCriticalSection GlobalFree GetCurrentThreadId lstrcpyW lstrcpyA FlushFileBuffers CloseHandle CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle ReadFile GetConsoleMode GetConsoleCP SetFilePointer lstrcmpiA GetLocaleInfoA GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA InitializeCriticalSectionAndSpinCount RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapSize TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo GetStdHandle WriteFile ExitProcess Sleep HeapReAlloc HeapDestroy HeapCreate GetCommandLineA IsDebuggerPresent SetUnhandledExceptionFilter SetLastError GetLastError RaiseException lstrlenW MultiByteToWideChar GetModuleFileNameW FindResourceA IsDBCSLeadByte GetFileAttributesW SizeofResource LoadLibraryW WideCharToMultiByte InitializeCriticalSection GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadResource FreeLibrary lstrlenA UnhandledExceptionFilter TerminateProcess VirtualQuery GetSystemInfo VirtualProtect VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedCompareExchange

user32

LoadCursorA GetWindow MoveWindow CallWindowProcA EnableWindow MapWindowPoints SetWindowTextA IsWindowVisible ReleaseCapture UnhookWindowsHookEx CharNextA InvalidateRgn EndPaint ClientToScreen DestroyWindow GetMessageA GetClassNameA DestroyAcceleratorTable ScreenToClient GetWindowRect RegisterClassExA PostQuitMessage FillRect IsChild GetClassInfoExA SetCapture GetFocus GetParent UnregisterClassA CallNextHookEx wsprintfA GetClientRect SetFocus GetWindowTextLengthA SendMessageA RegisterWindowMessageA BeginPaint GetDC IsDialogMessageA TranslateMessage CreateDialogIndirectParamA GetWindowTextA SetRect SetWindowLongA InvalidateRect CreateAcceleratorTableA GetWindowLongA CreateWindowExA ReleaseDC GetDlgItem EndDialog DefWindowProcA SetWindowsHookExA RedrawWindow GetDesktopWindow GetSysColor SetWindowPos ShowWindow IsWindow PostMessageA DispatchMessageA

gdi32

BitBlt DeleteDC GetDeviceCaps SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectA GetStockObject CreateSolidBrush DeleteObject

advapi32

RegCloseKey RegDeleteValueA RegQueryInfoKeyA RegOpenKeyExA RegCreateKeyExA RegEnumKeyExA RegDeleteKeyA RegSetValueExA

shell32

ShellExecuteW

ole32

CoCreateInstance CoTaskMemRealloc OleInitialize OleUninitialize CoTaskMemFree CoTaskMemAlloc OleLockRunning CoGetClassObject StringFromGUID2 CreateStreamOnHGlobal CLSIDFromString CLSIDFromProgID

oleaut32

VarBstrCat VariantInit LoadRegTypeLi OleCreateFontIndirect SysAllocStringLen VarUI4FromStr SysFreeString SysAllocString DispCallFunc SysStringLen VariantClear LoadTypeLi VarBstrCmp

$PLUGINSDIR/product-icon.jpg

SHA256 cf55e1d1472eef28953976f720f5fe9cd1665a814e07aefe3785ee958cc7204a
MD5 2a27424c4016983babe0d26870843196
SHA1 90b7f75dc4544d71f784a52a67080835756e97de
SHA512 0b3459ade6601b3850e2ada2435129409fc621ab47f0280eacbfbd39cbc33cd406947ed81b92a621b17fface23b67a64ab86e75844c46cf837f9ddbe5827ac37
SSDEEP 768:kJa3osa3UykJihQO/SKYyTHpTtCfxgQL+1p3YRUgPAel5B:f3W30AhQO/SKPHC78o1/B
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/product-image.jpg

SHA256 a2eaa5c68f6b8e036695be451e9bb961956a81e66b7bd0d1643715bd23de2a68
MD5 c61581e69bfff4d6fc9c0b2a02d9351b
SHA1 521ea31e6d74b1bb8bb13ca72f0c7305d754b2b6
SHA512 24e5126b920279ef5d4a7f94b6636dd5e312bc3fc9dda06597c6384a236cb99b79325e894f6d46f55fd9f460b2f6195a37727783ead24261599d41d58e489444
SSDEEP 768:CUqJbLsv6e6QQaO3N3nxWbR0Aj7+80WcUK+Q/ANz5q0708FSh:CUqJ0v6e6QZe3nGNH+whM/A3USSh
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/product.jpg

