66f5fe2ff41e6be5a0174e3e13fece7e_JaffaCakes118

resource	yara_rule
static1/unpack002/$APPDATA/Unitech LLC/sqlite3.dll	acprotect
static1/unpack006/$PLUGINSDIR/md5dll.dll	acprotect
static1/unpack001/$PLUGINSDIR/nsJSON.dll	acprotect

resource	yara_rule
static1/unpack002/$APPDATA/Unitech LLC/sqlite3.dll	upx
static1/unpack006/$PLUGINSDIR/md5dll.dll	upx
static1/unpack001/$PLUGINSDIR/nsJSON.dll	upx

resource
66f5fe2ff41e6be5a0174e3e13fece7e_JaffaCakes118
unpack001/$PLUGINSDIR/IS.dll
unpack001/$PLUGINSDIR/KillProcDLL.dll
unpack001/$PLUGINSDIR/NET.dll
unpack001/$PLUGINSDIR/System.dll
unpack002/$APPDATA/Unitech LLC/sqlite3.dll
unpack003/out.upx
unpack002/$PLUGINSDIR/IEFunctions.dll
unpack002/$PLUGINSDIR/InetLoad.dll
unpack002/$PLUGINSDIR/Processes.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/Time.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/$PLUGINSDIR/chrmPref.dll
unpack002/$PLUGINSDIR/mt.dll
unpack002/$PLUGINSDIR/nsisos.dll
unpack004/$PLUGINSDIR/Processes.dll
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/Time.dll
unpack004/$PLUGINSDIR/mt.dll
unpack004/$PLUGINSDIR/nsisos.dll
unpack004/$_0_/extensions/[email protected]/components/FFDisp.dll
unpack004/$_0_/extensions/[email protected]/components/ffdisp.dll
unpack005/components/FFDisp.dll
unpack006/$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/CTB.dll
unpack006/$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/CrmAdpt.dll
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/Time.dll
unpack006/$PLUGINSDIR/UserInfo.dll
unpack006/$PLUGINSDIR/md5dll.dll
unpack007/out.upx
unpack006/$PLUGINSDIR/mt.dll
unpack006/$PLUGINSDIR/nsisos.dll
unpack008/CTB.dll
unpack008/CrmAdpt.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsJSON.dll
unpack009/out.upx
unpack001/$R9/Plugins/npffividiplg.dll
unpack001/IEhelperActiveX.dll

resource	yara_rule
static1/unpack001/$PLUGINSDIR/ividi_1.8.23.0.exe	nsis_installer_1
static1/unpack001/$PLUGINSDIR/ividi_1.8.23.0.exe	nsis_installer_2
static1/unpack002/ividi4ffx.exe	nsis_installer_1
static1/unpack002/ividi4ffx.exe	nsis_installer_2
static1/unpack002/ividi4ie.exe	nsis_installer_1
static1/unpack002/ividi4ie.exe	nsis_installer_2

IMPHASH be41bf7b8cc010b614bd36bbca606973
SHA256 8c436076143b5d5a49ed25419f05c071654b0f0aa1a9f8c1b2db723964e45bf8
MD5 66f5fe2ff41e6be5a0174e3e13fece7e
SHA1 93598b0221984cc1a203d8ac6c8b335da827f837
SHA512 b06ad2c34074248a4307a12e6fd813891fc689f1403913bed26a04360eaf5839fd795185da5d588844cd1f1f6389a0db6aefe4ef5bf2188b2ad2f2d3fc7a581e
SSDEEP 98304:11k8VO82XHJjC+56Natnm6k7g4QTgDvasops1bc:72XHJj7FtP4/DvRNc
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14511

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode lstrcpynA CloseHandle lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW GetVersion lstrcpyA RemoveDirectoryW lstrcmpA lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrlenW

user32

GetAsyncKeyState IsDlgButtonChecked ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW wvsprintfW DispatchMessageW PeekMessageW wsprintfA DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ndata

Size

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/IS.dll

IMPHASH 43087810d965c117d20dd5225a45da5d
SHA256 2e5af5577044835e7d1c526b1ef11dddbf660dbf265f3c8b533cbfcfd2a8b57a
MD5 c31b97adf54bdd6ac6d19ab85cc6bc57
SHA1 7e458577b1fe49885c21f38ba981f77b00bdd59b
SHA512 9178ba7bfd3851b9622ffa7f5981f43b4ca654e3f85113f7c91ebd2ce417c1acb718e73737838c61496a255cee1f5ad9873ea88bce78a0cfe67bd2cfb1e71790
SSDEEP 1536:040tQWYXj9hStyVl4d5VypW4s+qxcfAsWjcdcmeiFrNt:6SV5Ll4dLBZ+q8cmZFrNt
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

13459

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\TopMedia\SVN\iVIDIInstaller\with_nation_toolbar\DLLs\InstallerService.pdb

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

advapi32

RegCloseKey RegSetValueExA RegCreateKeyExA

kernel32

SetEndOfFile WriteConsoleW GetFileType GetLastError HeapFree WideCharToMultiByte HeapAlloc ReadFile EncodePointer DecodePointer GetCommandLineA GetCurrentThreadId RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent GetProcessHeap InterlockedIncrement InterlockedDecrement IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetStdHandle WriteFile GetModuleFileNameW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount SetFilePointer SetFilePointerEx GetConsoleMode ReadConsoleW DeleteCriticalSection GetStartupInfoW CloseHandle HeapSize Sleep GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetStringTypeW LoadLibraryExW OutputDebugStringW LoadLibraryW CreateFileW SetStdHandle FlushFileBuffers GetConsoleCP HeapReAlloc LCMapStringW

$PLUGINSDIR/KillProcDLL.dll

IMPHASH 03f929832e821ea56617f74371196241
SHA256 fb3004f3e89257c0e13b9fe4b641e5ffccac45aca0a09d0d96146cbbadb55b62
MD5 e0cba97d6c9203b638fe94402106091b
SHA1 ba331d35ea9a19e0f5d228c8a0b6152cdb4c5c6b
SHA512 7c12ab9704b6a9887dc12f09c03505721f2ee26fed621ca8ddee27e366795d36f61a0b5b6204374d9a4e6faea3c7dc82a29abc1b9b8723c9549af4ab2d8cfd7e
SSDEEP 768:XzuIRePkNuMZmhBZYPdhZQqn2WEDFZjulJAsDo:qIVNUBW5wJkd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

7525

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NET.dll

IMPHASH 13747ecad4b929762d73c9d1ad62f57f
SHA256 b31d4e8af5d38991c692f219130fdfa92762a9a77e04e7ab05e44603af578555
MD5 9adaffc2a1b579115e40407733d94dde
SHA1 866bbb0dbbd217aa287fe3324ecaa828e8d7b622
SHA512 214eedc4b314b48c192d3a847a64807bf41481e5cd06b1a627bad048dbac14a2c0d6b5b3c992616e18ec9f59f4107d68e57b8c4fd9da01e0695824ffc8030619
SSDEEP 1536:YGm1qiWG5m2ftSFh/strsmDk+g6cLFsWjcd9VRqtOEVK:YG1ipptSqy+gzq96tOEV
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Work\TopMedia\SVN\iVIDIInstaller\with_nation_toolbar\DLLs\NETWrapper.pdb

kernel32

LocalAlloc ReadFile LocalFree CloseHandle GetFileSize CreateFileA GetLastError FlushFileBuffers WriteConsoleW SetStdHandle LCMapStringW LoadLibraryW OutputDebugStringW WideCharToMultiByte GetCommandLineA GetCurrentThreadId EncodePointer DecodePointer RaiseException RtlUnwind IsDebuggerPresent IsProcessorFeaturePresent HeapFree InterlockedIncrement InterlockedDecrement IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError HeapAlloc ExitProcess GetModuleHandleExW GetProcAddress MultiByteToWideChar GetProcessHeap GetStdHandle GetFileType InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetStartupInfoW GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW Sleep WriteFile GetModuleFileNameW HeapSize EnterCriticalSection LeaveCriticalSection GetStringTypeW GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW HeapReAlloc CreateFileW

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey

wininet

HttpQueryInfoA InternetReadFile HttpEndRequestA InternetWriteFile HttpSendRequestExA HttpSendRequestA HttpAddRequestHeadersA HttpOpenRequestA InternetCloseHandle InternetAttemptConnect InternetConnectA InternetOpenA

$PLUGINSDIR/OCSetupHlp.dll

IMPHASH 93bd1585ffbc730c763e71e0c6c896b3
SHA256 4d1ad8aaf803660ee9d989a8a9cb3129397a97e4d0fa4b50ba7fb700b9d4d7b6
MD5 9e4e850e12f2f4f869b2491dbbb17ceb
SHA1 bd89581a89604b601c817ea680c2a224b46737f8
SHA512 9285472e8ed2e685dce357383842356e3011110a09f2e66b2a34ee6bf3c7457dbba834256d8b9b240c20666ec38b62d0ebd7fe4dec1fd9cbb812adc36ad724f5
SSDEEP 12288:w3RHConJZh6lVfdxrHtgFl2nMLlKT2OIPL8mKqSTSTpz4cB8:wkuMV1xrHaF8nMI2RPL8STpz4cB8
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

62:df:9b:00:a0:2e:95:b2:8b:f9:8a:ae:08:ca:c4:3c:13:76:de:06

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Chains

Jun 24, 2013

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=OpenCandy Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=OpenCandy Inc.,L=San Diego,ST=California,C=US

Serial Number

6f:fc:26:3a:35:11:34:19:4c:f1:6e:1e:6d:0e:08:06

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 25, 2011 - Mar 14, 2014

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Serial Number

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Feb 8, 2010 - Feb 7, 2020

Minor OS version

0

Major OS version

5

Entry point

451236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetErrorMode GetFileAttributesW CreateFileW GetFileSize GetCurrentProcessId GetEnvironmentVariableW FindFirstFileW FindNextFileW FindClose ReadFile GetTimeZoneInformation GetSystemTimeAsFileTime GetTickCount GetTempPathW DeleteFileW WriteFile ProcessIdToSessionId HeapAlloc GetProcessHeap HeapFree CreateDirectoryW ExpandEnvironmentStringsW WaitForSingleObject OutputDebugStringW CreateMutexW OpenMutexW ReleaseMutex UnmapViewOfFile MapViewOfFileEx CreateFileMappingW OpenFileMappingW GetShortPathNameW SetFilePointer CreateEventW GlobalFree ResumeThread FreeResource SetEvent ResetEvent GetCurrentThread CreateProcessW MoveFileExW OpenEventW lstrlenA WideCharToMultiByte SetEnvironmentVariableW SetEnvironmentVariableA CompareStringW CompareStringA GetExitCodeProcess GetStringTypeW GetStringTypeA GetLocaleInfoA GetFullPathNameW SetEndOfFile SetStdHandle WriteConsoleW GetConsoleOutputCP WriteConsoleA DeleteCriticalSection GetCurrentDirectoryA CreateFileA lstrcmpiW GetProcAddress PeekNamedPipe GetFileInformationByHandle GetFullPathNameA FlushFileBuffers GetModuleHandleA QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA SetHandleCount LCMapStringA ExitProcess LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsAlloc TlsGetValue GetModuleFileNameA GetStdHandle HeapCreate RtlUnwind GetDriveTypeW GetFileType GetConsoleMode GetConsoleCP FindFirstFileA GetDriveTypeA FileTimeToLocalFileTime GetCommandLineA ExitThread IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA InterlockedCompareExchange FindResourceA GlobalMemoryStatusEx GetDiskFreeSpaceExW GetFileAttributesExW CompareFileTime GetVersion GetTempFileNameW ReleaseSemaphore InitializeCriticalSectionAndSpinCount CreateSemaphoreW GetSystemInfo GetVersionExW FileTimeToSystemTime GetSystemDefaultLCID FormatMessageA ExpandEnvironmentStringsA SleepEx GetThreadLocale GetLastError SetThreadLocale MultiByteToWideChar GetModuleFileNameW InitializeCriticalSection GetModuleHandleW InterlockedDecrement InterlockedIncrement LoadLibraryExW GlobalUnlock GlobalLock GlobalAlloc Process32NextW Process32FirstW CreateToolhelp32Snapshot CloseHandle OpenProcess GetUserDefaultUILanguage GetLocaleInfoW FreeLibrary LoadLibraryW MulDiv lstrlenW lstrcpynW SetLastError RaiseException Sleep CreateThread FindResourceExW FindResourceW LoadResource LockResource SizeofResource LeaveCriticalSection EnterCriticalSection GetCurrentThreadId FlushInstructionCache GetCurrentProcess

psapi

GetProcessImageFileNameW EnumProcesses

ws2_32

select WSACleanup WSAStartup closesocket WSAGetLastError socket recv send getsockname ntohs bind htons getsockopt getpeername setsockopt connect WSASetLastError __WSAFDIsSet gethostname freeaddrinfo ioctlsocket getaddrinfo

msimg32

AlphaBlend

shlwapi

PathMatchSpecW

user32

DestroyMenu SetActiveWindow DestroyCursor SetCursor FindWindowW PeekMessageW MsgWaitForMultipleObjects GetWindow TrackPopupMenu ReleaseCapture DrawFocusRect UnregisterClassA GetCursor NotifyWinEvent SetWindowLongW GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow LoadCursorW IsWindow GetDesktopWindow MonitorFromWindow GetUpdateRect SetRect CreateDialogParamW GetSystemMetrics CallNextHookEx UnhookWindowsHookEx SystemParametersInfoW SetWindowsHookExW DrawIconEx GetIconInfo SetMenuItemInfoW IsWindowVisible SetForegroundWindow SetDlgItemTextW SendDlgItemMessageW PostQuitMessage KillTimer SetTimer PostMessageW GetWindowTextLengthW GetWindowTextW EnumChildWindows EnumWindows RegisterClassExW GetClassInfoExW CreateWindowExW GetSysColor GetSysColorBrush GetDC SendMessageW SetFocus GetForegroundWindow TrackMouseEvent InvalidateRect GetClientRect BeginPaint EnableMenuItem GetSystemMenu EnableWindow LoadImageW MessageBoxW MapWindowPoints GetParent CharNextW SetClipboardData CloseClipboard EmptyClipboard OpenClipboard GetWindowThreadProcessId SetWindowPos SetWindowTextW LoadIconW DispatchMessageW TranslateMessage IsDialogMessageW GetMessageW GetDlgItem ShowWindow ReleaseDC DrawTextW FillRect GetAsyncKeyState CopyRect GetMonitorInfoW MonitorFromPoint MoveWindow GetWindowRect GetAncestor DrawFrameControl PtInRect ScreenToClient GetCursorPos EndPaint IntersectRect

gdi32

SetViewportOrgEx CreateCompatibleDC DeleteObject BitBlt SetBkMode SetTextColor GetDeviceCaps DeleteDC CreateFontIndirectW CreateSolidBrush GetStockObject GetTextExtentPoint32W GetObjectW CreatePatternBrush SetBkColor DPtoLP CreateCompatibleBitmap ExtTextOutW CreateDIBSection SelectObject GdiFlush

advapi32

RegCloseKey RegEnumKeyW RegOpenKeyExW RegQueryValueExW RegCreateKeyExW RegQueryInfoKeyW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegSetValueExW OpenProcessToken GetTokenInformation DuplicateTokenEx LookupAccountSidW CreateProcessAsUserW LookupPrivilegeValueW AdjustTokenPrivileges GetUserNameW

shell32

Shell_NotifyIconW SHGetFolderPathW ShellExecuteW

ole32

CoInitializeSecurity CreateStreamOnHGlobal CLSIDFromProgID CoInitialize CoUninitialize CoSetProxyBlanket CoTaskMemFree CoCreateInstance CoInitializeEx CoCreateGuid CoTaskMemAlloc StringFromGUID2 CoTaskMemRealloc

oleaut32

LoadTypeLi UnRegisterTypeLi VarUI4FromStr RegisterTypeLi SysFreeString SysStringLen VariantClear SysAllocStringLen VariantChangeType LoadRegTypeLi OleLoadPicture SysAllocString VariantInit

comctl32

InitCommonControlsEx

uxtheme

DrawThemeBackground OpenThemeData CloseThemeData

gdiplus

GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImage GdipAlloc GdipFree GdiplusShutdown GdiplusStartup GdipLoadImageFromFile GdipCloneImage GdipDrawImagePointRectI GdipDrawImageRectRect

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

urlmon

URLDownloadToFileW

wininet

InternetQueryOptionW InternetGetConnectedStateExW

DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer OCPID974OpenCandy1 OCPID974OpenCandy10 OCPID974OpenCandy11 OCPID974OpenCandy12 OCPID974OpenCandy13 OCPID974OpenCandy14 OCPID974OpenCandy15 OCPID974OpenCandy16 OCPID974OpenCandy17 OCPID974OpenCandy18 OCPID974OpenCandy19 OCPID974OpenCandy20 OCPID974OpenCandy21 OCPID974OpenCandy22 OCPID974OpenCandy23 OCPID974OpenCandy24 OCPID974OpenCandy29 OCPID974OpenCandy30 OCPID974OpenCandy31 OCPID974OpenCandy32 OCPID974OpenCandy33 OCPID974OpenCandy34 OCPID974OpenCandy35 OCPID974OpenCandy36 OCPID974OpenCandy37 OCPID974OpenCandy38 OCPID974OpenCandy39 OCPID974OpenCandy40 OCPID974OpenCandy41 OCPID974OpenCandy42 OCPID974OpenCandy44 OCPID974OpenCandy45 OCPID974OpenCandy46 OCPID974OpenCandy47 OCPID974OpenCandy48 OCPID974OpenCandy49 OCPID974OpenCandy5 OCPID974OpenCandy50 OCPID974OpenCandy51 OCPID974OpenCandy52 OCPID974OpenCandy53 OCPID974OpenCandy54 OCPID974OpenCandy55 OCPID974OpenCandy56 OCPID974OpenCandy57 OCPID974OpenCandy58 OCPID974OpenCandy59 OCPID974OpenCandy6 OCPID974OpenCandy60 OCPID974OpenCandy61 OCPID974OpenCandy62 OCPID974OpenCandy64 OCPID974OpenCandy65 OCPID974OpenCandy7 OCPID974OpenCandy8 OCPID974OpenCandy9 _GET_IS_REQUIRED_63 _OCPID974OpenCandy2@16 _OCPID974OpenCandy3@16 _OCPID974OpenCandy43@16 _OCPID974OpenCandy4@16

$PLUGINSDIR/System.dll

IMPHASH 039bcbc605477e8e87ec550c2e60e748
SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
MD5 bf712f32249029466fa86756f5546950
SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10024

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ividi_1.8.23.0.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 afc3a56884a203c8351098f217383d7397ede85580e1ce6dd54ad59f327bed69
MD5 8c271a4f3d22bab31657afef6d391392
SHA1 73ca356b709eea6404ad8a997d4175894706430f
SHA512 cd433aae16749a0581761fed60d1758f80351d9a08219a256aae95711060f91a2189fbfbf7e5dd35202d8c1da92049c03357c505159c7b724c4896dd7a1cc832
SSDEEP 49152:wLDJBvX6dkcGTsi5JmjUg/a4ttMPhvJNCUGZJYkPhgVr9WT:E/6dbiHmjUOa4tqxu1
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

8f:22:58:08:49:97:76:5f:f7:0c:18:08:b7:b6:92:57:9b:b3:fc:c1

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$APPDATA/Unitech LLC/sqlite3.dll

SHA256 970ab5826883e15bd9ae33310dcfb00968a938eebbe7e8e1ba5c8b0c12cc5d12
MD5 db4961bbb3c1cf487904b15ea5b5884b
SHA1 d1c23d22e93d3f9b268f99519d38d010ff99ea6c
SHA512 191e365500a824c1b31eca9f82caecdc227471d09c1343390a2879bd9642cad1a57fe812eb0ab3f20b24941da763a24a76f5a4b0791af5600d283eae7f6cae7d
SSDEEP 6144:XeuZevv40YGJbqYwOTfSED3HvE5+8jVAKZYOwr80B2:XEHGGJbXTaOX38jVX48
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

626016

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

DllCanUnloadNow DllGetClassObject DllRegisterServer DllUnregisterServer sqlite3_aggregate_context sqlite3_aggregate_count sqlite3_auto_extension sqlite3_bind_blob sqlite3_bind_double sqlite3_bind_int sqlite3_bind_int64 sqlite3_bind_null sqlite3_bind_parameter_count sqlite3_bind_parameter_index sqlite3_bind_parameter_name sqlite3_bind_text sqlite3_bind_text16 sqlite3_bind_value sqlite3_bind_zeroblob sqlite3_blob_bytes sqlite3_blob_close sqlite3_blob_open sqlite3_blob_read sqlite3_blob_write sqlite3_busy_handler sqlite3_busy_timeout sqlite3_changes sqlite3_clear_bindings sqlite3_close sqlite3_collation_needed sqlite3_collation_needed16 sqlite3_column_blob sqlite3_column_bytes sqlite3_column_bytes16 sqlite3_column_count sqlite3_column_decltype sqlite3_column_decltype16 sqlite3_column_double sqlite3_column_int sqlite3_column_int64 sqlite3_column_name sqlite3_column_name16 sqlite3_column_text sqlite3_column_text16 sqlite3_column_type sqlite3_column_value sqlite3_commit_hook sqlite3_complete sqlite3_complete16 sqlite3_create_collation sqlite3_create_collation16 sqlite3_create_collation_v2 sqlite3_create_function sqlite3_create_function16 sqlite3_create_module sqlite3_create_module_v2 sqlite3_data_count sqlite3_db_handle sqlite3_declare_vtab sqlite3_enable_load_extension sqlite3_enable_shared_cache sqlite3_errcode sqlite3_errmsg sqlite3_errmsg16 sqlite3_exec sqlite3_expired sqlite3_extended_result_codes sqlite3_file_control sqlite3_finalize sqlite3_free sqlite3_free_table sqlite3_get_autocommit sqlite3_get_auxdata sqlite3_get_table sqlite3_global_recover sqlite3_interrupt sqlite3_last_insert_rowid sqlite3_libversion sqlite3_libversion_number sqlite3_load_extension sqlite3_malloc sqlite3_memory_alarm sqlite3_memory_highwater sqlite3_memory_used sqlite3_mprintf sqlite3_mutex_alloc sqlite3_mutex_enter sqlite3_mutex_free sqlite3_mutex_held sqlite3_mutex_leave sqlite3_mutex_notheld sqlite3_mutex_try sqlite3_open sqlite3_open16 sqlite3_open_v2 sqlite3_overload_function sqlite3_prepare sqlite3_prepare16 sqlite3_prepare16_v2 sqlite3_prepare_v2 sqlite3_profile sqlite3_progress_handler sqlite3_realloc sqlite3_register_blob_functions sqlite3_register_unacc_functions sqlite3_release_memory sqlite3_reset sqlite3_reset_auto_extension sqlite3_result_blob sqlite3_result_double sqlite3_result_error sqlite3_result_error16 sqlite3_result_error_code sqlite3_result_error_nomem sqlite3_result_error_toobig sqlite3_result_int sqlite3_result_int64 sqlite3_result_null sqlite3_result_text sqlite3_result_text16 sqlite3_result_text16be sqlite3_result_text16le sqlite3_result_value sqlite3_result_zeroblob sqlite3_rollback_hook sqlite3_set_authorizer sqlite3_set_auxdata sqlite3_sleep sqlite3_snprintf sqlite3_soft_heap_limit sqlite3_sql sqlite3_step sqlite3_test_control sqlite3_thread_cleanup sqlite3_threadsafe sqlite3_total_changes sqlite3_trace sqlite3_transfer_bindings sqlite3_unregister_unacc_functions sqlite3_update_hook sqlite3_user_data sqlite3_value_blob sqlite3_value_bytes sqlite3_value_bytes16 sqlite3_value_double sqlite3_value_int sqlite3_value_int64 sqlite3_value_numeric_type sqlite3_value_text sqlite3_value_text16 sqlite3_value_text16be sqlite3_value_text16le sqlite3_value_type sqlite3_version sqlite3_vfs_find sqlite3_vfs_register sqlite3_vfs_unregister sqlite3_vmprintf

out.upx

SHA256 bc3f0a424c077cfbf88670d83b92eeb0ecb778361dec643999e800aa0da7e6c1
MD5 00c20aa3b9914d4399e8a0d17e09f6b8
SHA1 22efea4f21245b1507690fd5d603fb2ebfd556fb
SHA512 567e6a9b6e9f47d06be9d96a34e2d2154a2c49f2527c28544afc76979ebcc97f0266f2efdfad44c45c16f21c434f6bc71e72f929a9d109940987cc174a25bba8
SSDEEP 12288:MABU3Qf/hCkzCPAAk+U2ueRfFf+JdwSCnd:MABUAf/hCGyAAjU29Ff
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

357099

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

422KB

Virtual Size

421KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

418B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

56KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/IEFunctions.dll

IMPHASH 6fa52be756c91f139870df490053d24d
SHA256 a8fbec39470467e43e3fbc48cceeaf11d5e2fe3b98c521ac71b5522e7b46a859
MD5 46ee93cfce4dd2576579f45ad8c41b88
SHA1 f34a4eb6df68e521debda61e5af46aaf461bc3ce
SHA512 a2eb8ed29a819ee821c749dd76c04c2f3a5284a0063d08c43c9eaeb6f68a7c9034b846cb3cca26608cfe28b5ddc07842ea70a6aeb9cb7c6c1b579c3d05e40a5b
SSDEEP 96:fCOzwoO5dacVRNoYVhawoXA8B2oKhYVhrigWV6PM7qCtQp82:fAVV/cwcAMnAqrlWV6P0dQpL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5315

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InetLoad.dll

IMPHASH 24a4a671f5cc294ce3543d18a1e873cd
SHA256 bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
MD5 994669c5737b25c26642c94180e92fa2
SHA1 d8a1836914a446b0e06881ce1be8631554adafde
SHA512 d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
SSDEEP 384:nUOPTbiJmdztwwKq8W1cyMjPzV0Ac9k+LMkIX1+Gn+XHdjf:nTikliwKq8W1rMjPzz+f
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

strchr _adjust_fdiv malloc _initterm free memset strstr strtol strncmp strtoul time strrchr

kernel32

GlobalFree lstrcpynA CreateThread WaitForSingleObject TerminateThread GetModuleHandleA lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA lstrcmpA lstrlenA MulDiv WriteFile lstrcatA GetLastError DeleteFileA CloseHandle SleepEx

user32

GetDlgItem SendMessageA SetWindowTextA wsprintfA GetWindowTextA RegisterWindowMessageA CallWindowProcA PostMessageA DestroyWindow EnableWindow GetWindowLongA CreateWindowExA GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxA SendDlgItemMessageA SetDlgItemTextA SetTimer LoadIconA DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindow CreateDialogParamA FindWindowExA RedrawWindow SetWindowLongA

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoA InternetQueryOptionA HttpSendRequestA HttpAddRequestHeadersA InternetSetOptionA HttpOpenRequestA FtpOpenFileA InternetGetLastResponseInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/Processes.dll

IMPHASH eaa5f91829171a65db414b9e64ec9548
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Time.dll

IMPHASH 2e3a4d1f132aea64d421c1e936bcc407
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/chrmPref.dll

IMPHASH 7d07f4820d76999cba3c074d4db51382
SHA256 82d89574b1019c60d6bcf97318b36f8e4bb535bb68334c68253b6306d9dbe4af
MD5 b2bff24dcb4606c6c8474f979bfb4858
SHA1 5671b867df8ce726d1075909cd40f3934d680da6
SHA512 e7187607c909a9416ede056c10e83d4a0b8f8bb33a8653009630d5f36f80c8be145658d1c2d9df3ede48ce1e9bdf20d192dff45ebe0c6fdc50f241e81df4c874
SSDEEP 3072:R09yocgUKjfjp0CF45n1FAFbqz2Yoz+wThF4hW0OJ5XR+LbA1p5oonej12lS:R0MpgUWfFg4Fbc+ThihW55XiA1bW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

77909

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW WideCharToMultiByte GetProcAddress GlobalFree lstrcpyA lstrcpynA GlobalAlloc SetEnvironmentVariableA GetCurrentThreadId WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA Sleep FreeLibrary LoadLibraryA SetEndOfFile CreateFileW CreateFileA SetStdHandle WriteConsoleW LoadLibraryW IsValidLocale RaiseException EnterCriticalSection LeaveCriticalSection GetLastError InitializeCriticalSectionAndSpinCount DeleteCriticalSection HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedIncrement InterlockedDecrement InitializeCriticalSection EncodePointer DecodePointer RtlUnwind GetCommandLineA LCMapStringW MultiByteToWideChar GetCPInfo TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetACP GetOEMCP IsValidCodePage IsProcessorFeaturePresent HeapCreate SetHandleCount GetStdHandle GetFileType GetStartupInfoW ExitProcess WriteFile GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetModuleFileNameW GetLocaleInfoW GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA

user32

PeekMessageA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects

$PLUGINSDIR/mt.dll

IMPHASH 4ace53f9e1689a9a07327ded8e119e2d
SHA256 069db1a83371dcd2dd28a51def6cef190edcac6bbf35b81b7ee3c52105db210f
MD5 4fae8b7d6c73ca9e5fc4fe8d96c14583
SHA1 10865e388f36174297ec4ecdafd6265b331bfdcd
SHA512 73a5547c6d83227a08e2427f2e5eb6abf429d4b5b7e146fcd59b9fb8c9cc6eb9ff61347a3d46f83d0c7adbaff15e94e70bf40660c217f48e9a46a6e310aaf6b1
SSDEEP 96:Q934+YOERFWe2B1ZVtKW5A8V6dIUTY02J6qCtX:24FdL8vN5AHdIUTRw6dX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\nsis\Release\mtPlug.pdb

$PLUGINSDIR/nsisos.dll

IMPHASH a70233c77fd258ec47709388c2338273
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP 48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

80B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

588B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

156B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

96B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

ividi4ffx.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 63601ef9667c037dc62dc92c7b389edfb4191cde9063d1059996b93f035f454f
MD5 abbbe3516d8a6280b94e78ea7060e9c4
SHA1 a2f22d9dc3db1f10a44902e5cdfd7431b27a8671
SHA512 2ce546ef005dd07b5022fb524107c07693dbd58c21a2808060958baa7b968064c4e855d41c52f25ed89a3026460a6c9d413481e1d55f678ebf2cd5d170faf549
SSDEEP 6144:me343H/iBwVOG6Sqj1cibiFLjfCJH5hVOzb5:AH/ytGrOlbide5yZ
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

ad:5d:f0:47:a9:da:3f:a0:a8:b9:91:a3:3e:a8:2c:28:63:ef:89:94

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/Processes.dll

IMPHASH eaa5f91829171a65db414b9e64ec9548
SHA256 3b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
MD5 cc0bd4f5a79107633084471dbd4af796
SHA1 09dfcf182b1493161dec8044a5234c35ee24c43a
SHA512 67ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
SSDEEP 768:WmswCIbuzwEmd7Fp4KpDAKngV9tV3rJy63JgaVwoz7si4uYqUYWu1gYwmj552RFB:WmswCIbuzwEy7n3YD3Jgw7shKrp55io
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7219

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LoadLibraryA GetProcAddress FreeLibrary OpenProcess CloseHandle TerminateProcess GlobalFree lstrcpyA FlushFileBuffers CreateFileA GetCurrentThreadId GetCommandLineA GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetLastError InterlockedDecrement HeapFree Sleep ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WriteFile GetConsoleCP GetConsoleMode EnterCriticalSection LeaveCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

user32

GetDesktopWindow FindWindowA UpdateWindow wsprintfA

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Time.dll

IMPHASH 2e3a4d1f132aea64d421c1e936bcc407
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/mt.dll

IMPHASH 4ace53f9e1689a9a07327ded8e119e2d
SHA256 069db1a83371dcd2dd28a51def6cef190edcac6bbf35b81b7ee3c52105db210f
MD5 4fae8b7d6c73ca9e5fc4fe8d96c14583
SHA1 10865e388f36174297ec4ecdafd6265b331bfdcd
SHA512 73a5547c6d83227a08e2427f2e5eb6abf429d4b5b7e146fcd59b9fb8c9cc6eb9ff61347a3d46f83d0c7adbaff15e94e70bf40660c217f48e9a46a6e310aaf6b1
SSDEEP 96:Q934+YOERFWe2B1ZVtKW5A8V6dIUTY02J6qCtX:24FdL8vN5AHdIUTRw6dX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\nsis\Release\mtPlug.pdb

$PLUGINSDIR/nsisos.dll

IMPHASH a70233c77fd258ec47709388c2338273
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP 48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

80B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

588B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

156B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

96B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

$_0_/extensions/[email protected]/$_0_/extensions/[email protected]/uninstall.exe.nsis

SHA256 d755a3343d5c482ea9684cfdb93e69b554e933fa26ddf6ed4ccfdf097a031388
MD5 381746566e50f47e31f5988046e734ec
SHA1 b2006d68cf96ccce61fe7c39c27c54dd5d7a17f0
SHA512 bc900a81327310ac370ff2345c9f8f1ad26c6c74973d85714802de27c64f1bb2cd10fc3d4f5a4dc58e57992fa1d89ee002d08d07f7307c5225d29fd5703adcaa
SSDEEP 768:d/imFVV24DnCd3yModj0mnO/RycUoLqzUv5CLWX+VhouUJP4NOQdJcZfRxB03:piIVE42JGj16bUi4VhYJfQfQf23
MD5 SHA1 SHA512 SSDEEP

$_0_/extensions/[email protected]/chrome.manifest

SHA256 0e653d3d352b132843e5f7ab0a40e8637393892467ce9edfe8c82674122f4dbd
MD5 904206ce336dd4505a3a852898e77b2f
SHA1 85720bdebac33c47a9ccb409ecba066fa409e58b
SHA512 69e60f95a6e3e8d81f524453697e49beda2f42bc836dbaa4abe09ca2a4b6be93bb38e7d6ac6d217f01b2c927bdedd032efba8d663102a6fc754aa1764ac162d2
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/components/FFDisp.dll

IMPHASH 97afa875d1e57fd74d3d70e72dd926a4
SHA256 68da29242c721395d6dfa93cdc3b0044c7c17d4170f7477bd9a95b6329a6dc9f
MD5 f6ec79b37a78a30e35f73f45af4daafa
SHA1 95e2b92749a93cd020491a474b4428f424f61c5b
SHA512 da1779a782574218b67028d3ba7806bb7c51efd603ed83e535a32ebb6b0f25b790be3fb562d2417bbb6c45fb95e1a7a0039c212431ade492982566c3ea6fa9e5
SSDEEP 768:32ccINOvzk0jAfpN4Njf+rMrqwK9dCObTd/cwFI7:32jzvVaKpfbuwvOb9VFI7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\FFDisp.pdb

kernel32

MultiByteToWideChar GetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrlenW GetModuleFileNameW LoadLibraryW FreeLibrary GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapReAlloc HeapFree GetModuleHandleW GetProcAddress DeleteCriticalSection IsDebuggerPresent RaiseException HeapAlloc HeapDestroy GetSystemTimeAsFileTime

ole32

OleRun CoUninitialize CLSIDFromString CoCreateInstance CoInitialize

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantChangeType VariantClear VariantInit SysFreeString

atl100

ord30

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

free ??2@YAPAXI@Z ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABV01@@Z wcsnlen memcpy_s wmemcpy_s memmove_s calloc _recalloc _vscprintf vsprintf_s _CxxThrowException memset ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _crt_debugger_hook __clean_type_info_names_internal ??3@YAXPAX@Z wcsrchr __CxxFrameHandler3

$_0_/extensions/[email protected]/components/ffdisp.dll

IMPHASH 97afa875d1e57fd74d3d70e72dd926a4
SHA256 68da29242c721395d6dfa93cdc3b0044c7c17d4170f7477bd9a95b6329a6dc9f
MD5 f6ec79b37a78a30e35f73f45af4daafa
SHA1 95e2b92749a93cd020491a474b4428f424f61c5b
SHA512 da1779a782574218b67028d3ba7806bb7c51efd603ed83e535a32ebb6b0f25b790be3fb562d2417bbb6c45fb95e1a7a0039c212431ade492982566c3ea6fa9e5
SSDEEP 768:32ccINOvzk0jAfpN4Njf+rMrqwK9dCObTd/cwFI7:32jzvVaKpfbuwvOb9VFI7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\FFDisp.pdb

kernel32

MultiByteToWideChar GetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrlenW GetModuleFileNameW LoadLibraryW FreeLibrary GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapReAlloc HeapFree GetModuleHandleW GetProcAddress DeleteCriticalSection IsDebuggerPresent RaiseException HeapAlloc HeapDestroy GetSystemTimeAsFileTime

ole32

OleRun CoUninitialize CLSIDFromString CoCreateInstance CoInitialize

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantChangeType VariantClear VariantInit SysFreeString

atl100

ord30

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

free ??2@YAPAXI@Z ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABV01@@Z wcsnlen memcpy_s wmemcpy_s memmove_s calloc _recalloc _vscprintf vsprintf_s _CxxThrowException memset ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _crt_debugger_hook __clean_type_info_names_internal ??3@YAXPAX@Z wcsrchr __CxxFrameHandler3

$_0_/extensions/[email protected]/content/dpk.htm

SHA256 400e1722654c2986ed232c1ff984165e26dbd15b5d849eec0391b6926ec14e81
MD5 f5fe6cd832645b5daa04b41085f8b15c
SHA1 83570e3b7b9c576932fbf56423f2c6149ff2f484
SHA512 84bbef18130c0185906e7c07c72831b747462d2c9bd7598df6b17a5ab65eba19c099542a72f487d58e0c7806c3eabaa5555a356b414dec23ea2e98191849e733
MD5 SHA1 SHA512

polyglot

$_0_/extensions/[email protected]/content/hlprs.js

SHA256 8fd3968640fed419740744c27ce5453ec7c585097cdbdff053fd4bc15d668b0c
MD5 0208560f28cfc5fb7d9b35bab1b6ae08
SHA1 fa1b48800eef617e3ec741e9b814e953f4f1e19b
SHA512 67700f36a5a6c0cf95ffa5f1dc8234b591c60e618e2516d2981a298772667f4d463c9e6103b925c48f099a0d4ec544a5cab6fc2c6a3ae7e2188da576c95062ee
SSDEEP 96:8cuu6SEB9AJXEyzy2mD7Tj86B5bydnBVD:3uuMnAJX522mD7Tj86fyx
MD5 SHA1 SHA512 SSDEEP

$_0_/extensions/[email protected]/content/imgs/arwDwn.gif

SHA256 09d5f001629c8f26137e88cf7a0f7636e6c17d0d75abff9fd3ac106a85571617
MD5 2aa11fa4dcf0f03a0c8fb08170272566
SHA1 9e304d6bd0b0183a54baa2821772aa9f72ef149f
SHA512 8ee3d2e19a20ae5a2d84eed2c722d4bafe9ccc67eb7a061723f660178564945d5938584614f2bbdf5c90b2c78eddd3368196828a2992935f3a688db46f624080
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/closeo.png

SHA256 350ce7dc80d62bae5ee74655c6523171c4f3ad14be4a79a882db35ff9d117a65
MD5 b71d49346ccc4cdc8db3140456db417e
SHA1 ae1197e93bd97a20691f1773682939435b7b4bcd
SHA512 3197bc1d93b69d5256ca528d63dffb283ae7dce56e933226a48960f1cd7db21075a5fc180f9f53853ab7153db4f3f9b8c884cfe805cc0bf2670b2f2bc303f3d3
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ae.png

SHA256 18501f97e8f6782e1e13028632e28cf248e36f590992942de1800cad44c5c250
MD5 6eaf2387ebb3d038f6684457fc16bc44
SHA1 37efdfd3af3fb46e7b5158f045a1d471f15a3fa6
SHA512 f00a6e48be6c08044119cfcb578aaa3c5df6fc42bf51ee0d6334dd46d19afc254875bce0e6732fad1683834ae824578f10b124a5b07ae11cb2e720d510dff097
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/bg.png

SHA256 c4838a24ad388f934b04dbf9dba02a8bc6e9e58d0a1076477b47b5987a5c2d64
MD5 77b2183ab10cd26ee4e79fdfc12b8621
SHA1 c46dc6e0512560af14fceef6be24e8448e0f85f3
SHA512 50ddb2ce4bc0597bd3abba49ccfed0bc57484bffad6d44b8eaf2e8bdbffb52576167c7c575d218693c984d94775f6dd4b573038740d95cd6c402b8aeea49b885
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ch.png

SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
MD5 a82ff00f39eff54062328b4474c33dbc
SHA1 9c7185e038ea1000382fb1b14b88f3e9f2d99c14
SHA512 be801e5bbd51f6edb324dcd5b19239c64e011bb559e976875b2bcfe71b6a6eb1fd210454cc60402e7aeb6560e3ea6f277b1ca1eb4ff81bbb3dd99c3175a625f7
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/cn.png

SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
MD5 a82ff00f39eff54062328b4474c33dbc
SHA1 9c7185e038ea1000382fb1b14b88f3e9f2d99c14
SHA512 be801e5bbd51f6edb324dcd5b19239c64e011bb559e976875b2bcfe71b6a6eb1fd210454cc60402e7aeb6560e3ea6f277b1ca1eb4ff81bbb3dd99c3175a625f7
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/cz.png

SHA256 0f39366d88fabe6f6f5c7a3cb6a11165de6bc6bc2108802c49df5f9840bc6541
MD5 815b6d2bf60a3179c0652f0b6895bcbb
SHA1 6e8ced4d87b16744fb54c674fe95dc14e86babf4
SHA512 4b59d849d28741ae7ef338d293c41298c3d646748ccaf3b07985df0f1470da7738f17ca73f6af75f237244ec87ad4c38de80ff0587f9e104c74cf39442e7f1c7
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/de.png

SHA256 3323814006fe6739493d27057954941830b59eff37ebaac994310e17c522dd57
MD5 ddabae687ecae5edaaeb808d440543e6
SHA1 1daf2d67ccaa5be01a330a231ac996a9d5575594
SHA512 5bfbe453e635ede38a7e495badb349a2ebaa152a794d26d5b69b657f8e8fd5188436542bfe8c35d0c1117c3a25500d0404069d4b854faece914e07684d07a928
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/eg.png

SHA256 e4c44b7ce8a72720e2ab8b38b8885fca36dda04daa14ae37909bbd501d853074
MD5 09c48d3562f0dc51e2f9507704f6437f
SHA1 2e391c4c1a76533812f5ffe27076bcacb0fc3386
SHA512 dad27de417df66001869193a315af87a18d20bd472c369f7a66141b4208809ad1286504130e9f1307aa8de6ee9e37efa20006ada8822e20567eb411239351d88
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/en.png

SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
MD5 968591e0050981be9fa94bd2597afb48
SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
SHA512 ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/es.png

SHA256 e9aa6fcf5e814e25b7462ed594643e25979cf9c04f3a68197b5755b476ac38a7
MD5 d6693ce2a6346b2da89ceda335554e0a
SHA1 a88880bf0da5063d8082b66b066c4456e4d2e0d9
SHA512 6170bc86ff2076a7211161eeb09cf950da548c5e6c6a354054319ceb1f706e747ebae3ebf758efc24f0839266594bfc45eb3438677eb8c699420b60919cdc970
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/fr.png

SHA256 79a39793efbf8217efbbc840e1b2041fe995363a5f12f0c01dd4d1462e5eb842
MD5 c1cf1874c3305e5663547a48f6ad2d8c
SHA1 0f67f12d76a0543772a3259a3b38935381349e01
SHA512 c00e202e083f703e39cafbb86f3e3f6b330359906e3a6c7a6a78364d6adeb489f8b8ab1b2d6a1b8d9ef1a17702cfc8fc17219cf1aae3e5a7c18833f028037843
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/gr.png

SHA256 5648d2078756ae0b084312c46b02d82905cd9fb84262267cafcf9b71828ac358
MD5 fd9b321b80be31c027585c8992f1799f
SHA1 a7642c9048b600752746cbeb619db06986cb33aa
SHA512 9cdd89209e8d465e054f7259b3134bd4f45a758f7a1c805bb9839fa2e1a016887b0853b8cf943b1e64b8bb08155256bb1f1481e491b6d1df09195aac8f9c9d34
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/he.png

SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
MD5 a135fcdefe8a391b416bdb102476e12b
SHA1 69193e287d1aff860283b7bfec58268cc1a22cce
SHA512 7aa881a7bf15107198f9ac1ff5b7583b7c0f501bfc6ca88c938501881d67972ce826c757a5c3ac7e3bbacab76abe2438b217bfccb1dd04c4beaacc5608c619e9
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/il.png

SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
MD5 a135fcdefe8a391b416bdb102476e12b
SHA1 69193e287d1aff860283b7bfec58268cc1a22cce
SHA512 7aa881a7bf15107198f9ac1ff5b7583b7c0f501bfc6ca88c938501881d67972ce826c757a5c3ac7e3bbacab76abe2438b217bfccb1dd04c4beaacc5608c619e9
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/it.png

SHA256 c7992f57d67156f994a38c6bb4ec72fa57601a284558db5e065c02dc36ee9d8c
MD5 784f7eb333f0591558bcce9616a3c105
SHA1 c786c15b1b86629c1bbb6ac12be5fba39181dec0
SHA512 0f3feaa63385520f2565c7aed0d6d7a0b6f66b78fb6c8845a026199c375707911822b93534033c15f0f517677c1e9a400263c1b6022794401cbf8d7367639b6d
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ja.png

SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
MD5 10958397bc7c25c746e6e122365c003c
SHA1 3c5b175471d77c6e813a140c6859bca53952d9d3
SHA512 de6380d995a3f7ba70e05112332a4ba72f88ac2aa2f502a308d3f979197dc0a75c9822012b491c7f2f95519571ad6ca15b757b10a05cb95dc7006b0bde650ea3
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/jp.png

SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
MD5 10958397bc7c25c746e6e122365c003c
SHA1 3c5b175471d77c6e813a140c6859bca53952d9d3
SHA512 de6380d995a3f7ba70e05112332a4ba72f88ac2aa2f502a308d3f979197dc0a75c9822012b491c7f2f95519571ad6ca15b757b10a05cb95dc7006b0bde650ea3
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/nl.png

SHA256 1546928846ee0a8377fd30865d4c43cef501eba7d775d494b98d1ce699627a4a
MD5 6186550ebc77b1c51cd3ae37e78c33c1
SHA1 622ec95e782d65a5115921b1788b7fc3e97d90ef
SHA512 e816190dfd411f4d9caac81448f8aa8296ee42536a7c2d48fd8af8f519c2bd924913d5003ff1afdb0fa1d277d378f87ea9ee0162048894a78fad5687d9c30f6b
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/no.png

SHA256 f8dc302371c809ebda3e9183c606264601f8dd851d2b1878fd25f0f6abe2988c
MD5 559ce5baaee373db8da150a5066c1062
SHA1 ee80e5f63c986d04f46bff10f639113c88107ced
SHA512 c0ca7595cdd2dcef0385ccb1c0d15bb74accaea63b9531233bddf14c1791ffc9712dff660292706cfa269a975d29d7a189885cd09046ac6d8ed39a57ec9557ca
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/pl.png

SHA256 34f6a1822d880608e7124d2ea0e3da4cd9b3a3b3b7d18171b61031cedbe6e72f
MD5 fad0e96c20f20be196499d26a6c74cd1
SHA1 e383eba9af578aced6f5e9b896b7fbb4d7ef120c
SHA512 e6f25c2c165341ab56241518b5cf574623370ca68a1865defbd681210c8ed02dc080c3f998018e8278399f4d9a711051ba66f06bc345c32cfd6272188db30b83
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/pt.png

SHA256 ba636f1cb6bfd323dac1fb079cd002b5d486ed5eff54f4c4744b81316b257e96
MD5 5b8ab69ac52129bd32a3927f1b94d170
SHA1 058abf2f3e55994f2d952dbe8619bf9ad190635c
SHA512 f590d64f2e4407c3746b580dd94938d5288f0799e6bce082218639c80500dcb39110a75049d0c3f54977bafe1f9ffd212ea5b4c4a275658af5daf7c5a9e52a58
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ro.png

SHA256 0f83abcca7f07368819e3268d42f161edabcee4b56329c67de93779c1fba3ec5
MD5 d038c9c152c5e14f875c7b13afcd4711
SHA1 f141b663f5e234edabcb29e5fc69ce52f93be993
SHA512 9859531f797639458316f2a34aae3d56e8798ff45a7fed586c2e4129c93d1246af3d3d8509975d36a2ce7f4b38723ee79026020b1fe4fde628ef082e7e283769
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ru.png

SHA256 c6e9489e25e7854a58db93acc5a91b3cc023d33a70c4931dce8d2ef2868b5e94
MD5 0d31ef75adef220e73f0cb93a84a7422
SHA1 24b172c54d4691a8862403c73624f6b0bf23fc09
SHA512 708a416718a8461b26112ae05cea350eb44147ac43df9368280346a071440fec09155d069cf72554debbd6912c795a860cfe999c34a3dfbd588deb9a07db6764
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/sa.png

SHA256 8a82f9366b0218584e72ba24eefdbf0f9dd6030480219e39f13cf1e7fe87a03a
MD5 605884cec6f446d418a092c0941acad5
SHA1 d305493e396df549a97ebc6ab3a81f7307431799
SHA512 3de20f2c9d18cbc5195b65a68534612d98b16e31dfc9c615b8c764da343b1a7d598c927a58d16be6c94a2b3e506400fcdc2ac338eaa8b5eef0e7d0419ac16585
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/se.png

SHA256 dc67a89a0d57005dad961a1213206395e0dfd8c7825249a0611e140bf211e323
MD5 4c01f06db23324267e2802dcade3572f
SHA1 f3e4cb0b941ff02eb176bab9ba45feff6f544a17
SHA512 47d7f06f7f1c3e7d49dcd75e36185a39be94b81c233f6154c200bd3ebcd25b23ce40a25a4c0708051507b9a734beae56c7c66dcd6e2eb006f21c58d7c0044b8a
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/sv.png

SHA256 9722f682cdac58479490bd4ad3e2988aaf69fff9f73c4795f586fd6537cc97af
MD5 c6c853766dfbab2ddd225980d3012f5c
SHA1 a66a15a3d88a4343d0cac61d0b8c97fce2198b7d
SHA512 e513ca04828ce764389b6204d52f336344e95bd2d229a90f393773daa8f380164cedaa83cafcc9f58f0be8466da96b87a26fc6fdeb198e183fbee6c759aecc20
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/tr.png

SHA256 292d592f7fa1df2fa653ecc1e03d5eb2ae68277c6df264f762aefb8218e23454
MD5 31ea1f705854ad57c432845068bd05d3
SHA1 e1821d04141354bfdeb2e25e488ac8a7face8900
SHA512 48258f8dd8184851243f72ba042d00acec6c3fade4b3acb6265a41ec078802505352c7f09a307567ee9331583568bcc8165e806648a462e637856e2d272413b5
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/ua.png

SHA256 9ae2f204178855c4fdb29ce75a0a1b2588fc3db3a7084d29715876bacd293508
MD5 7ef7a6f5def3a4117d5c2f08e37008ff
SHA1 9fd21d733a8d9d551c5880c8f0b6a5e5c6916f57
SHA512 ab9d39fedf5a1e0c7fcc8226a4e43a0e241dfe3e08dfb3eeec028dc44a48431c56e7c434d99c75e11024aa36a1c383ca4fb1749126719acc9ff1bc7f7d311d71
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/flgs/us.png

SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
MD5 968591e0050981be9fa94bd2597afb48
SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
SHA512 ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/help_16.gif

SHA256 c0f88266f7bed444f325f262776de2e93ea08f0daefe34e6afe4321cea96464d
MD5 2a2dc1f7306ae44a3311fff7a6fb2a7f
SHA1 b404705e22dee4e3a2a4afddeb906aabb5178774
SHA512 fda8f40551c1d1ee2bf9f4eed7e1c3139e69ddc0ce89252d8272759520b58516ea4f9be6e3d039bd1286c6d490eac59f4a0199e89762ec5141284648198ff59a
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/home.gif

SHA256 82e60bcbb0e378b47cf29f468e90f9bf380dac0832aa090d01567b4f92a00f6d
MD5 d755d9075bc4e174adc0277569b9ff0f
SHA1 5436346d99061cf9b443db01fd1ce9272d155fb4
SHA512 5b6b26a6b5be6bb5c1e12bfe782c56e55a35da7b7e0c3321d6dfd71c23dac72c1eaddd71809abe05d59b6af8f57303b1c48811e6e41b1e70080443f24bac50ce
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/icon_seperator.png

SHA256 7287f506532fec559c881032d4eb744db6074c5cf6b40f0feb7cfa009f3847ce
MD5 a6746af3a5fd92038b0f143500757455
SHA1 54d558533edf7fbbd94d9874d975679939bd27b5
SHA512 4e885c290023eb3156432fbf55fc2e74e9631b83cd7ef56427538380ce2bb5c46499c0886a66555e90a4834c6cbb11e34842426e5ef60240738f4fb8b3342dce
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/logo.png

SHA256 058a5ef6675191b325a157bd4e168e71f6eb0805781883dd3ea27294248a27a9
MD5 952d34065b6fdbf50e4988bc493ab64e
SHA1 5f41ba1a1d855bc34e05f36b0320491fae45804e
SHA512 a5fdfc5e4af82e7700ca0a921cc2f8975e100217d230d5b6450b52ff555e82fdf9a7ebc90c79285d0aa749dbb754248bc1724539a221510014669c861ca3f60b
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/privecy_16_hot.gif

SHA256 f39738751127030af7f04870ae22120df86355174a0162ec63169b85a0a0b657
MD5 88cf50e9f311da3b28823f47eb8c556b
SHA1 c8eab21735068e31487d150b8a1fbe8a5cbfc291
SHA512 d7ae9ad6a02b8e13e483a5804f83054d67009a883973fc1c139496e8f163fa82879b6f41f811b8697a252c4948da9993a05ea9941665205c056ff46d53fede8d
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/sign.jpg

SHA256 9eb4e18a956eed4d8569e24a25621dc21333f3ccf353351598027d041793d7de
MD5 8ce895aed5dc943d6e5bcd438a1943f3
SHA1 33468cb47e071afa85e8baa2d42a3cdbf4498b8d
SHA512 a5805f35ee3765df86c54093aeadabe0758e90f6df47c2d7cfef9626049f3ec71c943bfcaf75869cca15a00f08ded274460d10fff8bcb076f27cc82dbb4303e0
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/specialoffer.gif

SHA256 cd679ddffd67c55358a483881efd57957664d791e2ddc0726eddb9f29caed8fb
MD5 fdcc9ecdc76728591e16036f89e4c5a5
SHA1 252d700ab476571b68441b90bb702dfd10dd05a0
SHA512 ae1dfd6351527ddab6d572470e928f2ca043857ba385bf78ed6ab87cd7c36a5b709d8762f555fb69f368c07a316f9126935d33fad1a42466ce54043eb7047dd6
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/tellafriend.gif

SHA256 cce0853613b237b4fbe284e485ccc7835db14cdb628c4f1dc7be19b637d5f5bf
MD5 42742d7e90c946ecf4f127f6e7c1ecce
SHA1 ec02244f0bc625ea156e6be8c1e08f2ced107b3a
SHA512 3c7af7b5758175d2bbbe6199d6eba27622530a3e5eb3602aecc74060b7b84a7e027a811c89b9ecc65f0f30c147fbce9245f4e8ec8db28f1a162e4f38084bcc0a
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/imgs/uninstall.gif

SHA256 84e1835aa736f6e18a140df111bc4b77a93bb7ac91f9b4e95950454fe28aebb3
MD5 7f738620927255010c91b900ee996bee
SHA1 14897de036f330ad7db59c464638940841a31d52
SHA512 0adc62f09a9be39506cc55196794e6fb03a57b767da5f8740475d7222d7cc93b44f1a938b31fd1974c2df4bb702dd56cef2f6549b1d6bdc329417a76173d527e
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/ividi.css

SHA256 20edd110377aa59757e96194104f3a94a116e4d2e8eaec176ed9e5b31b7a37f6
MD5 3d27cf8abda1871ff482a9847c49c54d
SHA1 cdad24fd732ddeb980dc857573e00d8872ae13ed
SHA512 a3bee6796035f2d038a17ceb3c8ee641073602b4b8c667d24a4224e52c2d62d0f02c0b382039444100a99758e5e97c4e7d8d3b9f770f23ad4c321bbbc7afd056
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/ividi.xul

SHA256 4b5c8fc8203c1edf0ed2e2bf09dcbf1eae7186cf8e2ac213750b1b4489c48a5e
MD5 041f646f63a4b35159487e8d23792c36
SHA1 8d8464198a529f5ceb8c9c45d8943e77d823805b
SHA512 339308fb11b0d1723ac9fab5f1445f7c1967260cbcce6a0ed6737c2d223eb6ba568e8c48e54babc66569d5c2f61ebcbe2147978a4c0d7230bcfd7a336dcc3f14
MD5 SHA1 SHA512

$_0_/extensions/[email protected]/content/loader.xul

SHA256 4660d79a17aea7f0e4f77a7a1dec1ff8a62d03c21832139bea10ef13cbc7f53d
MD5 ea7318b7fb5e0fd4ba9b5029cfa1b1ec
SHA1 41f3e315789dc82a014fdb84be97d6399f1f9617
SHA512 625e5f66bbbe0866d52d45e8f52e9815062d0d540a44be6973ad4a8fd566bb14ecae09757281cafdd09787c28939903cd18bd5910a79b4cc93c1f981dea9c5bc
MD5 SHA1 SHA512

polyglot

$_0_/extensions/[email protected]/content/mtstart.js

SHA256 728c0f581f70f6d705fe14fe2ac05f28cf682b833362719b2529e6c480972ea7
MD5 32d9799596d57cca88271ae9ee89e5e7
SHA1 60b1f8a1b9e4b48f5c5fb703822eab2327c3a361
SHA512 569970f954b0602da2d9bafa198faec752365758ec7a248c2665d642a108bc0846da5ff6f81ebcb26b4c13b412117d779663b0993f1e155c00659d3ea83a213e
SSDEEP 384:vWvRkn38kp9wYN9nxDbPz5bay1GQh6ebFbXnBB9TLXjnq2i262297swYX1T5qWst:pxp9zxDbPz5bay1GWxpNqWsjioluI
MD5 SHA1 SHA512 SSDEEP

$_0_/extensions/[email protected]/content/serp.js

SHA256 5fcf1902bf3b91c4e752580245651dff67090b3c68e6341881b3eb1e3e93c762
MD5 2ce333cf921024d3a5e7811dd83248c6
SHA1 a734a90921870dbd505ac9cf37dec90da970fb4d
SHA512 7b9993c573e7697eaa3f458adc51ca094c1c5813a0a531212c72b70bc43a9501d9110330e0ca6d9585bfff007eb72fb03fb8c6ac303edaf1ccfbf3b79ca9c2c8
SSDEEP 192:R+i5oW2l7owIWEjefLW0drKvWhdT6V3ZUJUaQ0oIq1qIP:RB5oW2l7eWEjefLPdW+hdT6hZuNQ0oIy
MD5 SHA1 SHA512 SSDEEP

$_0_/extensions/[email protected]/content/tmplt.js

SHA256 fe078bc40ffc977388a1f93d81858e901addbf2239bef51f5fe5f2a29fef5d64
MD5 ae6b7bb925f76c14e06cce500ebbc8ca
SHA1 61630e438c7e659409b2629a78c25bd7d3295184
SHA512 95928919c84c65108f80c587218d568380071f099b93180d1883642cf51873deb740381afa58b1a38cb84641fad1e815b21b0a065f5bdc95e0f7d3c0edb9f62c
SSDEEP 96:ZJpFZ7+xMkgTXM7qp3NDBPFrpR1pvAiz8v9JVXA96wDsdUslRydFkbsqBuu7hqTN:Z3F+MtXMep3xBPFrpbRzzNa5cybExaPC
MD5 SHA1 SHA512 SSDEEP

$_0_/extensions/[email protected]/install.rdf

SHA256 e13bbc1650aa9e1a07c4bffe5a048f74b821bbf183dd897489dbc3fc216c0e13
MD5 71ae8c825b1184cf4f0e4d66f8b01bf0
SHA1 7db0797a2225705ecc637536fe863b2b90f0909a
SHA512 799f5cd87593699bd73e389c31efbe1637ec00ccdd5cba1a6ed2bfe3b56f5965775196e28b7770a348bc9496c9bb875fd723b5e196c8f5817594323d74370ece
MD5 SHA1 SHA512

$_0_/extensions/staged/[email protected]/$_0_/extensions/staged/[email protected]/uninstall.exe.nsis

SHA256 d755a3343d5c482ea9684cfdb93e69b554e933fa26ddf6ed4ccfdf097a031388
MD5 381746566e50f47e31f5988046e734ec
SHA1 b2006d68cf96ccce61fe7c39c27c54dd5d7a17f0
SHA512 bc900a81327310ac370ff2345c9f8f1ad26c6c74973d85714802de27c64f1bb2cd10fc3d4f5a4dc58e57992fa1d89ee002d08d07f7307c5225d29fd5703adcaa
SSDEEP 768:d/imFVV24DnCd3yModj0mnO/RycUoLqzUv5CLWX+VhouUJP4NOQdJcZfRxB03:piIVE42JGj16bUi4VhYJfQfQf23
MD5 SHA1 SHA512 SSDEEP

ividi.xpi

SHA256 75dcca7e6e29c09f37c50ce3ce5bea43e9a372ab47fb262b5f1901c2548d29fe
MD5 ce008faae0849876dab1b6430395637a
SHA1 834b2051a881a17bdb2ca72fb25f001a2654f3bb
SHA512 8e63c302ad78521aa9376bbbdc617431878d5b57cf98c60eded3b4393511511c79d88aab024bcab70e037fe9e606aae3a682c6941a30a553e0e490ba5174d947
SSDEEP 768:jmV9Lx64OrNbESWxikusJtMMjy35yLme4L+ZYfRJnbAUYqp/lUg5SvWgLBsEtpJ0:6VxBOBoSWJ7MM5ye7Yf4+BlQHtTKs+mm
MD5 SHA1 SHA512 SSDEEP

chrome.manifest

SHA256 0e653d3d352b132843e5f7ab0a40e8637393892467ce9edfe8c82674122f4dbd
MD5 904206ce336dd4505a3a852898e77b2f
SHA1 85720bdebac33c47a9ccb409ecba066fa409e58b
SHA512 69e60f95a6e3e8d81f524453697e49beda2f42bc836dbaa4abe09ca2a4b6be93bb38e7d6ac6d217f01b2c927bdedd032efba8d663102a6fc754aa1764ac162d2
MD5 SHA1 SHA512

components/FFDisp.dll

IMPHASH 97afa875d1e57fd74d3d70e72dd926a4
SHA256 68da29242c721395d6dfa93cdc3b0044c7c17d4170f7477bd9a95b6329a6dc9f
MD5 f6ec79b37a78a30e35f73f45af4daafa
SHA1 95e2b92749a93cd020491a474b4428f424f61c5b
SHA512 da1779a782574218b67028d3ba7806bb7c51efd603ed83e535a32ebb6b0f25b790be3fb562d2417bbb6c45fb95e1a7a0039c212431ade492982566c3ea6fa9e5
SSDEEP 768:32ccINOvzk0jAfpN4Njf+rMrqwK9dCObTd/cwFI7:32jzvVaKpfbuwvOb9VFI7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19104

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\FFDisp.pdb

kernel32

MultiByteToWideChar GetLastError WideCharToMultiByte SizeofResource LockResource LoadResource FindResourceW FindResourceExW lstrlenW GetModuleFileNameW LoadLibraryW FreeLibrary GetCurrentProcessId GetTickCount QueryPerformanceCounter GetCurrentThreadId SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange DecodePointer EncodePointer InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetProcessHeap HeapSize HeapReAlloc HeapFree GetModuleHandleW GetProcAddress DeleteCriticalSection IsDebuggerPresent RaiseException HeapAlloc HeapDestroy GetSystemTimeAsFileTime

ole32

OleRun CoUninitialize CLSIDFromString CoCreateInstance CoInitialize

oleaut32

SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantChangeType VariantClear VariantInit SysFreeString

atl100

ord30

msvcp100

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?_Orphan_all@_Container_base0@std@@QAEXXZ

msvcr100

free ??2@YAPAXI@Z ??0exception@std@@QAE@ABQBD@Z ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@ABV01@@Z wcsnlen memcpy_s wmemcpy_s memmove_s calloc _recalloc _vscprintf vsprintf_s _CxxThrowException memset ?terminate@@YAXXZ _unlock __dllonexit _lock _onexit _malloc_crt _encoded_null _initterm _initterm_e _amsg_exit __CppXcptFilter ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _crt_debugger_hook __clean_type_info_names_internal ??3@YAXPAX@Z wcsrchr __CxxFrameHandler3

content/dpk.htm

SHA256 400e1722654c2986ed232c1ff984165e26dbd15b5d849eec0391b6926ec14e81
MD5 f5fe6cd832645b5daa04b41085f8b15c
SHA1 83570e3b7b9c576932fbf56423f2c6149ff2f484
SHA512 84bbef18130c0185906e7c07c72831b747462d2c9bd7598df6b17a5ab65eba19c099542a72f487d58e0c7806c3eabaa5555a356b414dec23ea2e98191849e733
MD5 SHA1 SHA512

polyglot

content/hlprs.js

SHA256 8fd3968640fed419740744c27ce5453ec7c585097cdbdff053fd4bc15d668b0c
MD5 0208560f28cfc5fb7d9b35bab1b6ae08
SHA1 fa1b48800eef617e3ec741e9b814e953f4f1e19b
SHA512 67700f36a5a6c0cf95ffa5f1dc8234b591c60e618e2516d2981a298772667f4d463c9e6103b925c48f099a0d4ec544a5cab6fc2c6a3ae7e2188da576c95062ee
SSDEEP 96:8cuu6SEB9AJXEyzy2mD7Tj86B5bydnBVD:3uuMnAJX522mD7Tj86fyx
MD5 SHA1 SHA512 SSDEEP

content/imgs/arwDwn.gif

SHA256 09d5f001629c8f26137e88cf7a0f7636e6c17d0d75abff9fd3ac106a85571617
MD5 2aa11fa4dcf0f03a0c8fb08170272566
SHA1 9e304d6bd0b0183a54baa2821772aa9f72ef149f
SHA512 8ee3d2e19a20ae5a2d84eed2c722d4bafe9ccc67eb7a061723f660178564945d5938584614f2bbdf5c90b2c78eddd3368196828a2992935f3a688db46f624080
MD5 SHA1 SHA512

content/imgs/closeo.png

SHA256 350ce7dc80d62bae5ee74655c6523171c4f3ad14be4a79a882db35ff9d117a65
MD5 b71d49346ccc4cdc8db3140456db417e
SHA1 ae1197e93bd97a20691f1773682939435b7b4bcd
SHA512 3197bc1d93b69d5256ca528d63dffb283ae7dce56e933226a48960f1cd7db21075a5fc180f9f53853ab7153db4f3f9b8c884cfe805cc0bf2670b2f2bc303f3d3
MD5 SHA1 SHA512

content/imgs/flgs/ae.png

SHA256 18501f97e8f6782e1e13028632e28cf248e36f590992942de1800cad44c5c250
MD5 6eaf2387ebb3d038f6684457fc16bc44
SHA1 37efdfd3af3fb46e7b5158f045a1d471f15a3fa6
SHA512 f00a6e48be6c08044119cfcb578aaa3c5df6fc42bf51ee0d6334dd46d19afc254875bce0e6732fad1683834ae824578f10b124a5b07ae11cb2e720d510dff097
MD5 SHA1 SHA512

content/imgs/flgs/bg.png

SHA256 c4838a24ad388f934b04dbf9dba02a8bc6e9e58d0a1076477b47b5987a5c2d64
MD5 77b2183ab10cd26ee4e79fdfc12b8621
SHA1 c46dc6e0512560af14fceef6be24e8448e0f85f3
SHA512 50ddb2ce4bc0597bd3abba49ccfed0bc57484bffad6d44b8eaf2e8bdbffb52576167c7c575d218693c984d94775f6dd4b573038740d95cd6c402b8aeea49b885
MD5 SHA1 SHA512

content/imgs/flgs/ch.png

SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
MD5 a82ff00f39eff54062328b4474c33dbc
SHA1 9c7185e038ea1000382fb1b14b88f3e9f2d99c14
SHA512 be801e5bbd51f6edb324dcd5b19239c64e011bb559e976875b2bcfe71b6a6eb1fd210454cc60402e7aeb6560e3ea6f277b1ca1eb4ff81bbb3dd99c3175a625f7
MD5 SHA1 SHA512

content/imgs/flgs/cn.png

SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
MD5 a82ff00f39eff54062328b4474c33dbc
SHA1 9c7185e038ea1000382fb1b14b88f3e9f2d99c14
SHA512 be801e5bbd51f6edb324dcd5b19239c64e011bb559e976875b2bcfe71b6a6eb1fd210454cc60402e7aeb6560e3ea6f277b1ca1eb4ff81bbb3dd99c3175a625f7
MD5 SHA1 SHA512

content/imgs/flgs/cz.png

SHA256 0f39366d88fabe6f6f5c7a3cb6a11165de6bc6bc2108802c49df5f9840bc6541
MD5 815b6d2bf60a3179c0652f0b6895bcbb
SHA1 6e8ced4d87b16744fb54c674fe95dc14e86babf4
SHA512 4b59d849d28741ae7ef338d293c41298c3d646748ccaf3b07985df0f1470da7738f17ca73f6af75f237244ec87ad4c38de80ff0587f9e104c74cf39442e7f1c7
MD5 SHA1 SHA512

content/imgs/flgs/de.png

SHA256 3323814006fe6739493d27057954941830b59eff37ebaac994310e17c522dd57
MD5 ddabae687ecae5edaaeb808d440543e6
SHA1 1daf2d67ccaa5be01a330a231ac996a9d5575594
SHA512 5bfbe453e635ede38a7e495badb349a2ebaa152a794d26d5b69b657f8e8fd5188436542bfe8c35d0c1117c3a25500d0404069d4b854faece914e07684d07a928
MD5 SHA1 SHA512

content/imgs/flgs/eg.png

SHA256 e4c44b7ce8a72720e2ab8b38b8885fca36dda04daa14ae37909bbd501d853074
MD5 09c48d3562f0dc51e2f9507704f6437f
SHA1 2e391c4c1a76533812f5ffe27076bcacb0fc3386
SHA512 dad27de417df66001869193a315af87a18d20bd472c369f7a66141b4208809ad1286504130e9f1307aa8de6ee9e37efa20006ada8822e20567eb411239351d88
MD5 SHA1 SHA512

content/imgs/flgs/en.png

SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
MD5 968591e0050981be9fa94bd2597afb48
SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
SHA512 ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219
MD5 SHA1 SHA512

content/imgs/flgs/es.png

SHA256 e9aa6fcf5e814e25b7462ed594643e25979cf9c04f3a68197b5755b476ac38a7
MD5 d6693ce2a6346b2da89ceda335554e0a
SHA1 a88880bf0da5063d8082b66b066c4456e4d2e0d9
SHA512 6170bc86ff2076a7211161eeb09cf950da548c5e6c6a354054319ceb1f706e747ebae3ebf758efc24f0839266594bfc45eb3438677eb8c699420b60919cdc970
MD5 SHA1 SHA512

content/imgs/flgs/fr.png

SHA256 79a39793efbf8217efbbc840e1b2041fe995363a5f12f0c01dd4d1462e5eb842
MD5 c1cf1874c3305e5663547a48f6ad2d8c
SHA1 0f67f12d76a0543772a3259a3b38935381349e01
SHA512 c00e202e083f703e39cafbb86f3e3f6b330359906e3a6c7a6a78364d6adeb489f8b8ab1b2d6a1b8d9ef1a17702cfc8fc17219cf1aae3e5a7c18833f028037843
MD5 SHA1 SHA512

content/imgs/flgs/gr.png

SHA256 5648d2078756ae0b084312c46b02d82905cd9fb84262267cafcf9b71828ac358
MD5 fd9b321b80be31c027585c8992f1799f
SHA1 a7642c9048b600752746cbeb619db06986cb33aa
SHA512 9cdd89209e8d465e054f7259b3134bd4f45a758f7a1c805bb9839fa2e1a016887b0853b8cf943b1e64b8bb08155256bb1f1481e491b6d1df09195aac8f9c9d34
MD5 SHA1 SHA512

content/imgs/flgs/he.png

SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
MD5 a135fcdefe8a391b416bdb102476e12b
SHA1 69193e287d1aff860283b7bfec58268cc1a22cce
SHA512 7aa881a7bf15107198f9ac1ff5b7583b7c0f501bfc6ca88c938501881d67972ce826c757a5c3ac7e3bbacab76abe2438b217bfccb1dd04c4beaacc5608c619e9
MD5 SHA1 SHA512

content/imgs/flgs/il.png

SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
MD5 a135fcdefe8a391b416bdb102476e12b
SHA1 69193e287d1aff860283b7bfec58268cc1a22cce
SHA512 7aa881a7bf15107198f9ac1ff5b7583b7c0f501bfc6ca88c938501881d67972ce826c757a5c3ac7e3bbacab76abe2438b217bfccb1dd04c4beaacc5608c619e9
MD5 SHA1 SHA512

content/imgs/flgs/it.png

SHA256 c7992f57d67156f994a38c6bb4ec72fa57601a284558db5e065c02dc36ee9d8c
MD5 784f7eb333f0591558bcce9616a3c105
SHA1 c786c15b1b86629c1bbb6ac12be5fba39181dec0
SHA512 0f3feaa63385520f2565c7aed0d6d7a0b6f66b78fb6c8845a026199c375707911822b93534033c15f0f517677c1e9a400263c1b6022794401cbf8d7367639b6d
MD5 SHA1 SHA512

content/imgs/flgs/ja.png

SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
MD5 10958397bc7c25c746e6e122365c003c
SHA1 3c5b175471d77c6e813a140c6859bca53952d9d3
SHA512 de6380d995a3f7ba70e05112332a4ba72f88ac2aa2f502a308d3f979197dc0a75c9822012b491c7f2f95519571ad6ca15b757b10a05cb95dc7006b0bde650ea3
MD5 SHA1 SHA512

content/imgs/flgs/jp.png

SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
MD5 10958397bc7c25c746e6e122365c003c
SHA1 3c5b175471d77c6e813a140c6859bca53952d9d3
SHA512 de6380d995a3f7ba70e05112332a4ba72f88ac2aa2f502a308d3f979197dc0a75c9822012b491c7f2f95519571ad6ca15b757b10a05cb95dc7006b0bde650ea3
MD5 SHA1 SHA512

content/imgs/flgs/nl.png

SHA256 1546928846ee0a8377fd30865d4c43cef501eba7d775d494b98d1ce699627a4a
MD5 6186550ebc77b1c51cd3ae37e78c33c1
SHA1 622ec95e782d65a5115921b1788b7fc3e97d90ef
SHA512 e816190dfd411f4d9caac81448f8aa8296ee42536a7c2d48fd8af8f519c2bd924913d5003ff1afdb0fa1d277d378f87ea9ee0162048894a78fad5687d9c30f6b
MD5 SHA1 SHA512

content/imgs/flgs/no.png

SHA256 f8dc302371c809ebda3e9183c606264601f8dd851d2b1878fd25f0f6abe2988c
MD5 559ce5baaee373db8da150a5066c1062
SHA1 ee80e5f63c986d04f46bff10f639113c88107ced
SHA512 c0ca7595cdd2dcef0385ccb1c0d15bb74accaea63b9531233bddf14c1791ffc9712dff660292706cfa269a975d29d7a189885cd09046ac6d8ed39a57ec9557ca
MD5 SHA1 SHA512

content/imgs/flgs/pl.png

SHA256 34f6a1822d880608e7124d2ea0e3da4cd9b3a3b3b7d18171b61031cedbe6e72f
MD5 fad0e96c20f20be196499d26a6c74cd1
SHA1 e383eba9af578aced6f5e9b896b7fbb4d7ef120c
SHA512 e6f25c2c165341ab56241518b5cf574623370ca68a1865defbd681210c8ed02dc080c3f998018e8278399f4d9a711051ba66f06bc345c32cfd6272188db30b83
MD5 SHA1 SHA512

content/imgs/flgs/pt.png

SHA256 ba636f1cb6bfd323dac1fb079cd002b5d486ed5eff54f4c4744b81316b257e96
MD5 5b8ab69ac52129bd32a3927f1b94d170
SHA1 058abf2f3e55994f2d952dbe8619bf9ad190635c
SHA512 f590d64f2e4407c3746b580dd94938d5288f0799e6bce082218639c80500dcb39110a75049d0c3f54977bafe1f9ffd212ea5b4c4a275658af5daf7c5a9e52a58
MD5 SHA1 SHA512

content/imgs/flgs/ro.png

SHA256 0f83abcca7f07368819e3268d42f161edabcee4b56329c67de93779c1fba3ec5
MD5 d038c9c152c5e14f875c7b13afcd4711
SHA1 f141b663f5e234edabcb29e5fc69ce52f93be993
SHA512 9859531f797639458316f2a34aae3d56e8798ff45a7fed586c2e4129c93d1246af3d3d8509975d36a2ce7f4b38723ee79026020b1fe4fde628ef082e7e283769
MD5 SHA1 SHA512

content/imgs/flgs/ru.png

SHA256 c6e9489e25e7854a58db93acc5a91b3cc023d33a70c4931dce8d2ef2868b5e94
MD5 0d31ef75adef220e73f0cb93a84a7422
SHA1 24b172c54d4691a8862403c73624f6b0bf23fc09
SHA512 708a416718a8461b26112ae05cea350eb44147ac43df9368280346a071440fec09155d069cf72554debbd6912c795a860cfe999c34a3dfbd588deb9a07db6764
MD5 SHA1 SHA512

content/imgs/flgs/sa.png

SHA256 8a82f9366b0218584e72ba24eefdbf0f9dd6030480219e39f13cf1e7fe87a03a
MD5 605884cec6f446d418a092c0941acad5
SHA1 d305493e396df549a97ebc6ab3a81f7307431799
SHA512 3de20f2c9d18cbc5195b65a68534612d98b16e31dfc9c615b8c764da343b1a7d598c927a58d16be6c94a2b3e506400fcdc2ac338eaa8b5eef0e7d0419ac16585
MD5 SHA1 SHA512

content/imgs/flgs/se.png

SHA256 dc67a89a0d57005dad961a1213206395e0dfd8c7825249a0611e140bf211e323
MD5 4c01f06db23324267e2802dcade3572f
SHA1 f3e4cb0b941ff02eb176bab9ba45feff6f544a17
SHA512 47d7f06f7f1c3e7d49dcd75e36185a39be94b81c233f6154c200bd3ebcd25b23ce40a25a4c0708051507b9a734beae56c7c66dcd6e2eb006f21c58d7c0044b8a
MD5 SHA1 SHA512

content/imgs/flgs/sv.png

SHA256 9722f682cdac58479490bd4ad3e2988aaf69fff9f73c4795f586fd6537cc97af
MD5 c6c853766dfbab2ddd225980d3012f5c
SHA1 a66a15a3d88a4343d0cac61d0b8c97fce2198b7d
SHA512 e513ca04828ce764389b6204d52f336344e95bd2d229a90f393773daa8f380164cedaa83cafcc9f58f0be8466da96b87a26fc6fdeb198e183fbee6c759aecc20
MD5 SHA1 SHA512

content/imgs/flgs/tr.png

SHA256 292d592f7fa1df2fa653ecc1e03d5eb2ae68277c6df264f762aefb8218e23454
MD5 31ea1f705854ad57c432845068bd05d3
SHA1 e1821d04141354bfdeb2e25e488ac8a7face8900
SHA512 48258f8dd8184851243f72ba042d00acec6c3fade4b3acb6265a41ec078802505352c7f09a307567ee9331583568bcc8165e806648a462e637856e2d272413b5
MD5 SHA1 SHA512

content/imgs/flgs/ua.png

SHA256 9ae2f204178855c4fdb29ce75a0a1b2588fc3db3a7084d29715876bacd293508
MD5 7ef7a6f5def3a4117d5c2f08e37008ff
SHA1 9fd21d733a8d9d551c5880c8f0b6a5e5c6916f57
SHA512 ab9d39fedf5a1e0c7fcc8226a4e43a0e241dfe3e08dfb3eeec028dc44a48431c56e7c434d99c75e11024aa36a1c383ca4fb1749126719acc9ff1bc7f7d311d71
MD5 SHA1 SHA512

content/imgs/flgs/us.png

SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
MD5 968591e0050981be9fa94bd2597afb48
SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
SHA512 ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219
MD5 SHA1 SHA512

content/imgs/help_16.gif

SHA256 c0f88266f7bed444f325f262776de2e93ea08f0daefe34e6afe4321cea96464d
MD5 2a2dc1f7306ae44a3311fff7a6fb2a7f
SHA1 b404705e22dee4e3a2a4afddeb906aabb5178774
SHA512 fda8f40551c1d1ee2bf9f4eed7e1c3139e69ddc0ce89252d8272759520b58516ea4f9be6e3d039bd1286c6d490eac59f4a0199e89762ec5141284648198ff59a
MD5 SHA1 SHA512

content/imgs/home.gif

SHA256 82e60bcbb0e378b47cf29f468e90f9bf380dac0832aa090d01567b4f92a00f6d
MD5 d755d9075bc4e174adc0277569b9ff0f
SHA1 5436346d99061cf9b443db01fd1ce9272d155fb4
SHA512 5b6b26a6b5be6bb5c1e12bfe782c56e55a35da7b7e0c3321d6dfd71c23dac72c1eaddd71809abe05d59b6af8f57303b1c48811e6e41b1e70080443f24bac50ce
MD5 SHA1 SHA512

content/imgs/icon_seperator.png

SHA256 7287f506532fec559c881032d4eb744db6074c5cf6b40f0feb7cfa009f3847ce
MD5 a6746af3a5fd92038b0f143500757455
SHA1 54d558533edf7fbbd94d9874d975679939bd27b5
SHA512 4e885c290023eb3156432fbf55fc2e74e9631b83cd7ef56427538380ce2bb5c46499c0886a66555e90a4834c6cbb11e34842426e5ef60240738f4fb8b3342dce
MD5 SHA1 SHA512

content/imgs/logo.png

SHA256 058a5ef6675191b325a157bd4e168e71f6eb0805781883dd3ea27294248a27a9
MD5 952d34065b6fdbf50e4988bc493ab64e
SHA1 5f41ba1a1d855bc34e05f36b0320491fae45804e
SHA512 a5fdfc5e4af82e7700ca0a921cc2f8975e100217d230d5b6450b52ff555e82fdf9a7ebc90c79285d0aa749dbb754248bc1724539a221510014669c861ca3f60b
MD5 SHA1 SHA512

content/imgs/privecy_16_hot.gif

SHA256 f39738751127030af7f04870ae22120df86355174a0162ec63169b85a0a0b657
MD5 88cf50e9f311da3b28823f47eb8c556b
SHA1 c8eab21735068e31487d150b8a1fbe8a5cbfc291
SHA512 d7ae9ad6a02b8e13e483a5804f83054d67009a883973fc1c139496e8f163fa82879b6f41f811b8697a252c4948da9993a05ea9941665205c056ff46d53fede8d
MD5 SHA1 SHA512

content/imgs/sign.jpg

SHA256 9eb4e18a956eed4d8569e24a25621dc21333f3ccf353351598027d041793d7de
MD5 8ce895aed5dc943d6e5bcd438a1943f3
SHA1 33468cb47e071afa85e8baa2d42a3cdbf4498b8d
SHA512 a5805f35ee3765df86c54093aeadabe0758e90f6df47c2d7cfef9626049f3ec71c943bfcaf75869cca15a00f08ded274460d10fff8bcb076f27cc82dbb4303e0
MD5 SHA1 SHA512

content/imgs/specialoffer.gif

SHA256 cd679ddffd67c55358a483881efd57957664d791e2ddc0726eddb9f29caed8fb
MD5 fdcc9ecdc76728591e16036f89e4c5a5
SHA1 252d700ab476571b68441b90bb702dfd10dd05a0
SHA512 ae1dfd6351527ddab6d572470e928f2ca043857ba385bf78ed6ab87cd7c36a5b709d8762f555fb69f368c07a316f9126935d33fad1a42466ce54043eb7047dd6
MD5 SHA1 SHA512

content/imgs/tellafriend.gif

SHA256 cce0853613b237b4fbe284e485ccc7835db14cdb628c4f1dc7be19b637d5f5bf
MD5 42742d7e90c946ecf4f127f6e7c1ecce
SHA1 ec02244f0bc625ea156e6be8c1e08f2ced107b3a
SHA512 3c7af7b5758175d2bbbe6199d6eba27622530a3e5eb3602aecc74060b7b84a7e027a811c89b9ecc65f0f30c147fbce9245f4e8ec8db28f1a162e4f38084bcc0a
MD5 SHA1 SHA512

content/imgs/uninstall.gif

SHA256 84e1835aa736f6e18a140df111bc4b77a93bb7ac91f9b4e95950454fe28aebb3
MD5 7f738620927255010c91b900ee996bee
SHA1 14897de036f330ad7db59c464638940841a31d52
SHA512 0adc62f09a9be39506cc55196794e6fb03a57b767da5f8740475d7222d7cc93b44f1a938b31fd1974c2df4bb702dd56cef2f6549b1d6bdc329417a76173d527e
MD5 SHA1 SHA512

content/ividi.css

SHA256 20edd110377aa59757e96194104f3a94a116e4d2e8eaec176ed9e5b31b7a37f6
MD5 3d27cf8abda1871ff482a9847c49c54d
SHA1 cdad24fd732ddeb980dc857573e00d8872ae13ed
SHA512 a3bee6796035f2d038a17ceb3c8ee641073602b4b8c667d24a4224e52c2d62d0f02c0b382039444100a99758e5e97c4e7d8d3b9f770f23ad4c321bbbc7afd056
MD5 SHA1 SHA512

content/ividi.xul

SHA256 4b5c8fc8203c1edf0ed2e2bf09dcbf1eae7186cf8e2ac213750b1b4489c48a5e
MD5 041f646f63a4b35159487e8d23792c36
SHA1 8d8464198a529f5ceb8c9c45d8943e77d823805b
SHA512 339308fb11b0d1723ac9fab5f1445f7c1967260cbcce6a0ed6737c2d223eb6ba568e8c48e54babc66569d5c2f61ebcbe2147978a4c0d7230bcfd7a336dcc3f14
MD5 SHA1 SHA512

content/loader.xul

SHA256 4660d79a17aea7f0e4f77a7a1dec1ff8a62d03c21832139bea10ef13cbc7f53d
MD5 ea7318b7fb5e0fd4ba9b5029cfa1b1ec
SHA1 41f3e315789dc82a014fdb84be97d6399f1f9617
SHA512 625e5f66bbbe0866d52d45e8f52e9815062d0d540a44be6973ad4a8fd566bb14ecae09757281cafdd09787c28939903cd18bd5910a79b4cc93c1f981dea9c5bc
MD5 SHA1 SHA512

polyglot

content/mtstart.js

SHA256 728c0f581f70f6d705fe14fe2ac05f28cf682b833362719b2529e6c480972ea7
MD5 32d9799596d57cca88271ae9ee89e5e7
SHA1 60b1f8a1b9e4b48f5c5fb703822eab2327c3a361
SHA512 569970f954b0602da2d9bafa198faec752365758ec7a248c2665d642a108bc0846da5ff6f81ebcb26b4c13b412117d779663b0993f1e155c00659d3ea83a213e
SSDEEP 384:vWvRkn38kp9wYN9nxDbPz5bay1GQh6ebFbXnBB9TLXjnq2i262297swYX1T5qWst:pxp9zxDbPz5bay1GWxpNqWsjioluI
MD5 SHA1 SHA512 SSDEEP

content/serp.js

SHA256 5fcf1902bf3b91c4e752580245651dff67090b3c68e6341881b3eb1e3e93c762
MD5 2ce333cf921024d3a5e7811dd83248c6
SHA1 a734a90921870dbd505ac9cf37dec90da970fb4d
SHA512 7b9993c573e7697eaa3f458adc51ca094c1c5813a0a531212c72b70bc43a9501d9110330e0ca6d9585bfff007eb72fb03fb8c6ac303edaf1ccfbf3b79ca9c2c8
SSDEEP 192:R+i5oW2l7owIWEjefLW0drKvWhdT6V3ZUJUaQ0oIq1qIP:RB5oW2l7eWEjefLPdW+hdT6hZuNQ0oIy
MD5 SHA1 SHA512 SSDEEP

content/tmplt.js

SHA256 fe078bc40ffc977388a1f93d81858e901addbf2239bef51f5fe5f2a29fef5d64
MD5 ae6b7bb925f76c14e06cce500ebbc8ca
SHA1 61630e438c7e659409b2629a78c25bd7d3295184
SHA512 95928919c84c65108f80c587218d568380071f099b93180d1883642cf51873deb740381afa58b1a38cb84641fad1e815b21b0a065f5bdc95e0f7d3c0edb9f62c
SSDEEP 96:ZJpFZ7+xMkgTXM7qp3NDBPFrpR1pvAiz8v9JVXA96wDsdUslRydFkbsqBuu7hqTN:Z3F+MtXMep3xBPFrpbRzzNa5cybExaPC
MD5 SHA1 SHA512 SSDEEP

install.rdf

SHA256 e13bbc1650aa9e1a07c4bffe5a048f74b821bbf183dd897489dbc3fc216c0e13
MD5 71ae8c825b1184cf4f0e4d66f8b01bf0
SHA1 7db0797a2225705ecc637536fe863b2b90f0909a
SHA512 799f5cd87593699bd73e389c31efbe1637ec00ccdd5cba1a6ed2bfe3b56f5965775196e28b7770a348bc9496c9bb875fd723b5e196c8f5817594323d74370ece
MD5 SHA1 SHA512

ividi4ie.exe

IMPHASH 7fa974366048f9c551ef45714595665e
SHA256 19e42855c02278efba771951c712468221e3318984e65c866590899a70e9b8cd
MD5 690df0811fc73ff2219183e5d80d824b
SHA1 a720126932f65de281c6f34c5512be8f787f7161
SHA512 7e5feae85b18b479a014f050a31d276b3a7d82600b1ab62338c371b9093e23e59021973ddb2cd5783247be076b5824f96bb7f05998c5fc26e971307e1cbb49ce
SSDEEP 24576:DBgnLjpToq6ugvVe96DcTwTQCmHAn/QyKkfQBipLfTVfWaOO5XTRdvDk7IEN1s:i976Pq6eUQCmH4/ZKk4QtJXlXTLGt/s
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

NSIS installer

installer

PE Signature issue

Digest

d5:41:4d:3e:5d:d1:66:a7:82:52:7e:02:8d:57:3e:d7:4d:de:3f:57

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

0

Major OS version

4

Entry point

12538

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess GetWindowsDirectoryA SetFileTime GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetTempPathA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/CTB.dll

IMPHASH d1c22339ddec3d9420c4420579fd49e0
SHA256 c5daf522183f0fd2a4e3fed2bc2f0c91161b83b7be243acb0bac3d3a56e22b60
MD5 f38bb01d0a734bb552337c0ea20257f3
SHA1 65ddfc6e23c9430be96a50ae45907aed590771df
SHA512 24273f6fc4765d71807df8cb06707aa796107e77d2cdd6851ddf434dd78e7942d9c11b8df743a3b15665970a5c86fa42dcc917830631e63d386ccb3fddd57fe3
SSDEEP 3072:lvfY9+L2M0De6TFYqHlYRoX8XQnJwDBIUmImSmaTfrHLtTdx70k1MmW4QQ6Sea:5w+L2M0DnKOCeJkBIzImSff7YQQXST
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

81037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindResourceExW GetCurrentProcessId GetCurrentThreadId GetLocalTime CloseHandle CreateFileA GetModuleHandleA GetLastError ReadFile GetFileSize MultiByteToWideChar lstrlenW OutputDebugStringA ExpandEnvironmentStringsA lstrlenA DeleteCriticalSection RaiseException InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement WaitForSingleObject GetTickCount ReleaseMutex FindResourceW CreateMutexA Sleep GetVersionExA GetCurrentProcess GetEnvironmentVariableA SetEnvironmentVariableA GetSystemInfo VirtualAlloc VirtualProtect LoadResource LockResource SizeofResource WideCharToMultiByte CompareStringW SetEndOfFile CreateFileW SetStdHandle WriteConsoleW LoadLibraryW IsValidLocale EnumSystemLocalesA GetProcAddress FreeLibrary LoadLibraryA GetModuleFileNameA GetModuleHandleExA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW HeapCreate FlushFileBuffers SetFilePointer IsProcessorFeaturePresent GetConsoleMode GetConsoleCP WriteFile GetLocaleInfoW GetStartupInfoW GetFileType GetStdHandle SetHandleCount GetTimeZoneInformation SetLastError HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange InterlockedExchange GetStringTypeW InitializeCriticalSection EncodePointer DecodePointer LocalFree GetTimeFormatA GetDateFormatA GetCPInfo GetCommandLineA RtlUnwind GetSystemTimeAsFileTime LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualQuery

user32

GetForegroundWindow EnumWindows IsWindowVisible GetClassNameA SendMessageA GetWindowThreadProcessId SetWindowsHookExA UnhookWindowsHookEx FindWindowExA IsWindow DispatchMessageA TranslateMessage PeekMessageA MsgWaitForMultipleObjects

advapi32

RegSetValueExA RegEnumValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

SHGetSpecialFolderPathA ord165

ole32

CoCreateInstance CoTaskMemFree CoGetClassObject CoRegisterClassObject CoRevokeClassObject

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

shlwapi

PathAppendA SHRegGetValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/CrmAdpt.dll

IMPHASH edf7e39da759ff1376e9d65250751d23
SHA256 83949742ba3d283d1b273dc8264cd1aa076bfcb6c773c2060db3a458760dc40e
MD5 c24d1b746d2bda76ebdeba5cd3c16d3e
SHA1 a727151a54a6ed809f4309af425e73971625c260
SHA512 399f0f76aa2e7cb31788761d69d6b425a2bb395517c40a65c587e99e3375c8f701e92ac721e02d626cee6fc8ad2349809fc66ed497bc1880912334493ac1f03c
SSDEEP 3072:be4cWslN8psmBxfKICTHXrhz+zUkjkfVY8GLO485JB8/CUrG7JTAn:bjcWslNcPzO9JCkfVY8GLO48N85rIs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\ividi\CrmAdpt.pdb

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW OutputDebugStringA IsBadCodePtr GetModuleFileNameA lstrlenW GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpA DeleteCriticalSection InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA Sleep InitializeCriticalSection FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP WideCharToMultiByte LoadLibraryW GetStringTypeW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount ExitProcess LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW GetStdHandle WriteFile HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind GetCommandLineA VirtualQuery GetSystemInfo GetModuleHandleW GetProcAddress VirtualProtect EncodePointer DecodePointer LocalFree InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc SetLastError FlushInstructionCache GetCurrentProcess RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection lstrlenA MultiByteToWideChar GetLastError SetFilePointer HeapDestroy

user32

CallNextHookEx UnregisterClassA IsChild UnhookWindowsHookEx RegisterWindowMessageA SetWindowsHookExA SendMessageA GetParent GetClassNameA GetWindow MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA GetWindowTextLengthA SetWindowTextA BeginPaint EndPaint GetFocus SetFocus GetDlgItem CharNextA RedrawWindow CreateAcceleratorTableA ClientToScreen SetCapture ReleaseCapture InvalidateRgn InvalidateRect GetDesktopWindow DestroyAcceleratorTable PostMessageA CallWindowProcW GetWindowLongW SetWindowLongW IsWindowUnicode GetWindowTextA CallWindowProcA GetWindowLongA DefWindowProcA CreateWindowExA SetWindowLongA DestroyWindow LoadCursorA GetClassInfoExA RegisterClassExA GetClientRect IsRectEmpty SetWindowPos InflateRect DefWindowProcW MoveWindow ShowWindow ReleaseDC FillRect ValidateRect GetSysColor ScreenToClient GetWindowRect GetDC IsWindowVisible IsWindow

gdi32

GetStockObject CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetObjectA GetDeviceCaps DeleteObject CreateSolidBrush

ole32

CoGetClassObject OleRun CoUninitialize CoInitialize OleInitialize OleUninitialize GetRunningObjectTable CreateItemMoniker CLSIDFromString CLSIDFromProgID CoCreateInstance CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject

oleaut32

DispCallFunc SysAllocStringLen VariantInit OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysStringLen SysFreeString SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysStringByteLen

shlwapi

SHRegGetValueA

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/appCntrl.js

SHA256 eb88c6a31536cb82609a0801ce0f38d4ebfd7aa0ba2d564a9068b5a8c8dc5311
MD5 7beaab1c723e9c70afdd947e193dcc2f
SHA1 2314704678ce598fa4037154e74eaeafe06949a5
SHA512 2fbacd228916d98a6af90b2123ddc777589e5b57310311299387e9efc117b668c4c72aa566da93e98be35c5298b7cd3151c7bc8342f86439be11ed2fa147d028
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/bg.html

SHA256 6c6839f84018d949932c48ab6ebf0ad128570c8c4f251f3728ac78324c5c5306
MD5 40e1c432d876b677f885d095de6b0bc7
SHA1 7aa8c5c0b996517fc6b7c97510554db2526288e3
SHA512 3087a61cfdb2ec01aafa460a4fd5605c6a4852c666c4b0fb2f68115892449e41146d8462efd2551aab4e332bc4217024c48fb64da8c616cec1f9e9d986db7ff4
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/bg.js

SHA256 5a57a0a420b569c1aa6580a7ae56ae62eca7a21fd5c529c0abf7800eff61e602
MD5 6fe96f481901dd1c864aa7e8996f5bff
SHA1 f71912195173dc325c3c507142776ff89f5da04a
SHA512 6bd615746a636b5dee10b8c25cf114e298a2912dca3879b0a49458c6da9c19ed69a87c0e8ffbe728404f1d4a8a11e6745bf92572e80e7cfff5f304e88cf37e26
SSDEEP 192:YTx2gkxlX5224FBNfDpfIF9QCv0xIqqGJQYfdz1c2OkwcYow7B8xjZl:Ex2gkx/22kbpfInMxIzGJQB2z
MD5 SHA1 SHA512 SSDEEP

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/ct.js

SHA256 e1214446d1eb25c422352f775fe301569db99b6f095e348dc835f707741cf4a7
MD5 b07d573d9fa44c748041cd62eaf39aac
SHA1 338f00c03c514bfd0f5855212f61540a96a28f45
SHA512 8e23556e671b2ecb4bbba72bf5b1496bbc1de340e2cd430a9455a28527be2bb77996efb9a19f167fde96bffddf29985e155c534130aca4fcd0b8316bed7bb827
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/dpk.js

SHA256 9c997b7015ffbad6624fc6cd058bfbb791bf54bc945e4494c645ab7cc0cd88e8
MD5 9c6a35e570a9d8d91c8d041c15c0d4fb
SHA1 92da7a0d8af8eaa10026fbf6d9a14cb002ddafd2
SHA512 01099b5711a7ac4cf00b186afe8e0a2a8a3212c03ff2470e816fdefb7f88efe387d2fc069dac65917e81a3b2da92e5461d516ac89aa72a505454aba98e42f736
SSDEEP 96:I573TeLrErZA4oZjqFO3CCt6wQnrmIJuXZQqejz6BVJJ4u:I5TqLrErZLodqFO3CCt6dSIAXaWD+u
MD5 SHA1 SHA512 SSDEEP

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/hprtkMsg.htm

SHA256 92ecc99c60d12c9f775e9542876ee943f4dd217231fe559a35b24d41a1eeaca7
MD5 3db5c0c470b371107e46a2303fe3acdf
SHA1 6712234ade55bc960d6bc4d1f990a741d8fa1167
SHA512 2013732628d8b825e34bb76b5ad231fdc356cff9add3610d121bd9475bebdcf27edb33c7e80f8c50b0300b17fe6a39aa06e8d1d3b420e1291879ab115c1d6e4d
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/hprtkMsg.js

SHA256 6d50b2207eea1e1da90da21380ab713bb197c2205d68c7afc6d0b635a1fd2514
MD5 8f877e4d1680f933a9d60598b351e90d
SHA1 40aebb600264bd975801bda40d317cc25e627bc5
SHA512 d16551cb8f57bf90b8015195ff57f3a5e577963d914c7ce37ccdfb348a05a61d926aa68f3ea2f55da72660a94b45ee626ae7ba346dffee918ed536bc20178ba3
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/json2.min.js

SHA256 ce18844ab3dba2c1b0ddb02f829421bedbc038a59f129b94ef9680d54922c4a3
MD5 b3f4ddf609d6f3e02f728f766a1863a2
SHA1 e5d5e6d0f61d4a5726902163a4d60c07b40e13ea
SHA512 93b88588c0ff9b18d3ff4efe418fe0a31338e322df18376fd1592197aaddae3eeaaa5d4fa1b461e7d15afe790204bee3d924e3e0661023d212b4ba027494dee0
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/logo.png

SHA256 058a5ef6675191b325a157bd4e168e71f6eb0805781883dd3ea27294248a27a9
MD5 952d34065b6fdbf50e4988bc493ab64e
SHA1 5f41ba1a1d855bc34e05f36b0320491fae45804e
SHA512 a5fdfc5e4af82e7700ca0a921cc2f8975e100217d230d5b6450b52ff555e82fdf9a7ebc90c79285d0aa749dbb754248bc1724539a221510014669c861ca3f60b
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/manifest.json

SHA256 73b0f6d0705381fa334c8150cc48cc73f957ed3b514f674939a5253be2e913e5
MD5 686d07743b5bf9b6f7a8bb1d7aabbae8
SHA1 737d29b00c87e065ec4682c6b11532fc2076c7b9
SHA512 aa2d4d791e2f3813f3fbd66313208e5d98f211c6f76de24eda5a0c174ef3a96e098dd66639015ee2e99ed58a9f66c2bebc06982909df052e1a5653a305879efa
MD5 SHA1 SHA512

$LOCALAPPDATA/Google/Chrome/User Data/default/extensions/kpdhgpkkloealnjnmepfhanpcleldbef/1.0_0/pref.json

SHA256 6b794cfe87251c7f7c68a6f4e89504129c926a96d2f81778b78be426a30e0e20
MD5 00c01df35386c717a138a41d23389d56
SHA1 8319fd61978d36ac6faa3adab3e7258dd2f2b0ad
SHA512 17f236b00b567b600552a1c57b435a35027a91a725b77837428846d7c474ba6776dccb9f4f08a9b359fed7c97a34d1e1577874338c93306094c7339d2e1d6aae
MD5 SHA1 SHA512

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/Time.dll

IMPHASH 2e3a4d1f132aea64d421c1e936bcc407
SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
MD5 38977533750fe69979b2c2ac801f96e6
SHA1 74643c30cda909e649722ed0c7f267903558e92a
SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5280

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH afa8e526425f3585465337467d0b5909
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4762

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/md5dll.dll

SHA256 fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70
MD5 0745ff646f5af1f1cdd784c06f40fce9
SHA1 bf7eba06020d7154ce4e35f696bec6e6c966287f
SHA512 8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da
SSDEEP 96:GL2PcvGn5olZMTZxEp8agTsflVwn4GogZcko5N1ub:U2Pxn5UZMTZipyaw4ZkKP2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 79653364f46754d144e3c6db81258d8cba965aae5d9d7b66030f7535d761b585
MD5 537a21e0573b7e13469e4b1ac35bd52d
SHA1 ecdc814bde9fec1c909e1907bd2c1bbac4914f54
SHA512 5a7efdd11ac09330cc6257999d670c4cdd97ef1acf5f121278d3811f4439feed745e2e1a04e1fa62abb04ac24b2130fa6e496ef5740d7a11d00f7ad5dd5f30e8
SSDEEP 96:yX4qYlYGflug0Dvxn6GuKM9sh1gdrN9+oB7FT9I4GogZcko5N1:yXMhugRK8hlTZkKP
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/mt.dll

IMPHASH 4ace53f9e1689a9a07327ded8e119e2d
SHA256 069db1a83371dcd2dd28a51def6cef190edcac6bbf35b81b7ee3c52105db210f
MD5 4fae8b7d6c73ca9e5fc4fe8d96c14583
SHA1 10865e388f36174297ec4ecdafd6265b331bfdcd
SHA512 73a5547c6d83227a08e2427f2e5eb6abf429d4b5b7e146fcd59b9fb8c9cc6eb9ff61347a3d46f83d0c7adbaff15e94e70bf40660c217f48e9a46a6e310aaf6b1
SSDEEP 96:Q934+YOERFWe2B1ZVtKW5A8V6dIUTY02J6qCtX:24FdL8vN5AHdIUTRw6dX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\nsis\Release\mtPlug.pdb

$PLUGINSDIR/nsisos.dll

IMPHASH a70233c77fd258ec47709388c2338273
SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
MD5 69806691d649ef1c8703fd9e29231d44
SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
SSDEEP 48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
MD5 SHA1 SHA512 SSDEEP

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

1

Entry point

4424

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

80B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

588B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

156B

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_DISCARDABLE

Name

.edata

Size

96B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

bh/ividi.dll

IMPHASH e64de3a32cd8a3406e888c96c74b8ef5
SHA256 0ae00604bf96832b5220b5e28ca53e5fc5d7b02e6596d9c628c41995901f0142
MD5 89af93b96e140fc33c94dc82a4996366
SHA1 ffdad98417b9e383a128bad3ee7a16bd4e982975
SHA512 fe3fe2f6a2bb02826066f0641b4fd89e9db3debaf02c76da43cc7914af051e00b44b74dab107a4925cfd762b5b176a7b23c88276ab7ec3fc1b22f9d9134f6958
SSDEEP 6144:jNqzL9QVlGZjdOzZpDy6eipMQ/GaqoBSPdiR0br:4zLibGZjdOXy6YQ/GaVBSViC
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

44:d4:70:7b:7d:10:72:86:06:66:0f:51:be:e1:da:ad:59:e8:c2:a5

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

122156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\ividi\escort.pdb

sensapi

IsNetworkAlive

kernel32

InitializeCriticalSectionAndSpinCount DeleteCriticalSection lstrlenA lstrcmpiA GetModuleFileNameA GetModuleHandleW IsDBCSLeadByte InterlockedIncrement InterlockedDecrement FreeLibrary FindResourceA LoadLibraryExA SetThreadLocale GetThreadLocale FlushInstructionCache GetLastError GetCurrentThreadId lstrcpyW SetLastError GetTickCount GetEnvironmentVariableA SetEnvironmentVariableA OutputDebugStringA CloseHandle EnterCriticalSection GetCurrentProcess LeaveCriticalSection GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW TlsSetValue TlsGetValue TlsAlloc TerminateProcess IsDebuggerPresent GetStartupInfoW GetFileType RaiseException InitializeCriticalSection CreateMutexA ReleaseMutex WaitForSingleObject lstrlenW MultiByteToWideChar WideCharToMultiByte GetModuleHandleA GetProcAddress FindResourceExW FindResourceW LoadResource LockResource SizeofResource GetStringTypeW SetUnhandledExceptionFilter SetHandleCount FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP UnhandledExceptionFilter GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualProtect RtlUnwind EncodePointer DecodePointer LocalFree InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent LCMapStringW Sleep HeapCreate ExitProcess IsValidCodePage GetOEMCP GetACP GetCPInfo SetFilePointer LoadLibraryW HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedCompareExchange InterlockedPushEntrySList TlsFree

user32

KillTimer RegisterClassExA DefWindowProcA CharNextA CharNextW GetParent GetFocus SetWindowLongA GetClientRect ShowWindow GetClassInfoExA LoadCursorA MoveWindow GetWindowRect CharLowerBuffA SetTimer GetWindowLongA SetWindowPos UnregisterClassA DispatchMessageA TranslateMessage PeekMessageA MsgWaitForMultipleObjects IsWindow CallWindowProcA CreateWindowExA

advapi32

RegDeleteValueA RegEnumValueA RegQueryValueExA RegQueryInfoKeyA RegEnumKeyExA RegQueryInfoKeyW RegSetValueExA RegDeleteKeyA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

SHGetFileInfoA

ole32

CreateItemMoniker CoTaskMemAlloc CoTaskMemRealloc CoTaskMemFree StringFromGUID2 CoCreateInstance OleRun StringFromCLSID CLSIDFromString GetRunningObjectTable CLSIDFromProgID

oleaut32

SysAllocStringLen VarBstrCmp DispCallFunc VariantCopy VariantInit LoadRegTypeLi SysStringByteLen SysAllocStringByteLen VariantClear VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen GetErrorInfo VarCmp

shlwapi

SHDeleteValueA StrStrIW SHRegGetValueA SHGetValueA

ividi.crx

SHA256 b7948c80fcb6f8dbe3897cce6b2ac8df6d27b6059b9762d76d8da9f02c7312a8
MD5 6748de5fc375ca8b8bae846cff85d9ac
SHA1 ba957336dcdafa19cc52ebeee7126bf04684f9d5
SHA512 a855d547e77ecc744c0c599abe4c34c5e8324e6d585d0a94c9b72df14b8773eef6cd1ff5e813b4d608495841d6f0786de8e1299ad8d24488e527898bf5b30660
SSDEEP 6144:OQgqoDDaC05lYI5UuLh4J+Uph3tKo5MXDZrNWDqG7X0k:OQLbCXT9KZDpNJab
MD5 SHA1 SHA512 SSDEEP

CTB.dll

IMPHASH d1c22339ddec3d9420c4420579fd49e0
SHA256 c5daf522183f0fd2a4e3fed2bc2f0c91161b83b7be243acb0bac3d3a56e22b60
MD5 f38bb01d0a734bb552337c0ea20257f3
SHA1 65ddfc6e23c9430be96a50ae45907aed590771df
SHA512 24273f6fc4765d71807df8cb06707aa796107e77d2cdd6851ddf434dd78e7942d9c11b8df743a3b15665970a5c86fa42dcc917830631e63d386ccb3fddd57fe3
SSDEEP 3072:lvfY9+L2M0De6TFYqHlYRoX8XQnJwDBIUmImSmaTfrHLtTdx70k1MmW4QQ6Sea:5w+L2M0DnKOCeJkBIzImSff7YQQXST
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

81037

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindResourceExW GetCurrentProcessId GetCurrentThreadId GetLocalTime CloseHandle CreateFileA GetModuleHandleA GetLastError ReadFile GetFileSize MultiByteToWideChar lstrlenW OutputDebugStringA ExpandEnvironmentStringsA lstrlenA DeleteCriticalSection RaiseException InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement WaitForSingleObject GetTickCount ReleaseMutex FindResourceW CreateMutexA Sleep GetVersionExA GetCurrentProcess GetEnvironmentVariableA SetEnvironmentVariableA GetSystemInfo VirtualAlloc VirtualProtect LoadResource LockResource SizeofResource WideCharToMultiByte CompareStringW SetEndOfFile CreateFileW SetStdHandle WriteConsoleW LoadLibraryW IsValidLocale EnumSystemLocalesA GetProcAddress FreeLibrary LoadLibraryA GetModuleFileNameA GetModuleHandleExA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW HeapCreate FlushFileBuffers SetFilePointer IsProcessorFeaturePresent GetConsoleMode GetConsoleCP WriteFile GetLocaleInfoW GetStartupInfoW GetFileType GetStdHandle SetHandleCount GetTimeZoneInformation SetLastError HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap EnterCriticalSection LeaveCriticalSection InterlockedCompareExchange InterlockedExchange GetStringTypeW InitializeCriticalSection EncodePointer DecodePointer LocalFree GetTimeFormatA GetDateFormatA GetCPInfo GetCommandLineA RtlUnwind GetSystemTimeAsFileTime LCMapStringW TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleHandleW ExitProcess GetACP GetOEMCP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree VirtualQuery

user32

GetForegroundWindow EnumWindows IsWindowVisible GetClassNameA SendMessageA GetWindowThreadProcessId SetWindowsHookExA UnhookWindowsHookEx FindWindowExA IsWindow DispatchMessageA TranslateMessage PeekMessageA MsgWaitForMultipleObjects

advapi32

RegSetValueExA RegEnumValueA RegQueryValueExA RegOpenKeyExA RegCloseKey RegCreateKeyExA

shell32

SHGetSpecialFolderPathA ord165

ole32

CoCreateInstance CoTaskMemFree CoGetClassObject CoRegisterClassObject CoRevokeClassObject

oleaut32

VariantClear VariantInit SysAllocString SysFreeString

shlwapi

PathAppendA SHRegGetValueA

CrmAdpt.dll

IMPHASH edf7e39da759ff1376e9d65250751d23
SHA256 83949742ba3d283d1b273dc8264cd1aa076bfcb6c773c2060db3a458760dc40e
MD5 c24d1b746d2bda76ebdeba5cd3c16d3e
SHA1 a727151a54a6ed809f4309af425e73971625c260
SHA512 399f0f76aa2e7cb31788761d69d6b425a2bb395517c40a65c587e99e3375c8f701e92ac721e02d626cee6fc8ad2349809fc66ed497bc1880912334493ac1f03c
SSDEEP 3072:be4cWslN8psmBxfKICTHXrhz+zUkjkfVY8GLO485JB8/CUrG7JTAn:bjcWslNcPzO9JCkfVY8GLO48N85rIs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

74469

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\ividi\CrmAdpt.pdb

kernel32

SizeofResource LockResource LoadResource FindResourceW FindResourceExW OutputDebugStringA IsBadCodePtr GetModuleFileNameA lstrlenW GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpA DeleteCriticalSection InitializeCriticalSectionAndSpinCount InterlockedIncrement InterlockedDecrement WaitForSingleObject GetTickCount ReleaseMutex CloseHandle CreateMutexA Sleep InitializeCriticalSection FlushFileBuffers CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP WideCharToMultiByte LoadLibraryW GetStringTypeW GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount ExitProcess LCMapStringW TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GetACP GetCPInfo GetModuleFileNameW GetStdHandle WriteFile HeapCreate IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess RtlUnwind GetCommandLineA VirtualQuery GetSystemInfo GetModuleHandleW GetProcAddress VirtualProtect EncodePointer DecodePointer LocalFree InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc SetLastError FlushInstructionCache GetCurrentProcess RaiseException GetCurrentThreadId LeaveCriticalSection EnterCriticalSection lstrlenA MultiByteToWideChar GetLastError SetFilePointer HeapDestroy

user32

CallNextHookEx UnregisterClassA IsChild UnhookWindowsHookEx RegisterWindowMessageA SetWindowsHookExA SendMessageA GetParent GetClassNameA GetWindow MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA GetWindowTextLengthA SetWindowTextA BeginPaint EndPaint GetFocus SetFocus GetDlgItem CharNextA RedrawWindow CreateAcceleratorTableA ClientToScreen SetCapture ReleaseCapture InvalidateRgn InvalidateRect GetDesktopWindow DestroyAcceleratorTable PostMessageA CallWindowProcW GetWindowLongW SetWindowLongW IsWindowUnicode GetWindowTextA CallWindowProcA GetWindowLongA DefWindowProcA CreateWindowExA SetWindowLongA DestroyWindow LoadCursorA GetClassInfoExA RegisterClassExA GetClientRect IsRectEmpty SetWindowPos InflateRect DefWindowProcW MoveWindow ShowWindow ReleaseDC FillRect ValidateRect GetSysColor ScreenToClient GetWindowRect GetDC IsWindowVisible IsWindow

gdi32

GetStockObject CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetObjectA GetDeviceCaps DeleteObject CreateSolidBrush

ole32

CoGetClassObject OleRun CoUninitialize CoInitialize OleInitialize OleUninitialize GetRunningObjectTable CreateItemMoniker CLSIDFromString CLSIDFromProgID CoCreateInstance CreateStreamOnHGlobal OleLockRunning StringFromGUID2 CoTaskMemAlloc CoRevokeClassObject CoRegisterClassObject

oleaut32

DispCallFunc SysAllocStringLen VariantInit OleCreateFontIndirect LoadTypeLi LoadRegTypeLi SysStringLen SysFreeString SysAllocString VariantClear VariantCopy SysAllocStringByteLen SysStringByteLen

shlwapi

SHRegGetValueA

appCntrl.js

SHA256 eb88c6a31536cb82609a0801ce0f38d4ebfd7aa0ba2d564a9068b5a8c8dc5311
MD5 7beaab1c723e9c70afdd947e193dcc2f
SHA1 2314704678ce598fa4037154e74eaeafe06949a5
SHA512 2fbacd228916d98a6af90b2123ddc777589e5b57310311299387e9efc117b668c4c72aa566da93e98be35c5298b7cd3151c7bc8342f86439be11ed2fa147d028
MD5 SHA1 SHA512

bg.html

SHA256 6c6839f84018d949932c48ab6ebf0ad128570c8c4f251f3728ac78324c5c5306
MD5 40e1c432d876b677f885d095de6b0bc7
SHA1 7aa8c5c0b996517fc6b7c97510554db2526288e3
SHA512 3087a61cfdb2ec01aafa460a4fd5605c6a4852c666c4b0fb2f68115892449e41146d8462efd2551aab4e332bc4217024c48fb64da8c616cec1f9e9d986db7ff4
MD5 SHA1 SHA512

bg.js

SHA256 5a57a0a420b569c1aa6580a7ae56ae62eca7a21fd5c529c0abf7800eff61e602
MD5 6fe96f481901dd1c864aa7e8996f5bff
SHA1 f71912195173dc325c3c507142776ff89f5da04a
SHA512 6bd615746a636b5dee10b8c25cf114e298a2912dca3879b0a49458c6da9c19ed69a87c0e8ffbe728404f1d4a8a11e6745bf92572e80e7cfff5f304e88cf37e26
SSDEEP 192:YTx2gkxlX5224FBNfDpfIF9QCv0xIqqGJQYfdz1c2OkwcYow7B8xjZl:Ex2gkx/22kbpfInMxIzGJQB2z
MD5 SHA1 SHA512 SSDEEP

ct.js

SHA256 e1214446d1eb25c422352f775fe301569db99b6f095e348dc835f707741cf4a7
MD5 b07d573d9fa44c748041cd62eaf39aac
SHA1 338f00c03c514bfd0f5855212f61540a96a28f45
SHA512 8e23556e671b2ecb4bbba72bf5b1496bbc1de340e2cd430a9455a28527be2bb77996efb9a19f167fde96bffddf29985e155c534130aca4fcd0b8316bed7bb827
MD5 SHA1 SHA512

dpk.js

SHA256 9c997b7015ffbad6624fc6cd058bfbb791bf54bc945e4494c645ab7cc0cd88e8
MD5 9c6a35e570a9d8d91c8d041c15c0d4fb
SHA1 92da7a0d8af8eaa10026fbf6d9a14cb002ddafd2
SHA512 01099b5711a7ac4cf00b186afe8e0a2a8a3212c03ff2470e816fdefb7f88efe387d2fc069dac65917e81a3b2da92e5461d516ac89aa72a505454aba98e42f736
SSDEEP 96:I573TeLrErZA4oZjqFO3CCt6wQnrmIJuXZQqejz6BVJJ4u:I5TqLrErZLodqFO3CCt6dSIAXaWD+u
MD5 SHA1 SHA512 SSDEEP

hprtkMsg.htm

SHA256 92ecc99c60d12c9f775e9542876ee943f4dd217231fe559a35b24d41a1eeaca7
MD5 3db5c0c470b371107e46a2303fe3acdf
SHA1 6712234ade55bc960d6bc4d1f990a741d8fa1167
SHA512 2013732628d8b825e34bb76b5ad231fdc356cff9add3610d121bd9475bebdcf27edb33c7e80f8c50b0300b17fe6a39aa06e8d1d3b420e1291879ab115c1d6e4d
MD5 SHA1 SHA512

hprtkMsg.js

SHA256 6d50b2207eea1e1da90da21380ab713bb197c2205d68c7afc6d0b635a1fd2514
MD5 8f877e4d1680f933a9d60598b351e90d
SHA1 40aebb600264bd975801bda40d317cc25e627bc5
SHA512 d16551cb8f57bf90b8015195ff57f3a5e577963d914c7ce37ccdfb348a05a61d926aa68f3ea2f55da72660a94b45ee626ae7ba346dffee918ed536bc20178ba3
MD5 SHA1 SHA512

json2.min.js

SHA256 ce18844ab3dba2c1b0ddb02f829421bedbc038a59f129b94ef9680d54922c4a3
MD5 b3f4ddf609d6f3e02f728f766a1863a2
SHA1 e5d5e6d0f61d4a5726902163a4d60c07b40e13ea
SHA512 93b88588c0ff9b18d3ff4efe418fe0a31338e322df18376fd1592197aaddae3eeaaa5d4fa1b461e7d15afe790204bee3d924e3e0661023d212b4ba027494dee0
MD5 SHA1 SHA512

logo.png

SHA256 058a5ef6675191b325a157bd4e168e71f6eb0805781883dd3ea27294248a27a9
MD5 952d34065b6fdbf50e4988bc493ab64e
SHA1 5f41ba1a1d855bc34e05f36b0320491fae45804e
SHA512 a5fdfc5e4af82e7700ca0a921cc2f8975e100217d230d5b6450b52ff555e82fdf9a7ebc90c79285d0aa749dbb754248bc1724539a221510014669c861ca3f60b
MD5 SHA1 SHA512

manifest.json

SHA256 73b0f6d0705381fa334c8150cc48cc73f957ed3b514f674939a5253be2e913e5
MD5 686d07743b5bf9b6f7a8bb1d7aabbae8
SHA1 737d29b00c87e065ec4682c6b11532fc2076c7b9
SHA512 aa2d4d791e2f3813f3fbd66313208e5d98f211c6f76de24eda5a0c174ef3a96e098dd66639015ee2e99ed58a9f66c2bebc06982909df052e1a5653a305879efa
MD5 SHA1 SHA512

pref.json

SHA256 6b794cfe87251c7f7c68a6f4e89504129c926a96d2f81778b78be426a30e0e20
MD5 00c01df35386c717a138a41d23389d56
SHA1 8319fd61978d36ac6faa3adab3e7258dd2f2b0ad
SHA512 17f236b00b567b600552a1c57b435a35027a91a725b77837428846d7c474ba6776dccb9f4f08a9b359fed7c97a34d1e1577874338c93306094c7339d2e1d6aae
MD5 SHA1 SHA512

ividiApp.dll

IMPHASH 14d54a5c1ffdf56b7c1341d618a7349a
SHA256 2d8ab3f2dfec1393b75e1ba8d12148ab5b5e334d1b071754e08f7087b22cdcc2
MD5 1989cd78346c1f430484236daca1c2cc
SHA1 9d9eaece8fe80dd400a1af12595a5a32e931abfe
SHA512 00aaf06bc2a092ce3d9b8d95e685a9fd0b61a8a5afb23910bdeb43a82bb294f54ce21a05823cdca28aa67b520dfb4091c847f4ae2ea211156441dd3e5a50205a
SSDEEP 6144:wioGux3xaleKJlYg+45eRHUeHivGxz4SxzeFwbhO:EGux3xallbYD2IUeHiuz4Sx3bc
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

e0:b4:35:8b:0c:a5:b9:b1:c2:6a:a7:06:2f:ea:b9:75:67:a2:33:44

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

139343

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

iphlpapi

GetAdaptersInfo

kernel32

lstrlenA MultiByteToWideChar lstrcmpiA lstrlenW GetModuleFileNameA InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection IsDBCSLeadByte GetModuleHandleW FreeLibrary FindResourceA LoadLibraryExA SetThreadLocale GetThreadLocale LoadLibraryA InitializeCriticalSection GetCurrentThreadId GetVolumeInformationA WaitForSingleObject GetTickCount ReleaseMutex SetEvent ResetEvent CloseHandle CreateMutexA CreateEventA FindResourceExW CreateFileA GetModuleHandleA WriteFile SetFilePointer GetFileSize GetVersionExA GetCurrentProcess GetEnvironmentVariableA SetEnvironmentVariableA OutputDebugStringA IsValidCodePage GetOEMCP GetACP GetCPInfo CompareStringW FlushFileBuffers CreateFileW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError RaiseException WideCharToMultiByte ReadFile GetProcAddress Sleep WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP LoadLibraryW GetTimeZoneInformation LCMapStringW GetStringTypeW GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapCreate GetModuleFileNameW GetStdHandle ExitProcess GetSystemTimeAsFileTime GetCommandLineA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind EncodePointer DecodePointer LocalFree FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount IsProcessorFeaturePresent SetLastError TlsFree TlsSetValue TlsGetValue HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap TlsAlloc

user32

CharNextA GetParent MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA KillTimer SetTimer CharNextW

advapi32

RegCreateKeyExA RegEnumValueA RegQueryValueExA RegQueryInfoKeyA RegQueryInfoKeyW RegDeleteValueA RegEnumKeyExA RegSetValueExA RegCloseKey RegDeleteKeyA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA SHGetFileInfoA ord165

ole32

CoCreateInstance CoTaskMemFree StringFromCLSID CLSIDFromProgID OleRun CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoCreateGuid CLSIDFromString

oleaut32

SysStringByteLen SysAllocStringByteLen VarBstrCat RegisterTypeLi UnRegisterTypeLi VarUI4FromStr LoadTypeLi LoadRegTypeLi SysAllocString SysAllocStringLen VariantCopy VariantClear VariantInit SysFreeString VarBstrCmp SysStringLen GetErrorInfo

shlwapi

PathIsURLW PathAppendA StrStrW SHRegGetValueA SHGetValueA

ividiEng.dll

IMPHASH 5aaf4c1e1da3cf76af0ffd0d9e9f39e3
SHA256 eae253b5691720fadd70083ed874b53929287a3d93834a3206f78ddf8fab1201
MD5 8a7e5619cbb2c659b3dd2d9c4a09db98
SHA1 a7eb94c32ca25dc1a9eb461d2d97d48475e010b4
SHA512 14f126006dccead7a344e69e6f21de15bddc6ed30fc248df4043838edd6ed838eae2db0f9ea1204584064a4426d610aeb34f268e37a98f54f274029763a146c1
SSDEEP 12288:7SiUhJF7Aidc0jJMgiEpHgsvpyM1aOa/DNAnDJfJkHwQJIccAqT64I4o96:cPUCpBQan9fJkHwRB6dVQ
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

af:81:97:e0:ad:35:39:ee:a6:3c:ab:47:cd:79:3e:ac:62:3d:a6:f9

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

295301

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\ividi\escortEng.pdb

psapi

GetModuleBaseNameA

sensapi

IsNetworkAlive

kernel32

GetThreadLocale LockResource FindResourceW FindResourceExW GetCurrentProcess CloseHandle WaitForSingleObject FlushInstructionCache GetCurrentThreadId SetLastError CreateFileA CreateThread InitializeCriticalSection GetTickCount InterlockedExchange lstrcmpA MulDiv GlobalUnlock GlobalLock GlobalAlloc LoadLibraryA GetDateFormatA FileTimeToSystemTime Sleep ReleaseMutex SetEvent ResetEvent CreateMutexA CreateEventA GetEnvironmentVariableA SetEnvironmentVariableA WriteFile FileTimeToLocalFileTime GetFileTime OutputDebugStringA MapViewOfFile CreateFileMappingA OpenFileMappingA GetFileSize UnmapViewOfFile ReadFile SetFilePointer HeapDestroy HeapAlloc InitializeCriticalSectionAndSpinCount LeaveCriticalSection CompareStringW SetThreadLocale CreateFileW WriteConsoleW SetStdHandle LoadLibraryW GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetStringTypeW GetTimeZoneInformation GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount GetLocaleInfoW GetModuleFileNameW GetStdHandle IsValidCodePage GetOEMCP GetACP ExitProcess TlsFree TlsSetValue TlsGetValue TlsAlloc HeapCreate TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo LCMapStringW GetTimeFormatA GetCommandLineA GetSystemTimeAsFileTime VirtualQuery GetSystemInfo VirtualProtect RtlUnwind LocalFree DecodePointer EncodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange LoadLibraryExA FindResourceA LoadResource SizeofResource FreeLibrary InterlockedDecrement InterlockedIncrement IsDBCSLeadByte GetModuleHandleW lstrcmpiA lstrlenA GetModuleHandleA GetProcAddress EnterCriticalSection RaiseException MultiByteToWideChar GetModuleFileNameA CreateProcessA lstrlenW WideCharToMultiByte GetLastError FlushFileBuffers HeapFree DeleteCriticalSection CreateDirectoryA GetProcessHeap HeapSize HeapReAlloc

user32

UnregisterClassA SetWindowLongA PostMessageA GetClassInfoExA LoadCursorA CreateWindowExA RegisterClassExA DestroyWindow CharNextA DefWindowProcA GetWindowLongA CallWindowProcA SetWindowTextA GetWindowRect GetClientRect ScreenToClient IsWindowVisible SetTimer CharNextW IsWindow CharUpperBuffA KillTimer MsgWaitForMultipleObjects PeekMessageA TranslateMessage DispatchMessageA FindWindowExA EnumChildWindows GetWindowThreadProcessId SystemParametersInfoA InflateRect SetForegroundWindow GetWindowTextLengthA GetWindowTextA AnimateWindow GetCursorPos OffsetRect ShowWindow RegisterWindowMessageA SendMessageTimeoutA GetCaretBlinkTime CreateAcceleratorTableA SendMessageA GetDesktopWindow SetFocus DestroyAcceleratorTable BeginPaint EndPaint FillRect ReleaseCapture GetClassNameA GetDlgItem SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ClientToScreen SetWindowPos MoveWindow GetSysColor UpdateLayeredWindow CharLowerBuffA GetFocus GetParent GetWindow IsChild

gdi32

CreateCompatibleBitmap OffsetViewportOrgEx GetStockObject CreateSolidBrush GetDeviceCaps BitBlt GetObjectA CreateDIBSection DeleteObject SelectObject DeleteDC CreateCompatibleDC

advapi32

RegQueryValueExA RegEnumValueW RegEnumValueA RegQueryInfoKeyA RegEnumKeyExA RegQueryInfoKeyW RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA

shell32

SHGetFileInfoA SHGetSpecialFolderPathW

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance OleRun CoTaskMemFree CoInitialize CoUninitialize StringFromGUID2 StringFromCLSID CLSIDFromProgID CLSIDFromString OleLockRunning CoGetClassObject CreateStreamOnHGlobal OleInitialize OleUninitialize GetRunningObjectTable CoCreateGuid CreateItemMoniker

oleaut32

GetErrorInfo VariantInit VarCmp SafeArrayCopy SafeArrayDestroy SafeArrayUnlock SafeArrayLock SafeArrayGetVartype SafeArrayGetDim SafeArrayGetUBound SafeArrayGetLBound VarBstrCat DispCallFunc OleCreateFontIndirect VariantCopy SysStringLen SysFreeString VariantClear SysAllocStringByteLen SysStringByteLen SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi VarUI4FromStr VarBstrCmp SysAllocStringLen LoadRegTypeLi

shlwapi

SHRegGetValueA StrCmpIW SHSetValueA SHDeleteValueA SHGetValueA StrToIntExA

gdiplus

GdiplusShutdown

ws2_32

WSAStartup freeaddrinfo getaddrinfo WSASetLastError WSACleanup

ividiTlbr.dll

IMPHASH 6222a1a4c6fbfb4ebf90cae01fa2d06e
SHA256 7838055c1f0aabe6df5b5fb3c6db737936eeee6d2314339082a7586414ae81b2
MD5 57543e6554f60bd4082306d26245bfe5
SHA1 70d4b021173c42dc82d40073fabe7fc0c28ebdde
SHA512 317557cddf5d666c2ed677619d9b98424cadc624e1e31067403ab7646008ce5496687e46fb07b4c61d0aa967bd0b3ac144acc3672c64ed66c1b3dd0d23938399
SSDEEP 3072:OiedPgOLaG/jj56hwlnjDMNOYgHMC4yYC/usWhponshOgHcpoxm3SvQ9U7:OiedYClvoSpMznyYC/usWpons5lSU7
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

PE Signature issue

Digest

77:d8:15:f3:7d:7a:46:05:e9:5d:61:d8:15:75:00:35:3b:03:bc:ab

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

117019

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\svnNew\dvlp\bin\ividi\escorTlbr.pdb

kernel32

FindResourceA LoadLibraryExA SetThreadLocale GetThreadLocale lstrcmpA MulDiv GlobalUnlock GlobalLock GlobalAlloc GetEnvironmentVariableA SetEnvironmentVariableA OutputDebugStringA Sleep IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsGetValue TlsAlloc GetCommandLineA VirtualQuery GetSystemInfo VirtualProtect FreeLibrary GetModuleHandleW InitializeCriticalSection CreateMutexA ReleaseMutex IsDBCSLeadByte WaitForSingleObject FlushFileBuffers CloseHandle CreateFileW WriteConsoleW SetStdHandle GetStringTypeW LCMapStringW GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryW SetLastError InterlockedDecrement WriteFile InterlockedIncrement GetModuleFileNameA lstrlenW GetCurrentProcess FlushInstructionCache lstrcmpiA MultiByteToWideChar lstrlenA GetModuleHandleA GetProcAddress FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection GetLastError RaiseException WideCharToMultiByte GetCurrentThreadId GetSystemTimeAsFileTime DecodePointer GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType SetHandleCount IsValidCodePage GetOEMCP GetACP GetCPInfo EncodePointer RtlUnwind LocalFree HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList InterlockedCompareExchange ExitProcess GetStdHandle GetModuleFileNameW HeapCreate

user32

IsWindowVisible KillTimer SetTimer UnhookWindowsHookEx IsChild SendMessageA CallNextHookEx RegisterWindowMessageA SetWindowsHookExA DestroyWindow SetWindowLongA ShowWindow IsWindow GetClassInfoExA LoadCursorA CharNextA CreateWindowExA RegisterClassExA GetWindowTextLengthA GetWindowTextA SetWindowTextA CreateAcceleratorTableA GetDesktopWindow SetFocus GetFocus DestroyAcceleratorTable FillRect ReleaseCapture GetClassNameA GetDlgItem SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ClientToScreen SetWindowPos MoveWindow GetSysColor CharNextW ScreenToClient GetCursorPos BeginPaint EndPaint GetParent GetWindow MapWindowPoints GetWindowRect CallWindowProcA GetWindowLongA DefWindowProcA UnregisterClassA DispatchMessageA TranslateMessage PeekMessageA MsgWaitForMultipleObjects GetClientRect

gdi32

GetStockObject GetObjectA CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC SelectObject DeleteObject OffsetWindowOrgEx SetWindowOrgEx SetViewportOrgEx

advapi32

RegQueryInfoKeyA RegQueryInfoKeyW RegDeleteValueA RegEnumKeyExA RegSetValueExA RegCloseKey RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA

shell32

SHGetFileInfoA

ole32

CreateItemMoniker CoTaskMemFree StringFromCLSID CoTaskMemAlloc CoTaskMemRealloc StringFromGUID2 CoCreateInstance OleLockRunning CoGetClassObject CLSIDFromProgID CLSIDFromString CreateStreamOnHGlobal OleInitialize OleUninitialize GetRunningObjectTable OleRun

oleaut32

SysAllocString VariantCopy OleCreateFontIndirect SysAllocStringLen RegisterTypeLi UnRegisterTypeLi VarUI4FromStr LoadTypeLi LoadRegTypeLi SysStringLen DispCallFunc VariantInit GetErrorInfo VariantClear SysFreeString

shlwapi

SHRegGetValueA

ividisrv.exe

IMPHASH 75c212979d4f245d52935105103be765
SHA256 1a2c8aff9f309a8c648b6e9b8b921f3bb1e663ab13666d1ae82d9c440849759d
MD5 ccd25f8891ae89da45075a9547297636
SHA1 f4b7c5edcbc1f368ee26c78433ba029fc827378e
SHA512 c5b0f43b1027790eb5419c171a7df5712cd725118edfa26b12346d16f30d4ac571ff467e16ae96868d646316d5563bb4f1c5788fda28e3eabe057f37dc10071f
SSDEEP 6144:KVsHC7Q17/3p2tCKO3IdHEcJAZLi47W+HGpm7l0ZsdvAUdS/VT6O:osH2Q17/3p2EzIdhiLi479HGpm7l0Zss
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

54:7c:31:39:20:21:ef:8a:11:59:5f:7c:31:6b:eb:ee:19:3f:25:53

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Montiera Technologies LTD,O=Montiera Technologies LTD,POSTALCODE=40500,STREET=18\, Amammi st,L=Even Yehuda,ST=Hasharon,C=IL

Chains

Jul 25, 2013

Minor OS version

1

Major OS version

5

Entry point

174407

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\svnNew\dvlp\bin\ividi\esrv.pdb

sensapi

IsNetworkAlive

kernel32

GetTickCount RaiseException EnterCriticalSection LeaveCriticalSection lstrcmpiA OutputDebugStringA IsDBCSLeadByte Sleep CreateThread CreateEventA GetModuleHandleW SetEvent ExitProcess FreeLibrary FindResourceA LoadLibraryExA GetCommandLineA FlushInstructionCache GetCurrentProcess SetLastError LoadLibraryA LocalAlloc LocalFree GetDateFormatA SetFilePointer CreateDirectoryA GetTempPathA MoveFileExA GetTempFileNameA InitializeCriticalSection GlobalUnlock GlobalLock GlobalAlloc lstrcmpA MulDiv ReleaseMutex ResetEvent CreateMutexA GetVersionExA GetEnvironmentVariableA SetEnvironmentVariableA WideCharToMultiByte CompareStringW CreateFileW WriteConsoleW FlushFileBuffers SetStdHandle LoadLibraryW GetConsoleMode GetConsoleCP LCMapStringW GetCurrentProcessId QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW GetStdHandle GetTimeZoneInformation TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter HeapCreate GetSystemTimeAsFileTime GetStartupInfoW HeapSetInformation VirtualQuery GetSystemInfo VirtualProtect GetTimeFormatA RtlUnwind EncodePointer DecodePointer InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent InterlockedPushEntrySList InterlockedCompareExchange GetProcessHeap HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy CloseHandle GetModuleFileNameA GetCurrentThreadId lstrlenA InterlockedIncrement InitializeCriticalSectionAndSpinCount WaitForSingleObject GetFileTime InterlockedDecrement lstrlenW MultiByteToWideChar FileTimeToLocalFileTime GetModuleHandleA GetProcAddress CreateFileA FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection GetLastError FileTimeToSystemTime WriteFile

user32

UnhookWindowsHookEx CallNextHookEx GetDlgItem SetForegroundWindow SetFocus SetWindowsHookExA SetTimer IsWindow SendMessageA KillTimer UnregisterClassA SendInput ShowWindow CharNextA PostThreadMessageA CharUpperA ReleaseCapture LoadIconA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects PeekMessageA GetWindowTextLengthA GetWindowTextA CreateAcceleratorTableA DestroyAcceleratorTable GetDesktopWindow GetFocus GetWindow BeginPaint EndPaint FillRect CharNextW GetClassNameA GetParent IsChild SetCapture RedrawWindow InvalidateRgn InvalidateRect ReleaseDC GetDC ScreenToClient ClientToScreen GetClientRect MoveWindow GetSysColor RegisterWindowMessageA PostQuitMessage CreateWindowExA RegisterClassExA CallWindowProcA GetWindowLongA DefWindowProcA LoadCursorA GetClassInfoExA SetWindowLongA SetWindowTextA DestroyWindow SetWindowPos GetMessageA

gdi32

SelectObject GetStockObject GetObjectA CreateSolidBrush GetDeviceCaps BitBlt CreateCompatibleDC CreateCompatibleBitmap DeleteDC DeleteObject

advapi32

RegQueryValueExA RegEnumValueA RegSetKeySecurity ConvertSidToStringSidA RegQueryInfoKeyA RegQueryInfoKeyW RegDeleteValueA RegEnumKeyExA RegSetValueExA OpenProcessToken RegCloseKey RegDeleteKeyA RegCreateKeyExA RegOpenKeyExA RegGetKeySecurity RegOpenKeyA GetTokenInformation

shell32

SHGetSpecialFolderPathA SHGetSpecialFolderPathW ord165 ShellExecuteA SHGetFileInfoA ShellExecuteExA Shell_NotifyIconA

ole32

CoRegisterClassObject OleInitialize OleUninitialize OleRun CoCreateInstance CLSIDFromProgID CLSIDFromString CoTaskMemFree StringFromCLSID CoTaskMemAlloc CoTaskMemRealloc CoInitialize CoUninitialize CoRevokeClassObject CoGetClassObject StringFromGUID2 CoAddRefServerProcess CoCreateGuid CoReleaseServerProcess CoInitializeEx CreateStreamOnHGlobal OleLockRunning

oleaut32

SysAllocStringByteLen GetErrorInfo SafeArrayGetLBound OleCreateFontIndirect VarBstrCat DispCallFunc RegisterTypeLi UnRegisterTypeLi VarUI4FromStr LoadTypeLi LoadRegTypeLi SysStringByteLen SafeArrayGetVartype SafeArrayCopy SafeArrayDestroy SysAllocStringLen VariantCopy SysAllocString VariantClear VariantInit SysFreeString VarBstrCmp SysStringLen SafeArrayUnlock SafeArrayLock SafeArrayGetDim SafeArrayGetUBound

shlwapi

StrStrW SHSetValueA PathFindExtensionA PathIsURLW StrToIntW PathFindFileNameA PathRenameExtensionA SHGetValueA PathAppendA SHRegGetValueA

uninstall.exe.nsis

SHA256 cf291376af5ebbe6f7128c7a565c6a8f307eaff86eb351863c7c877d0fdca08d
MD5 fb5e3607b71b6446f80b328d116a1258
SHA1 402056c64352851aa739aa5c27b584a481f100ee
SHA512 83b21294351234fcc8d0f6f333c13ff209598b38ff8fc572520ab549b3b1f46a28437c8f821a02162329bb767f4e3c3df010dc88bc404bb6fef35be5165dc2d3
SSDEEP 3072:LDb55m4VOzO+rDO7Q5ZXZZx2otYMNzw6s23bXvqwbhaZr:LDb5hVOzXzrJZvmMtLB3bXLhaJ
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 9ea5bdc8c90dfcffe309465c26c89758
SHA256 416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
MD5 4ccc4a742d4423f2f0ed744fd9c81f63
SHA1 704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA512 790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
SSDEEP 192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7445

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsJSON.dll

SHA256 e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59
MD5 78b913fcd04259634a5e901c616e6074
SHA1 ad5e1c651851a1125bcad79b01ccdcfa45df4799
SHA512 cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5
SSDEEP 192:QTIBadVjvTMEE7bZATR4N65bhztNDcrGu:QkkV/JE7IR865bhTcau
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

ACProtect 1.3x - 1.4x DLL software

Detects file using ACProtect software.
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

32912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

out.upx

SHA256 e2890c196c7f2746da19aee87984b30a0a31019e34f95517f8a34b929451ef99
MD5 44ba57bfbda7ae8d7ebd7b3386c29722
SHA1 2ee636ec6bde1d21ecb26980b91172eff6887cd6
SHA512 69eb0308ad4b509173be85e18999435d16464c0b9f1f8c7301b06daea7d8f2c3fdb1a08e46fe12963d7498555bcfc45cd489e78bfa50c666420b2e731154e44c
SSDEEP 192:SdszDFl1jXOHwUMXVHWUf99hqZWmQBuM4+Oav6HIXDcr:SdIDpOeXVHdFWZWLuR9av5c
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/welcome.bmp

SHA256 51e09f665227bfeef147e1c449da005ebd833ccd346c1a8f99e710fb85c9a105
MD5 2cada2a24071378d4d82ed635f138348
SHA1 b052332e92cb4f268e09e8c193c84b5e563e5e95
SHA512 faff81edfd48db8167900a6229d33d9d3082f649c960acbfdbb142de475e4b47702e6b3bdf14d1b5a7f313038a9fe6046fbeaaa234f3a54b3429f12a59e71cfc
SSDEEP 192:RvQo+q8UROlCksseyghdYk7gN6uej2rxNhiA+e4fvtCE2FOZWKBfnVZ5WqO2NqOB:jt2FrVvRsGYR3
MD5 SHA1 SHA512 SSDEEP

$R9/Plugins/npffividiplg.dll

IMPHASH 4ed3111a5b0f84ef176e0021a95a8442
SHA256 5693147f90eacfb3c59193542da233c6901e5ffd8472a485954c45cbc1993b66
MD5 63b0af5d8fed833d39981c54c988c749
SHA1 b99c8500ca999f5f247666d0680b8938cc6e4dc5
SHA512 d1668e0b8e18ef714705074b9869f151c3799dacd1de5a1e36c9c44d47f93bf9c53775342a6319744d21ecf6803ae7c9dfcf7bc80c7051d565ca837bda8f81a4
SSDEEP 3072:ftgHwDNERgogcETnGVeXPpdl96C83t5g7y4QkFqBSeNZby8Z+A3rOzmFyqWfCsqO:lgHwDNERgogcETyMXl9f+t5g7KkFq0oQ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

22784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Program Files (x86)\Mozilla Firefox\Plugins\npcodeproject.pdb

kernel32

CloseHandle GetPrivateProfileStringA CreateFileW ReadFile GetPrivateProfileIntA GetSystemTimeAsFileTime CreateFileA GetCurrentThreadId DecodePointer GetCommandLineA InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapValidate IsBadReadPtr GetModuleFileNameW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer RaiseException IsProcessorFeaturePresent WideCharToMultiByte LCMapStringW MultiByteToWideChar InterlockedIncrement InterlockedDecrement GetACP GetOEMCP GetCPInfo IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress GetModuleHandleW SetLastError GetLastError ExitProcess SetHandleCount GetStdHandle GetFileType GetStartupInfoW GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId WriteFile HeapAlloc HeapReAlloc HeapSize HeapQueryInformation HeapFree OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode GetStringTypeW SetStdHandle FlushFileBuffers InitializeCriticalSection

user32

DefWindowProcA SetWindowLongA

advapi32

GetUserNameA RegOpenKeyExA RegCreateKeyExA RegQueryValueExA RegSetValueExA RegCloseKey

shell32

SHGetSpecialFolderPathA

IEhelperActiveX.dll

IMPHASH 0927ad8d2957da1ec29577efba787c36
SHA256 fc46747d2a60d5cdbcf3ec583ccf768cd34b712b092b886cadf9ea5fdc274f55
MD5 564bbf6eda61c599b0e1ffe3d7a1318c
SHA1 b858cc368d63f60500a1f266a4c546c303194087
SHA512 f2bc2cbb816d7c3ebe45c6eef472d9a3179099b89f503a015c6eec8a4400822cc851091b70ce2ab5149211a788a3990b8274efd35d36bc09d7eac8bd264c6462
SSDEEP 3072:i2L+efxDrJ1goim90iK7We5pN4ivpbpGtHojB11zLrg:X+6DcNv+oB11z3
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

53784

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCurrentThreadId SetLastError FreeLibrary SizeofResource LoadResource FindResourceA LoadLibraryExA GetModuleHandleA lstrcatA lstrcpyA GetStringTypeW LCMapStringW GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetStartupInfoW GetFileType GlobalAlloc Sleep HeapSize HeapReAlloc HeapDestroy HeapCreate GetModuleFileNameW GetStdHandle WriteFile ExitProcess TerminateProcess IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TlsFree TlsSetValue TlsGetValue TlsAlloc IsValidCodePage GetOEMCP GlobalLock GlobalUnlock MulDiv GetCurrentProcess FlushInstructionCache GetSystemTimeAsFileTime IsDBCSLeadByte GetModuleHandleW GetProcAddress GetModuleFileNameA InterlockedDecrement InterlockedIncrement DisableThreadLibraryCalls lstrlenA lstrcmpiA GetLastError DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection MultiByteToWideChar RaiseException lstrlenW WideCharToMultiByte SetHandleCount GetACP FlushFileBuffers CloseHandle CreateFileW WriteConsoleW SetStdHandle GetConsoleMode GetCPInfo GetCommandLineA EncodePointer DecodePointer RtlUnwind VirtualQuery GetSystemInfo VirtualProtect InterlockedPopEntrySList VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedPushEntrySList GetConsoleCP SetFilePointer LoadLibraryW InitializeCriticalSectionAndSpinCount InterlockedCompareExchange

user32

CreateWindowExA RegisterClassExA InvalidateRect IsWindow GetKeyState GetParent GetFocus UnregisterClassA SetFocus CallWindowProcA BeginPaint GetClientRect EndPaint IntersectRect EqualRect OffsetRect SetWindowRgn SetWindowPos GetDC ReleaseDC LoadCursorA GetClassInfoExA ShowWindow GetWindowLongA SetWindowLongA UnionRect PtInRect DefWindowProcA DestroyWindow CharNextW CharNextA IsChild

gdi32

SetMapMode SetViewportOrgEx DeleteDC CreateDCA CreateMetaFileA SaveDC SetWindowOrgEx SetWindowExtEx RestoreDC CloseMetaFile DeleteMetaFile CreateRectRgnIndirect GetDeviceCaps LPtoDP

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

ole32

CreateOleAdviseHolder CreateDataAdviseHolder OleRegGetMiscStatus OleRegGetUserType OleRegEnumVerbs StringFromGUID2 CoCreateInstance CoTaskMemRealloc CoTaskMemAlloc CoTaskMemFree

oleaut32

OleCreatePropertyFrame LoadRegTypeLi SysStringByteLen SysAllocStringByteLen SysAllocStringLen VariantClear VariantInit VarBstrCat VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysAllocString SysFreeString SysStringLen

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

ividiplg.crx

SHA256 95909264b035947f6885eb3f479b4e8599e86cf03e909748f620b0212f0edad2
MD5 b13251e6bddb1cc5a52b6c120963d20a
SHA1 e5e07061b7732fc62782501dc9622012d3891bae
SHA512 b5aac5b50105008258669cb7e1749dc30d8b0db7ab8481d8acfce8ebb915d7f236affd34180dd396e9c4fd7a8f8f0897f3ca83e73e52f93aa7c932ee9260435c
SSDEEP 3072:EJSTNGp6JUTTajqjhcWuTyF9PeHyJRy93oj1jxUFMtMfDScbC:EsNG0jqLnFSy3y9Yyen
MD5 SHA1 SHA512 SSDEEP

uninst.exe.nsis

SHA256 30293b1c62a66405da346419d15ce122a025619230d6b82c23f419f70ccdad7e
MD5 0dcbd28f98af2a1debe6e253aa1bf639
SHA1 43a51a1983af0edc70f3199c55825be4da200d6f
SHA512 fdb9d29d7e79c48d1896f2e671e15aa790bd053a8caf0a9417ef3272c9aaa52c7d7480ca6b04b408b61aae845e3c2eb854e72b7557e9079e7b27d66e52a7b4fa
SSDEEP 192:oEt7t50Nv17JsZ8uUh3z5yoqc5N6vxpPGMBFI9De9:3tSvPvb3Vyon5g5hpFuDo
MD5 SHA1 SHA512 SSDEEP

Sharing

General

Malware Config

Signatures

File Explorer