SHA256 8ea772af2423457124d85d22b0b3398546caf1e8b19913cf78cebebc5db2ea75
MD5 43c5e43e2359bd811f15d868b480e27c
SHA1 c82ccbabb55fa323550e5c3a7dd5f5dc0a0f4b73
SHA512 64a5bafd966b46f911ac8b150b9e7b46e1a8a5d189c11aba24cee6b48e34da378759afe5cce5603098cd273c72d0927ab8e4b57bda6758c888482890ddbe8f73
SSDEEP 768:laYhU4CBe0flYhU4CBe0fJPfWh35ZrOZjNcFWwaI:Vu3BeKau3BeKJXe3XCPcQ9I
MD5 SHA1 SHA512 SSDEEP

NSIS installer

installer

$PLUGINSDIR/sponsor.gif

SHA256 1f25a1c853d414212fed2bc115e9b34900479636512836cf0af5edad13b25658
MD5 f55bb0d6f36fceb6b7bb19853a957353
SHA1 37430f837a87ddd54bedebfa8daba69c79f64732
SHA512 6de8994e85bf772bd4c17c73e4ac041000cc8ce406d4a8f6bf36eb80a9539f114e3d4a7e8f969fc5ec3cfb4eb28cf1c19ae51d90a8fbfe20be9e14f06a90afbe
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/style.css

SHA256 ec1489e71ad73a713c3c52b296a6e36a39d0ea3b680682c3115b0ad804da7e24
MD5 4403ec3b956cede857dfe895bb86ff74
SHA1 202ef9f3daff5a5d213e431e3d10622155c7bd42
SHA512 75822005d6ee8bfe05a9705cbecc6468bf8d074320b74effa680c3dffb5f151eb27293a9d248272fce1b02b126a1d9fc987428ed525e11d4931b4466007f4c6d
MD5 SHA1 SHA512

NSIS installer

installer

$PROGRAMFILES/ChameleonTom/$SMPROGRAMS/Chameleon Tom/Chameleon Tom Web Site.url

SHA256 e8f8afd9ca5b82695558d12d082dbf9a2fcf5197d1d4a8270bdd97ceedaf4e59
MD5 5df997d51273970e3a602d41eb4ebfc0
SHA1 00da2735e3a105a8c0cd67eb2ecd9fafdb65eefd
SHA512 f78d1bf1fe5adbfb1352c49ab2f36e4d33c1fd92f7749bfe882768893aa0610acc1cbde0b10528eff761fb762cf1300bfd165baffd02d64fe724e02b4b4866e9
MD5 SHA1 SHA512

NSIS installer

installer

$R3/$PROGRAMFILES/ChameleonTom/UninstallChamTom.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 add07dddb8aea6cfb9e7e401bc5450ec7c4fe6b8a2a96e3c554fd312ece266d4
MD5 953219712118401d01cf7986c39d7082
SHA1 4b17e4ed600119f609212a223b60ab69bce5b4cb
SHA512 5306d67f6bcc4cec2d14166d74a0a61faa178c78a24c6c42089aba01dea441c8f90d24ced700d00e5b8a8a850bc4e0cab18eb2ec5c2d1e66e86b46a827116845
SSDEEP 1536:EQpQ5EP0ijnRTXJIgdLeAyNNhn6wJ77b1eD27l/VfNk7tCGd:EQIURTXJIceAin6s77bQD25/Vyhd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Processes.dll

IMPHASH f5edecae12589e705677a6e272ad0394
SHA256 86b302fa9c85dfa0c1c03ba000864a928365dab571f3355347dba02da22949b7
MD5 2cfba79d485cf441c646dd40d82490fc
SHA1 83e51ac1115a50986ed456bd18729653018b9619
SHA512 cca186a7f9c5cff3f4eca410fbe8cc13dad2514a7e36aec9b1addfbcb239ace9b9b2d8427771858e3fd11783abce7e24d43c286f98da9f8b17562ca095a4c043
SSDEEP 768:uxEiycFoaj/+WSiJfmjvab7L/cUf7IIlMLRF:uxEm7sgfmjy//cgdlM/
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
MD5 00a0194c20ee912257df53bfe258ee4a
SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer