dfsetup119[.]exe | Triage™

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack002/$PLUGINSDIR/InetLoad.dll
unpack002/$PLUGINSDIR/MoreInfo_U.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsisProcMgr_U.dll
unpack004/$PLUGINSDIR/InetLoad.dll
unpack004/$PLUGINSDIR/InstallOptions.dll
unpack004/$PLUGINSDIR/MoreInfo_U.dll
unpack004/$PLUGINSDIR/System.dll
unpack004/$PLUGINSDIR/timet.dll
unpack004/$PLUGINSDIR/ymailadv_setup.exe
unpack005/$PLUGINSDIR/System.dll
unpack005/$PLUGINSDIR/nsisProcMgr.dll
unpack005/uninst_ymailadv.exe
unpack006/$PLUGINSDIR/System.dll
unpack006/$PLUGINSDIR/nsisProcMgr.dll
unpack004/$PROGRAMFILES/Yahoo!/Common/unyt_wrap.exe
unpack007/$PLUGINSDIR/System.dll
unpack007/$PROGRAMFILES/Yahoo!/Common/unyt_bs.exe
unpack008/$PLUGINSDIR/InetLoad.dll
unpack008/$PLUGINSDIR/YExecShell.dll
unpack008/$PLUGINSDIR/timet.dll
unpack004/YPUBC.dll
unpack001/Lang/lang-1025.dll
unpack001/Lang/lang-1026.dll
unpack001/Lang/lang-1027.dll
unpack001/Lang/lang-1028.dll
unpack001/Lang/lang-1029.dll
unpack001/Lang/lang-1030.dll
unpack001/Lang/lang-1031.dll
unpack001/Lang/lang-1032.dll
unpack001/Lang/lang-1034.dll
unpack001/Lang/lang-1035.dll
unpack001/Lang/lang-1036.dll
unpack001/Lang/lang-1037.dll
unpack001/Lang/lang-1038.dll
unpack001/Lang/lang-1040.dll
unpack001/Lang/lang-1041.dll
unpack001/Lang/lang-1043.dll
unpack001/Lang/lang-1044.dll
unpack001/Lang/lang-1045.dll
unpack001/Lang/lang-1046.dll
unpack001/Lang/lang-1048.dll
unpack001/Lang/lang-1049.dll
unpack001/Lang/lang-1050.dll
unpack001/Lang/lang-1051.dll
unpack001/Lang/lang-1052.dll
unpack001/Lang/lang-1053.dll
unpack001/Lang/lang-1055.dll
unpack001/Lang/lang-1058.dll
unpack001/Lang/lang-1061.dll
unpack001/Lang/lang-1063.dll
unpack001/Lang/lang-1065.dll
unpack001/Lang/lang-1066.dll
unpack001/Lang/lang-1067.dll
unpack001/Lang/lang-2052.dll
unpack001/Lang/lang-2070.dll
unpack001/Lang/lang-5146.dll
unpack009/$PLUGINSDIR/InstallOptions.dll
unpack009/$PLUGINSDIR/LangDLL.dll
unpack009/$PLUGINSDIR/System.dll

resource
dfsetup119.exe
unpack001/$TEMP/ytb.exe
unpack002/$PLUGINSDIR/YDefUser.dll
unpack002/$PLUGINSDIR/ytb_setup.exe
unpack005/$2
unpack005/YMMAPI.exe
unpack005/YMailAdvisor.exe
unpack005/ymmapi.dll
unpack004/YCAPlugin.dll
unpack004/YMERemote.dll
unpack004/YTAntiSpy.dll
unpack004/YTBM.dll
unpack004/YTMsgr.dll
unpack004/YTNavAssist.dll
unpack004/YTSingleInstance.dll
unpack004/YTabBar.dll
unpack004/inyt.exe
unpack004/pubmod.dll
unpack004/yt.dll
unpack004/ytbb.exe
unpack001/Defraggler.exe
unpack001/Defraggler64.exe
unpack001/df.exe
unpack001/df64.exe
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

dfsetup119.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 a1e3b059be682b13311bfe4289e69d5774fd11ba483347f640df0600740d44e5
MD5 3750b779146a5c8f79f71dc81415838a
SHA1 7464a8604b1371fb844e3fbbaaa1ad063616fb31
SHA512 e3271ae510289d85da53591c8efc4b19a7015f660b0637aac851757ef6139e01aaee7c901119aa0e3a4087ba51f0c2dc956ad255b6cd34ef4c1aabb3a0175460
SSDEEP 98304:shnd/jNez9FZd9ueSP8Pas+1LVt1FaZKMOFDBdc8G:Gd/W9FNueSYah1Zt1cZ6DxG
TLSH
T11D163347A24BD028E49446342DC2CAB7A8B7FC534B49A16FB7DE3BC3DDB8086ED51019
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

46:9b:44:a8:3e:c2:12:10:e1:b2:20:1f:49:11:76:87:2e:0c:e5:cf

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 8773e19ae02f331332db1b00671fdecf
SHA256 e727c8bba6686c4814602f2bc089af4b4cf3498d1dbe1a08d8c4732da5ba046b
MD5 8d8fdad7e153d6b82913f6fdc407d12c
SHA1 aabbeed33cd5221e4cb22aab6e48310df94facfd
SHA512 42bc0ce1aca63904c34025307fd4b1d9f480ae47e42e7dfa48bbbf8286d947de2989435ad7a748951291307949217afeebcd31d10a1356c9366d3187085773a2
SSDEEP 384:0B/JF+HUI+LzlKSYWwgdHEINlWya4LL0Ac9khYLMkIX0+GBxgW+x:WFo72lvYWwgy8Fa4LX
TLSH
T1EC920A02AE592AF7E3651970787C371346AAAE70342154C769F32FCD2829257FA37743
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14335

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free _mbsrchr strtoul memset _mbsstr strtol

kernel32

CloseHandle CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA GetLastError GlobalFree lstrcmpiA DeleteFileA SleepEx SetFilePointer GetTickCount lstrcatA GetFileSize CreateFileA

user32

MessageBoxA GetParent ShowWindow SetWindowLongA GetWindowLongA SetWindowTextA IsWindow GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA SendDlgItemMessageA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/ioFileY.ini

SHA256 21888c505ddefb2088c52d098d5cc2b78bd4b492945a9b7de63e73738861f7dd
MD5 25263491a60490fb1b5fef9a46e75480
SHA1 1a98212c2fbe9966b9b74ad87a65fb22dba758f1
SHA512 0f384c498c304c91124bc0c67d7aa5f2075a5c1609bfebf9c2a103608b4d126dd9c09565a0798040c636ca12c4c817303e4b3db970e78abb84de1674d3f4cc30
TLSH
T16AF030999042C33E8C35A50198DAB2516FF029606F0128F5F3F598C393EDCE19DAF0C9
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 f2d07a76ad7d89e64ee261c81039205e44cd0f496193a25de08eac488874e1e0
MD5 6412e0b095da5095b321d376eb912ca5
SHA1 e93a95c724ba969c656f1cca47595a178176b238
SHA512 f1a32da61b3d219d72256c2fcc5e01923052832b88c86a8ed3efb369e7575c7e54af77fdaa690c03317a64be04c3bfd6b2e16095dfed2e9c6b6ed9af59e57b2e
TLSH
T1C551B53494384868F3D54BE03A01E85CB6F9D4041A755E0363515B7E9C821ACC4BD4F3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 1ea1d0a8b0302840b2ba4743fdef788c93517ac083b7a9da7dd25640251ce061
MD5 bf670074262a7e29da8c0ff2d94c1438
SHA1 5d608a1cb519e5751a4736a6b8e9f3e80477f3e3
SHA512 6c974589ba1e2939e86216078b5ec8bf750346fa77ee81e85a7842aee42cd33f858de9fd2d6837e264f73ab18c1b1d26c4a29336da4e4b41e83c465371c94ca8
SSDEEP 192:7XEVeCHsVXE8EflKJVdzVqWx0AtYDv0SbS5v5VVpvyy99m:rEUCHsVXVHlVqW+tDv0SiRhvf99m
TLSH
T171121997651A601FB04404E46CD20A4E89D485F6DABDFE1AF8E4CCFB74578282AF026E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$TEMP/ytb.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 7ab505da56855344404834de64efa3c3bf396cb051f09f849c5ec24c1dacb0a5
MD5 f0745c1e12ff5179d8452d162fa5369a
SHA1 84ffda6e09fa86dd78d886854f24c1fbef04b257
SHA512 0e6e973993da04451565347e6c4fddf7e677aceb136da3a5c11230ceab082829671b5f711ea6e1447f30da368207b95cdaa974251d9cf56494c007ba1cad10a1
SSDEEP 49152:sLDL9QwXSoBJQX19YDSWWAoL5QnqAHYcFPw3tdq:sLUoUKIbMqoYcC9dq
TLSH
T1B1A533D38587F5CFE6E142B21C35A473806CAF8F1641406F9763BCEDAA7A487E047299
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

19:a7:bd:1b:73:a9:a1:c5:57:20:62:46:e1:99:04:83

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/LICENSE.txt

SHA256 9abe2cf9ea4b01fe7816f6947f46a994055cd6226f550be7a18b406da6c1b39e
MD5 054cb5b226e8147b47a74a74f68f1872
SHA1 519f665624848cda27a13582a223ae461c23cf80
SHA512 ebf3f31e7b6f254d1aa3c74f5688460ad6504285b044ca4aab81b9b76a94fb6df21d8ab6c292da05d2717612efc0d109c859ce1b6b0df8eb7a9e1218c90f7343
SSDEEP 768:sWzJYKfCsCcW0+ib9gPTI7FdBUB+YcF/LuHulFdl/:p9Zf9E0+ib9QT2BUJcq0R/
TLSH
T13313B6AFB34553F30AD103553B07B5C5E72A803CB27EA6507468815D23E6E6C43BB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/manifest.mf

SHA256 67bf77ec98203e6fe06067fbdbace75a7f01a277968df65d9e20685a69096577
MD5 4c71558a9696bdbe9589a765af4756d5
SHA1 1c97e6ee4c3250cb5d1a10d8450bf2d9af790595
SHA512 82bda3db4351bf2dec3f038167520ebbba339121f2b897e2c4196f2ead265e86a55531cc71f2e0417e9aa07488737f41972c71aae768471a23d7ed2b5583e7f3
TLSH
T1FF31A02967581182A2DCE8E20FCA6D172C6C704ED1B1195C6FC04BBC35949B5A1F67F4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.rsa

SHA256 7fffccc42fe76c3472e2458068ce06b8f25e50b8dc0eed7cf40a2db794264d73
MD5 64f10c3f82713b5a13008bca45d17dc8
SHA1 e1eaf9a1604cda8c0a44699ea91bbe738c9f5731
SHA512 64a0bde27834f1f6b53ce0303157e5fd9b657c1cbbd4972240e2ac9d8deb3d24d4f0bb901baa69aaecd8ebdd5020007c541da0a3146bad4e7be0f6dd45ad273c
TLSH
T1F05145E70A0168A5FDE95F51D1DEDA638E71F2946DC071C67070C1596E82BB03BCA14F
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.sf

SHA256 548443f0ac3762381946a2f600d94c0228ea224432d2e96429ff2667988adaf7
MD5 29d957c6a1274fcb0b94aad6305c87e2
SHA1 8298217be598d116d0ff974645538bf6e36be444
SHA512 77e37d9c040659a00540bdd45a8fc1e0d4b04a8b40a7265b417d158862e9d4e0302617cc58397503e79e157a6ab5cddd8dc88d343ce40066524005860470607f
TLSH
T19231CF142A542082A3DCE8E10FCF5C07393C708BD1B1195CAFC44ABC34A5599A5F77F5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/chrome/ytoolbar.jar

SHA256 d83fb9e9d64033c70d58545d507bd9e1fd4b3216ac74feeaba2350a0d3de64f4
MD5 8e4b3bfe7da0d658579be6804a29579e
SHA1 b619c77e1a106d2e64d3a77b5b64b514631366db
SHA512 8db016a7328808d3757a9dc90ad291e9a8e3eb8f8d041d156b1149d5fdafc089c91f9be0a5f8b30eec2dc2052a7c6cc18256bb046f51ff51171f594a5eb62c97
SSDEEP 3072:i7qndLgz26TYk/8pmHSvonEXd53MxYk57LKYzd:i76dLgz2oYtpUSdX07LKYzd
TLSH
T112D3D039F9F678B2E98F9CFB1DB22C10664AC659D4C719D17DA662C88CCE6F0076211C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/cache/about.xul

SHA256 3cbf01d2596d3d611fa917029560ebabc0c94c77de6695e20ba57e98520d938f
MD5 e2870eb1b484f8befe61e2aa18f3b65c
SHA1 c9b01c9ed5540d173e37d1188b325282aec7242e
SHA512 7475d013f7dc84f107afd2991f50b03aca6ba212b0ccdc494c7ffbbb5720c85ece0c640c5b9c030bc454826dda2bb0f09fdb2b2ddb1e1c5d09fb4763c6fd51fc
TLSH
T11431FE6891AEFC6B95F25C9AB2527904A19F2540C64EC5C4B5FF0C6071D8CC2E3387EB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/cache/option.xul

SHA256 d379430b178d2c72f60cb4e66064e1c313f369838ac13a57834e66840af977ec
MD5 976e17e2455d53e509b7a7f67ec79b47
SHA1 7d21f062608ecb7473508ce95ef7c0a43cfb11b7
SHA512 705bd7eff1829177b432c3544c01ae9f14ddc94d3a8b3e4a50da2aacab479337af0c61ce8b3d993f041e90f42b274fc2fd11783198e4624a1f3b9712b2a43aee
TLSH
T1423111557169FB25833349CB33F3890895039B43A30995B6F1FDA9F3209A890B2E724B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/cache/sethp.xul

SHA256 1023dd391ac7896ba53586e7895c3c21049fac217bcca060a196e8f1ff071598
MD5 99632a09f79d2a94627d75612c076bd7
SHA1 c1e4544dedfaf8141075c4ee9963126a73747aa0
SHA512 a5ea95328b83a5b82e957c81cdf25390272bf8a60c06a64f07e5359b1ebdaa2702ae9216a5d4ac8be11cda54df6bc7eeb0070199ec105f30dc948d301f3e36ea
TLSH
T1B041FE95789ED46517A2C9CB7172E850F64BD920D60DEBC0B0FD64F36282BC592AE350
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

content/ytoolbar/cache/uninstall.xul

SHA256 69aef4e34b2f7199ab80356d0fa331e2a7e5fe83da2e3aa754083564e00a7857
MD5 b0d05010605d1e4287daeb40150fef09
SHA1 6c3bb5a6b0b78a09179397a5226e33be0ed93435
SHA512 16356e2dba92c4c30bd84e002de60f22e1e36895838c9888bb45cc3d7340ca42f30d76090efe5c23ef6c058d1d79efa316c9bb2c746b4c94643a9254a4f6e607
TLSH
T1553104D67C8BC8B52F934EEB9172EDD0F6259104865ECA41B4DD70B311C2BD9477A20D
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

content/ytoolbar/contents.rdf

SHA256 374006cfb9851e1a0f81524cf7d36506e3aea7651052dbb53b94d3f3bf30793e
MD5 2fb4ddcaf29dbd115f292c691342f0d6
SHA1 3419f05e3cb3967d733f37417fa80917fbab47b9
SHA512 002b53b4c792102cba54382eb9abb9ceac76f3ce1a3fe866636c05b08d01abc8463b46fa6eb35d40d833c052968991adfaedf92ad2077b6667a9eaab24c4d371
TLSH
T1D8216D1562AB8A6CE27BDDCBA1F178989B075240E0BC04C3788B39B726D2790E74C758
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/dialog.js

SHA256 4e5aef8de1e1d533ce010ce31c462f9f443b8450fda53ccc8340715af116eb55
MD5 d70400ffb5f32c6f436b7e30c5ad1970
SHA1 0724a32cc3a74e4e60687c83855e5a91f5517b55
SHA512 76bbcae2b7f9e437cf7681ae3d0abd8a0740c0152080af706113bea2988d969470cab1aff42cf74e8f3b434a666342a3a10154d158d7ed71d6ae0fa5f1c8bb42
TLSH
T1C57140783B4C837F2AD013288679D699ECFCD431950DE8E1D1AC992B40A4D609AEF6E5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/dialog.xul

SHA256 31569144a328542808ca04ebe516d7f16c212b1e9c675229f81875bf42b800c8
MD5 a6d1d456f2be50aa7747269f3fad47fd
SHA1 7d726e29a3617907708e2c18b1cc576b76c4e0f0
SHA512 2bd0a7431be071b80df19a820b4ee54f6ec707f9c3e5a3e23371b73304be4174a9bfba8c05ed8edf9e627a8d95aba05b40ddc4eb0340d8932281b6c48489dbf5
TLSH
T1A2311622AAEFE57867B3DDCE52B6FC049E48D402527F4585B9DE30E313CA2C9259D604
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/feedFunctions.js

SHA256 f5a52444a68219d125b063ac021244f15bfa2f359bdb82bb37fc0eb444857e74
MD5 f95d072934fc40ad4cee569f00ed66f1
SHA1 3afa9919dab0322fc01693fcb4dc84a5ec60709e
SHA512 c3b1b787a6bb9c3dca63f5846109ee90324f300165008ce0378f97ecf6e537a7539089f763af6f0dd754aa65354af59411a7b80d81ce905e227b5b451b01cd00
SSDEEP 384:gQ04nYwfO71GiqdJ87Migl+wUktjvh7rbHMYL0+lyiT8xDhD06z5ZSZm+wAPNd5+:gQn2IL8B/oZHzLkiT8zpkZ9S7hUdM/n
TLSH
T17F03B669330D226F16E5232846BE34C8EE7CDA71500D84F6BC58E994E4E446DC3EBBB5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/fileio.js

SHA256 b967f565195487e3ce6976fbeedf92cbbd9f212bc5bfefad7fc52112dd567915
MD5 ce97790e485ebe476c74e0c9c5278ade
SHA1 37972b139a787040adcafbded249af8b220e37a3
SHA512 a242f0915da59a67007f4f91954b88972ff7c5226830f5200129ce4a022d9d1356bc5e239518f4d3631c1513681f1406593dd2c88e8cecb434611e255afc8867
SSDEEP 96:vkiCEh7Vu4MfMVIHr952YBglwBPqmkZ5C7YFtJ6Z9Ebt+:vkte7w4z2QYBCwIbs7utJ+ut+
TLSH
T1C7C156AD364D112F07E112A45BBC2847ECADD067492D41F4F1F9966CA4E0E09C3EC7E6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/globals.js

SHA256 f63a635481cd77445d7052703cf556916569b3d846fbce3651dcf5482cbd55a2
MD5 5101baa849b4b4726df8e49869405dca
SHA1 d26d2462501a114585778c113130f3f2598ac0dd
SHA512 81d3bad455c5149968b3edfc4f87eb32f8c1e2579b8019ad2f7cef92ad3c1f79da8714f0964929f54d480581a060825b33427c691b0ac0c14d13333a14946f15
TLSH
T1725102A673905CE7096252200BCF13EF69E5C402584DC26ABC7DF74473EA98FC0B45AA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/history.js

SHA256 54b6122ab0144c35370e42c84ac44590583b94ef20ccb73add66d53bc8c54075
MD5 015adce6b2abac3f1e38501168c3dd31
SHA1 fdb20102aa6ac36e3f954852228a091102c7943b
SHA512 89cfb44a4d0f1c2432c300097ca4e92ec9ba09a4b811062519180521b7fc6fdb0098a922910b3940fa6352eef02f5e5215d960fb2420f91b125db000be68e5ca
SSDEEP 96:gOSFoVHFE8VgiucTtItVx9Im9nRAk+7jXyrrt2d80H1V/ghtyA:gOSoVHFGcETImAk4Xyrrt0861V/utJ
TLSH
T1FBB13283335C502F59FA13280AF671C8FE7DD5B2A90A60F4B0F86CA8E6E4D1193E5675
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/i18n.js

SHA256 6a34b9965e82b6b3808498336d5e208622fdc1af6628825579d51b7dc0377cd0
MD5 0346d7c367761d96bde9354d97da3f0e
SHA1 e2de654d6eb3989f9cc09f95e1fbe18b4ab76984
SHA512 7e3e4ffb0673ff1e9275fa48eb20f7a956154d9a9b76bc5eb638b3ef4a3cd621a8ac2b5cf78e46b63c945677a149fd11b60f8de8ec3e8845cfd7c41dd0b0cb30
TLSH
T1A7F00CEB300A80375298258790F6698CFCF8EE30473FACF9F480A04A9424C3D22FD284
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/installerVariables.js

SHA256 030eb8eb073f0a1e81e24e53925c760c5ebb3c41f24eeb2c0237ee85875c6bf1
MD5 b9221e098729435e47a169c5809edec1
SHA1 5c3feec55ba5dc583d826453f70f165f503664ca
SHA512 65f18e629c64001621ae0434e8cccd588b48424837092087245453457e42dc0d81f24ac67b6777d6af13e57923f10b2b3ce9cff386235a101c7642ef868e9a4d
TLSH
T1C3E0480C4B31B1F2B3A2A3BF47939C248014B272605D647519F353450757919F0808FB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/network.js

SHA256 94b709bfb3edd15281fbd34398357710dc6864bb08fc36223675223251531236
MD5 e93c0d2fdb46f417203dbdac78167c2a
SHA1 5bc82b03fd9e886f947fca32d3da9ffb560cd4fe
SHA512 5f3dae338adae08c2db179bb2458efc17fc4df3b3bf3ddd4721abd296806e372ec5727d653b65b4d470719ce118b599a1a75605aa39810adc62f626fe00c8a01
TLSH
T13F5142EDB72C610B06D42046437E2614EDBDF8E1571D84E1B516E989E898A24F2FC7D1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/options.js

SHA256 384b41fc1aaf4854ebc5252d2b171c87031c19504705d2a7d58b09511be9d2e9
MD5 bdb6d9e09b0cf1981181017c361b88c2
SHA1 c3ddae4f9236d2754b9660ffc1ace7915625e355
SHA512 bfd45b2773cfc40643ce643906a249395794e8c75d36065df4ea8fdebe47e8b0a4d85d3256bf2838920bfdbdc927ab71ee18f43eb06cb30ec92223822230105c
SSDEEP 96:gV54Ch9LQxwc4EUWkF71sGAZssa6CjsstLfGqpXJls/DHxrN8RGALIlA2pP0:gViChQwcm7q7ZZa/jZRZU/DnAZ2pc
TLSH
T179D1339B72D8113B47FB12B9047C6459ED78CD21951FE8D164B88D9884B8E24D3DBFB0
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/setHomepage.js

SHA256 566032ea3b7a7f94ef750df96027ef62a974d27fe25749f87240d2375e791086
MD5 89f33cca146d786ae3c2722de8b01ae4
SHA1 d5ee5ca7301bb63313930178a83727925755e939
SHA512 ed26c0b8fe5aec832a5cdd2ee49f471ca4a8ed05a786900ef802f2fa51b62dd2bef003847df2b3233bfcbbe04ff6ef9f28452cd1ed06e9afe929084ecbf39a2f
SSDEEP 192:gAabDHZSAFtpDocsZzFSOZ2UL1GdXKHWdXKQgctulAr:gdbDHZSaOTGdGWdDr
TLSH
T114F1B973324A01760EF52360657868D9FC9AC030D99EE461B27CD005A560EAEF3DB7D9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/toolbarBuilder.js

SHA256 16e6dd88c7a2c2fccceec7bfd76917ac5ead431f91fb1ad2ee72676a134daaa1
MD5 519d19d54d592de7e6113ea25626916f
SHA1 335a1e4c8f0728605435f6574a24ce2d3ff0d692
SHA512 fc5afc11d3a2ed5eb922ac9d7ffca33cd6fd03c68a0a6d25a47240daf2adb546cb0d168ec30e4420c43513fd711e5b8025fb0d1d8338737d046d5f9f92c6b4ce
SSDEEP 384:gELap5tkE3rN5JN2edPbuP0wzudddRze+qUCExAheoIk/xHIPN:gELfE7N5JpdTAjGcUCEx0IsdCN
TLSH
T1A7B2637A33AD437F1AAB231855F85198EE2CC430471FA4F1787CB59D50E8CA093EA6E5
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/trackinginterfaces.js

SHA256 943c364d44bddf5e5099c5f082f8b6dcc41dfd0d79cec62a05c74c725128bcd0
MD5 9d88c536b21028d97620923d57e3dfcb
SHA1 7ebb9f0d22a660e7294ef9bede7e1f5106109b22
SHA512 7813b8bcdde0693e7cceda6e7c99f12fd70c9742afa25e3ed6e715cd87c6ad3ae01c511e6ff60585b81ab6fa5d8fdcceba013eb005a9cb5b47493be30fa0f176
TLSH
T17171C91E72AC322F6B70116490BE4944DF7CEDB6135908F1A670B8CA84F5534E3DAF99
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/uninstall.js

SHA256 284df705e02141e26abfe81074136d87e7a24b794cd1b7269242504b254afa24
MD5 f1977cf9df4bd5ca58cabbaad43eb94f
SHA1 cb3e7ab6acdd5bffa58814201b8185a0230a875f
SHA512 7bdf666bad4053ed4ba520d7df58233db33b24088748ff9a826117093e34af41a40ccd530bf905ed48d1d25939ca6bb3227da7442ec1ff6a69047c46e3e11902
TLSH
T15A515216779D157F2DA50306C57B24F0D7ACD230616D62E07AFA247880EEAA853CF753
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/yahoo.xml

SHA256 92c7134ba4ba04325505f0fdc33d03855988983de836a15c6fd7458c973785f9
MD5 2cfb3677538cf1ef166b7d5df17cc021
SHA1 8026e5b7070d8dd499d7fa78edf8b4ecad2603f1
SHA512 ca4dd5f190da2ea3578e8cf610e7a713c72cedf186dc25cd8d9dc9e04ebc8f2e6b6e8e3102811a97e1c1011c93bd09fc51817b16bb169d5cb1323b59f1141c00
SSDEEP 768:LPPzrVV7ar9SNicTYc1XjIhREtYEtzY+BrC:L4cTYcNjOEtYEtc+B2
TLSH
T10FC245A6338C492705FA01AE0D70A484FC7FDC36E51A29DA7DAD58EB9764801C3EA734
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

content/ytoolbar/ylib.js

SHA256 0111c96631eea1bdf33f491bcefd17e3e7dc214e0d35013175f1958d18ce33de
MD5 aa181cc8124a1a278e68f9710bf64cbc
SHA1 41b5918bfc2f7bf75711c32a357fe16cc5ab6005
SHA512 59cf35fbcc9ac218d5cb4fe5481028468889127d4d79b00f6a930a8361243e7f722540f7a89c36458ff391e22047f87163e820e7b940376874eef6a435da87f0
SSDEEP 192:g4UuRc8Xy930F07yURuJklmAxucYZtA0yctzOvHj:g4UMXy9WCyxJZbKj
TLSH
T136E1B695388D211B43E0331056793AA19CFDF6A127EE60F8E5B8A696D1E0C1BC3F479C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/yprefs.js

SHA256 f6528ef9d505cda294b8b8782e48bb1280ee7926e93081201a41abbcac445f16
MD5 3849af84a42a14c642b730dc0a430a2f
SHA1 51fb007e53233dc0912c12e92b608afcc356c943
SHA512 09f27f7011f820bfa8decd208e33d77b0096ebd2ee8b3d9d93741bd601a7fbeeba264f9fd6796ed79180d6319cebef37f18390dde53b6dfce98b4b1aaadd8fc4
TLSH
T10631F26A734C10E5215047194CB211E9D87CE128087FA0E066E1DC16D1CEF99CBEAFDB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/yrss.js

SHA256 38f2d9515e2da433e0960289f2bb0162a8f015e409671b8bf893a6f44442f6e7
MD5 f7199f98ec3bc803f6ecfb3043a4320f
SHA1 f78f6efdb8aac9979888bfc6423d3a2fbdd3813c
SHA512 a4c8818071e045e71780dccc6502eeb66f466489cfc5295b93f5b6fd33e2bb1864f028016b4251d9cba4fd000ab1dbd8a19bfa8c2480b7c426bcdd5d2567d042
SSDEEP 192:gj5sn8dfDzUwcqGdEkblEiILirGLA2jhigDT4/cfODZ5ttO/YuN:gQmrRcqGd7lEiIL5A2jhiGk/FHluN
TLSH
T1B80243AA321C226F7F963310CEB991C4DD7CD530854EA4B4FC9CD98940A0E7096FE6E9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/ysearch-history.rdf

SHA256 e4316745ec77dd283ec07ae0e3f701ded3d641b96d1d835f8b0107f03a1bbb34
MD5 d706b22a4d25fd75d402a9b639966910
SHA1 77fa8c588d9dfd6709d938f594aca0d9fcc45479
SHA512 dc43b906131eda10526af96f9f98d5dde8fa5a29fb26eaf8db7c30fab40daaccb272b78a2fe8e8d85e27ec704176e5df02bb7c8a342d8e109aa654e03895c32a
TLSH
T1E671D92A09828DB4C9F779891CE5849598900385E37D1D08F0EAF9370F77BD6D36F86A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

content/ytoolbar/ytoolbarOverlay.js

SHA256 17ebab4baf7a2c52ef72730da2cd801030dfde1c39e696d097f49fd589ab9b7d
MD5 329ccd9f052e6a94efc11bc28bc77d21
SHA1 cf0dee446a35858d94ad6e5c6fc6918ea2990492
SHA512 34c1ac8cb7a4aba3f9ce6e6bc226f0631b95c3a6e45203399a560ddaa4ec6e6944bb2e99b1bb6fdde672b314fca8196a066ed945965af001abd9b681892fa779
SSDEEP 768:gorQIMLQm0q2ZVMeP6wZ32ygvVkmhh4VrObxtvqJHPQ/:JEYm0q2nMf64Vkmh4VrObxtvqJvQ/
TLSH
T1FEE29439335C017B1BA2235959FD2058DE7DC032052EA4F1B5BDA458A3ECE58D3DBBA2
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

content/ytoolbar/ytoolbarOverlay.xul

SHA256 c1496c5f3bf34fe00cffb05b35f5ece8b42ae11d533ce9234b6e106a8dc15c4b
MD5 f54c814c7d6ff4341719a996e17d065b
SHA1 27de67b8f85a7099669e65141ed6cd78868175ba
SHA512 9eb4fb9c45975dcfe05b342762096586f1d0d316b185ecdd2cc9acb5841daee8da0c7d3d9de6343b5ecef0af6d91a07fb9b1de642f6524b65ad203847628bed7
SSDEEP 192:w7Wnck6xiFCgBGwzReCiabpyOap6+Hpw+T8GSDiyg6mpHVRTv:ws8ab/+m+/hyg6iRD
TLSH
T164627804FAFCA0352B3F568F52B6ACB067AEE9B1615E44E4BD3E3DD293CD1982358114
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

locale/de/ytoolbar/contents.rdf

SHA256 4c4e75f6b89895f557d38f3bf7e70ae7083b0b14b88b7a0f458390e6499eeda0
MD5 963f72fab88d39237d8e1fcd599d7455
SHA1 1b8d14d277872172cf21779be1896eeaac3d971d
SHA512 2fbaf650934d1205708a422f12ad05d96e2679a23b02816dd3b72efac2332a12b01c41f43276daecabaa72292b9da20e762df4a1b13d806d8d0fe886c10ef74c
TLSH
T1B9012B4005829E14E13A4CC16EF04454DB1223A7E06E185DBD4E79236FB6B9681EF5DA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/de/ytoolbar/ytoolbar.dtd

SHA256 35084f1aca6bfabd047f78ea22b194d0dc342b901fa68c61144f07dc2b2061e1
MD5 f183a7613e2c7eba77602d0f64ea8e1a
SHA1 607520be893878a444049ff6a92134ff0113ef7d
SHA512 d8f9761e9f1a5c09b497a1ad66c7a2dc7394754ec8be2228a9332047be9f61e7fe80c4a2a0e3d62de6da752aa2def7dffe0d44d45fa8bb384dfdbd89cb9a00c5
SSDEEP 96:JLWLgxL5mV/1BlpMRdZK+cq8QUrc+8UNpYxp6xNdlw:J8OL5a5Mh6Q0X76p6xq
TLSH
T1F9F1E90ED1E298B22B17440EA4906C34B93D456485BE48F68E7FBAC5E5F9CECBB4D134
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/de/ytoolbar/ytoolbar.properties

SHA256 1fc3a3c5b5f978c7aedb5b730d39c320aa8cfa9b94fb710df8a9ab734f88f8e0
MD5 104cf9fd261ce1f8f86b58e7cf389e66
SHA1 2ab05b2abc844996c66f2f63e5c0a8126a44bb86
SHA512 e94112a75c9cd0369427f2ceb832ab52c9c0db7fbddf8bcefe48d67dad62297ae5341fd13165582403df1f8f0a6955b98c32771da3a5a07312e1bd326619e46d
TLSH
T1E5F0788F2E93F487B7258472A8052E3030E0AA800A7820E076F1E0B526206DCDF9B1F1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/en-UK/ytoolbar/contents.rdf

SHA256 c59c9a851f383e2af8d6ed7ffa6f073249bc54b048a04149f23a5bbc7f6d87da
MD5 36d24f54c51eea4c12d0865b8031fd4d
SHA1 6b80ded645cf26a53e07d3f6c35b0585bef1bc3f
SHA512 cd813964640f5a15881c9189acc4a5ab3881261ee89a95bdb29c5b1dca397965ee73e5dc273078e5dd2ed769d8858f65f38fc710de6fbfd744f6294007ea0a6a
TLSH
T10A012B0006828E15A5370CC16EE00489DB1213E7E06E1C9DF99E79235F36B4A81EF5DF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/en-UK/ytoolbar/ytoolbar.dtd

SHA256 a65762bdc86084c728e22e699aa6834c0a9aa22dca49ea0a4bbc9c97128c5839
MD5 f542f444eaa581186d05c9df6b673574
SHA1 aed39b283d00e965aa2846437a0b90e9f4da9857
SHA512 014cf3619113cdf9276d9bc5ce89f74ed675c7bfc86db2c2d29245738abb6a4b87524739e32bc8ad8ed94ae685d7df37e83bb454bf1edb0390fcf0b8806571b5
SSDEEP 96:IRUTLpmwhEom979gm+aezASldWw2sXI92s2C:IRUvpmwh0w4W6XH
TLSH
T1C8E11E0FE1A18CB22F17452E64D03CB8B11D05A445E649F28A7EBAC6FEF94EC5B4D134
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/en-UK/ytoolbar/ytoolbar.properties

SHA256 224351896700cc7e2821feae43fdeddfcfa2776bdf669d1ab8cfe51c663e8322
MD5 101bc484aed61b63602170e5146fa472
SHA1 a2af125ed198b176994b08ed3acf841ffda44d44
SHA512 6b064d309153e53376e9264d2e26784d65ffb3e0891c6a9badf2d5026964eb83f19505d37782ea3053742325b5eb582e28078e091c07b74b75a0a1f4a11b544c
TLSH
T19BF08B2F6E79C4D378669135A8103E3071F0CB50192871E078FBE0A41530AD9DBFB1B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/en-US/ytoolbar/contents.rdf

SHA256 64cc875462acc164dafdfd00ab5a3a7eecfcc18a708742847b7d2a04456c0881
MD5 4607db47783d298cba04ef8602db2fcc
SHA1 526b4d350de6ff4a962aa534e8cbdfc0f7905e26
SHA512 f540bbbb9903740076121b96ae6381fc07fa52c375643dca9c1edb5b24c0e5e81b9bb00f6a06b62c425df0db5a2f35718a4fe942c553d206e93c52e1e206be95
TLSH
T1EA01F75186839E14B5370CC16EE04449DB1213E7E06E1C5DF98E7A235F36B4681EF5DB
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/en-US/ytoolbar/ytoolbar.dtd

SHA256 a311a9774f96d6e0715f098017caf445f608c055632d8a7b38052d689f023ac7
MD5 93e9ac9e40411001763ea414a194f24d
SHA1 fa8d65206dbfee972cdb2b2d3773dc0fff3c229b
SHA512 f45de3eef0e0b9cd3946ec0ffbe6e7cbe2fe2102e34f44fa74c74a6239f072f9980c5b1eaa25ad7ec59bb6b8e952069fbadea35e9328501dde30b48142aed978
SSDEEP 96:IRUTLpmwhEom979g1+sPhUYk0xQH7T192l2C:IRUvpmwh0VKhUYdy1m
TLSH
T13CE11E0FA1E188B26F17442EA4D03CB4B21D45A445E649F68B7EBAC6FDF84EC5B4D134
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/en-US/ytoolbar/ytoolbar.properties

SHA256 df9e6764e8c17a80fc0e760e1518f43ce1be0e5bc339eb0088f21184ac5d1e90
MD5 017fd3c6ef49b0854c474c28acac72af
SHA1 e8f552faafbe7254f06906ba273652042a3f64c9
SHA512 455699d86ca9818ad83af1ecd2f2d052bb4acab30dccc1a251c415152f51f866667f12ade09cc96326945b2616ad42e805b4886d57e1300e266fef7fade56a1d
TLSH
T114F08B2F6E79C09378669175A8103E3071F0CB50192C71E078FBE0A41530ADCDBB71B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/es/ytoolbar/contents.rdf

SHA256 e6db041a372c90e11b9ba874967f4d7dfede75d1af6869385af55853326afa05
MD5 588b086a13238dad9a61c57eec52bde0
SHA1 565b7ee7fc731042eae66fa0477d1cc2a53e0ec2
SHA512 fbcb4b898c6385ef4e466020dc72f632923edbf06d10944bda7e7fb74443b90a727bb557f1b39ba7fee47eb08bf94c9030c1c43830ca5d81b2e46ce891c32a7f
TLSH
T17E014E0146838E14A1360CC16EF04444DB1607E7E06E185DBD4EBA235F37B4782DF6DE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/es/ytoolbar/ytoolbar.dtd

SHA256 8aa9b5836a923d13f33daa4af4a3e3d9a319f307a05b5c8b17a26a8135027ed7
MD5 5f68e91a3cf4e9a5ac63d96227cf110d
SHA1 5d07ddcdcb58eb40c7ba092981ae05f1d8c60628
SHA512 27f7dbb6ded0b147d5f383a4ebfa91d5ff71668eb3a91d02d34c7e68804e5ec2ee1b529b9e394941a5f3eeea3ad011908ef89d5eea32c95c91a237154aeb04bb
SSDEEP 96:IRzOc1zCneYxXOe0+wzO9i7R2rUNbbN+3gbfJ:IRpzK9Og8O4zN4W
TLSH
T1B6E12C0F91E298F23F17402E64902C74B55D45A088E588F68B7FBAC6FAF84EC9B4D535
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/es/ytoolbar/ytoolbar.properties

SHA256 b3337ba7672bdb26fb66e8f2b6b29813f1549d098f26e603d981bf1b21547c2b
MD5 0c29c76655afe382bd6d3b61383a456f
SHA1 351b07eb0269f6d330dcd52b28ad245f105cd625
SHA512 94b73036c984f2c949e414441eb17d9882694b935a7695070b5dd861746ef75d7b60af2192b7810f81cafc4a9767274274980a0c495e6c0176d4ccc86da513e3
TLSH
T149F0464F6DF6C49378B59176A9012E30B1B08A91592871E179FAE1A45830BCCEBA71B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/fr/ytoolbar/contents.rdf

SHA256 d34f06473c1caf46b27a3743524e94e3ee97f033c294e1d4ebede30a0d8e77e2
MD5 5e244a459a3dcda84add38c6491ad88d
SHA1 c1e757c66af069d402d5b435028c83001b477a93
SHA512 0ba40aafc94fa081a0e30e61235e68f417f024686b1aa239ffe9013e2416a658031bbbaad218f453e11166726e781e06fbd4db2d2f1815190497ffbcd2f4a568
TLSH
T13001F70006828E59A13A4CC16EE14454DB1223A7E06E185DBD4EA9235F76B8682EF5DA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/fr/ytoolbar/ytoolbar.dtd

SHA256 2af90b3902645000a23573aaaf3dd6625ee1d780a33a81e6ab72ea1e70ad45c2
MD5 daa05076ad5eb33e314ba7a2023fd391
SHA1 9ff39f82fbf163349ff908979322d973112ebd57
SHA512 fb64bc6753cf50e0c9cf10cc81e754f7be559f35650bea8b9627e9c0a873f7b42ce49d819a740d1a2716bfa72775375d1d933df52bc72270f847b7e488a50881
SSDEEP 192:J8zrK3zzDUXKvtLrKGPbwOeL/KB9V1dCd5xzJstgNabnK4wbsTrL:JA+wkJTrL
TLSH
T1EFE1C81FA1A288B22F27440E65D03C34A97D45A045BE48F68E7FBAC4E5F5CECBB49134
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/fr/ytoolbar/ytoolbar.properties

SHA256 baa906a1cc0697945ed449b88e7d07507ec0edb08d0e5e0907d565e14474c94e
MD5 2b6caa725abba5ab1147c756c52ccb7b
SHA1 ffa33e8c27291e0806675b7aec7b1129b4e85f1d
SHA512 34a3a5dbceb09e342c4970086d0192a0873658860bad2c76b1bbb1733505cc38d047b2ecc38ca85caa5673e9a45af9c5833347362d817524f6b5582341d8f514
TLSH
T167F07D1B7A7594A779629035AD106F2020E08A40956930D079F2D1F85530BC9CB972B5
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/kr/ytoolbar/contents.rdf

SHA256 23aa94e2f8913d105def016016e8ddb1dc4220eba14db3dfce45616466ccf042
MD5 75dfa7225c08350502c5c2e497434643
SHA1 3b8964b3248710201631f515ba430e1f4a275756
SHA512 c5f27d679ef3616e62d18345beb1d539a87f566bd21a66c5c11a7f6972d0304ca18d7d0b74bc8037a1c65638792e7d0c7b2f51473132b9e6f3ea0817a8b3096b
TLSH
T139017B1009828E18A1368CC16EF14444DF122397E06E1C5EB94EB9235F32B8682EFADE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/kr/ytoolbar/ytoolbar.dtd

SHA256 11892f40c2cf893ad5655c8d777e84943ae3203c6113236ef94e9c4c4a0e7554
MD5 e84d3dd60e752c65c46194830ed935ae
SHA1 49412ee07073e29c4a0ebc3d3f16f052f8e8c458
SHA512 61664a0524a492df97b3b9bcfa71a5ac1c577879ee93c469b043096b994b24f5073bd860a26ad6195eb46f0aa336939d8a81e8c7ce68f3bccce90abee17859de
SSDEEP 96:IRgFMdlyStDt3UhR94bjE+Q9EmgLbtG8VTTRZvP:IRgudlyStx2R94v92EmgLbtpHP
TLSH
T106E12E1FA1E288B62F17442EA4D02CF8B21D45A055E648F28E7EBEC6EDB44FC5B4D534
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/kr/ytoolbar/ytoolbar.properties

SHA256 fdcb1873f463af51efc1be5e38912f08aae0184620b35ce25c2cccf20cd36646
MD5 6f5289c309a3058416b472bfc7a94321
SHA1 0209a58f102b4e5bde0497fe56292d8db228e971
SHA512 67eb012c04cccad97967e34a9fd40e042cc26d0e50c279d99c502433132b1422e79bd0a7c586ecf5ba7a8dbaba5485a4bd58bbe49c2c97ee359278a525c7325c
TLSH
T12A01706F68F7D0CB7A92543265013B1461F1AA50676A30E079F2CCB855306CCC793376
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/zh-HK/ytoolbar/contents.rdf

SHA256 9677fb014e00b6ab1220f63c1f3482c3066288e68f1c61f76cddc431aa722e14
MD5 b93cb66b2e00047cecea108830aa79b9
SHA1 10ce2cf6a302df7f851221d4e4a8a097af3d8220
SHA512 54277ea9c3d296b74a426d19e9adaeb4645958ccd018e4e4d43119609a7992bcb6c4a2f2b0cbf1a2b07985f4985aad42dfbb7d5c3263a547e95f0bd16d176392
TLSH
T1EC017B800A429E15E13B0CC27EE10445DF12039BF06E485DB94EA9234F37B8781EF6DE
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/zh-HK/ytoolbar/ytoolbar.dtd

SHA256 a86c959c4233f043250064852e7f6e06301593f7cf7eec1012ac326f9ff3a9b2
MD5 8ef032bae8d719bf98010716bbfb82fb
SHA1 098dc379ab85a727494442cbc6b97abfe8d335c9
SHA512 13db4bedd8e131a670f505f518d5c8dc28dd1fb3672a0e39bbec3f5a798a8171294f2a99e3be275120c76ee709ab851c1f05f03fe829663edc70648cae8ae231
SSDEEP 96:IRBPl4KUzv5kE+PTYUu5N+1UWt60ZkeE92s2FSk:IRBPiKUzxkp7YUAIjt3DE9k
TLSH
T11BE11D0FD1A288B23F13442EA4903CB8B15D856544E658F68B7EBAC6FDF84EC9B4D534
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/zh-HK/ytoolbar/ytoolbar.properties

SHA256 3da3d05af2bf782684b66a45ff06dbed9c913b12722953d298eb0ffa9243bac4
MD5 f46c7c19ecd3619b32b463d851856c4e
SHA1 f6427c861125172d970fdd9f89787caa57aa0139
SHA512 7b3f1d6b41abbf8a8a32a2441f914c56b0049276cf467584215cf094b462ceb9c0a80f0e1d7d949bf7724d70b6cc037c8e5130f933be3a6e48bf405cce9633be
TLSH
T11EF0289F2E67E9937A629131E5012F3430B0DB50186D34E134F6D5A45960BC8D7F32B4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/zt-TW/ytoolbar/contents.rdf

SHA256 99f54b49805d601da41ab4e2cf9bb9496d7d2cb54a87c14a6c15fa426f8c1633
MD5 4f2bab2adf3131f79ca215d5ac07816d
SHA1 6eb837f14db745eb72bcb22dbf3657c6b57bed1e
SHA512 7c65b6c050499293877208339cb311027d44b583138228420e0ca4fe355c027a6e04424561451ad807961724201fc1bcd86aba1d4707cf95fbed78e8967e8f3a
TLSH
T14201701009568D18A5364CC27EF14444DF1513A7E06E1C5DB94E75235F32B86C2EF5DA
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

locale/zt-TW/ytoolbar/ytoolbar.dtd

SHA256 5de54810ca9224266e6ad3b509f2cd27ae4a7153b886e89ee53bfadf82aa6c52
MD5 168782c07421ea1356ad9e307e4d68ea
SHA1 daf0f8bdd092f4c7bb2ff88b45a79964918c2bcc
SHA512 365dfa58ee6a82f61e443c9ac41f3806f0e89d01cc56f9814fca497de81743fb2bcfa25db16c4b292b4c739a48b915bdbbf50936e985583dedcbbf1bd5b6d9a7
SSDEEP 96:IR7Sbx/AUEUix04CTxUxs5o+RDNai9ts+8mdshNP:IR72AUuxHAxUkRRxl9r8mKhNP
TLSH
T1CAE12B0FE1A298B23F17442EA4902CB4B15D45A544E648F28B7FBEC6FDB84EC9B5D134
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

locale/zt-TW/ytoolbar/ytoolbar.properties

SHA256 251aa7c204341f2234828e42e6c9e79bb51847ae5c0097d4ba531ffa79d4b0ca
MD5 98beb9e68741652da3a32a3e19b83b2b
SHA1 839fdd56888edd48a8307f39d96eb0c51df67af8
SHA512 80cd4b49c872ef166a0bce3d478054d5decd22aa4bc0903cfeb91f76ad5919294db69abd8dedda8531b1469670954301aafcb71c7109ad707db29bb662821260
TLSH
T19CF022AF6E67E89339519232A5012F3470E0DB50186934E135F298A84820BC8D7E3270
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/05c.gif

SHA256 f65edb9dd9fb9bc59783337c9e2506a86aceaf0363839f3b9febceca5fe3201c
MD5 47820fb5ae2e31a3988c61049734f528
SHA1 1f5e2ff3d761d9ed21fa3c122fa062ab0590da69
SHA512 5427aa2b33d1255c55a83eda85b67604b2ffc351a267749befb8fe4de55b28a00a67b2ff7e9bb4461f2feab671011130ffb4bd57b98e5a18d0a64e79a9c40a38
TLSH
T1EF1173141638D898CFADACF5D48D068C219CEA4D3472F9DB0C4154B69A2C5ADC8BEB9A
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/07c.gif

SHA256 70d488852e309147ef788cc6d49256abdb5f3dbc0294ae9663fcd0a545a17a39
MD5 271f5d6a73b045c5da52cf89ea5c5ec1
SHA1 2aaaa0990f9482ce79a91dda02e445feb58ec0e9
SHA512 06545418bbfc84f3d7f5abd27e866229fe84dc1d300d87262ef5e35b7e230e13a3b14e218ac6c9042d4a5fdfc15aa07cbe0cd98fb3d3feb3eb2939ac2ebe9da3
TLSH
T1B21152551738D8A88FADACF5C48D058C219CED492471F9871C01B47A95391EDC8BEF66
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/08c.gif

SHA256 0b1caf5c22e01225d7be02abec1b7c44e30eee5408a387fa055f36e966c57d0f
MD5 f9b42b6e608295f2ae326be501b6ea64
SHA1 7268766511708a9b399f43ba1501dee2580fd711
SHA512 295b6df87684d962d279351ea4d4ff68eb162fddbeee82e14c4d91509ef23aa291f9f8df57fa2378d874328cbd7bdca25b0d8bb97cbb732bff0bb6d683b1bdd9
TLSH
T129117314063DE898CFADA8F5C48D068C219CF6592472FDCB181145768A2D5EDC8BEB96
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/11c.gif

SHA256 b3f0f9db2f69f0222ccb9eeaafa682662e2717c6e2d0f34c02a5ec4bcfdfd414
MD5 e440e7030b83f6f1e771a0d8b9d3a1e8
SHA1 c5e280cbd4ba31c3b66ed470317af3916b687569
SHA512 d56819bfdd75464af4752bd73e4181bcb2cc478144ec33bc8e3edb8390b70ab067509f2b67469ae2a2effa0f544ff6f753b965d79dffe5def911647f2e90fdb8
TLSH
T157E02B4ED9947674CF06B7FFC05E43E11E57E60485C6A41A1B3D3B4660388E964B6518
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/18c.gif

SHA256 4c2d0862c7ed7a6ea9b058b3197bcfabd49cd360df5a589718b22f3b3ab97d11
MD5 ebfea8e18ffd0f60b5cd87f11785395d
SHA1 21a978171baae5c90bd6d408aa88c337a406e01a
SHA512 4aed3574d818835965a3c099e1e4d8f1a1179b447be8648fe75b3de75c4019782c2e5bc6435748f9eee03e18b46d60c8db39697d01548cdba8c2e89d196f963b
TLSH
T1D9E07DD690E28079D271D0F6051B7260306275873D08B2913839C5896ACB47B0024171
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/19c.gif

SHA256 57bc42ec1ee2d81988639e73e79a935c9244f73b4348f468ad161fb226636ba1
MD5 9dff1a9c9fbbfbcc48fa41f023b662ec
SHA1 9decd2540a2a843dfc22e9c3013ebffb4ffc12a4
SHA512 22f0986a1a97da806bef49af2cc9219e6f59049461da86ab29c95234f387b6834e97d765ffbca1f688e46134ed938ebd8e676420a2770471abd5f8b7a231b348
TLSH
T149E0EBC60AE1ECA9C24006F0CECD8084628E9B3ADB28E30C34E1A7C90A7016ECA19C84
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/50c.gif

SHA256 70f5c899c0a3ce8f27ab436f05bdcd5ca6d0287af4f51f7150b4cfa4593ecabc
MD5 a6d69c2341e265d8b96e6a8c1cc7312d
SHA1 d4b062d068df648810456f775bec880e29241751
SHA512 6d43f22438224379745ef5d4dad1b28ab521a3a3b49d767ec59a3f85fa65b1bbe2dabf2f205b1822ebfee97284be88f0bdb08eaa2362bfae2b002fbfeb26ef41
TLSH
T1A3C0C000F15BD00CC35420304E2CCD0202301F17C606DF67B7142F0F31243002431004
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/52c.gif

SHA256 1e18a3a94951862b54fe3f7c8bfd6793a2ee29ec788f7c736263dbe26f4c9503
MD5 af4f83ca3bc8b1b4b8d886a9e729d0a1
SHA1 cc9dbd3aac082c841e579526b4ca739eeb98856d
SHA512 521f525ddcaf15117c77f52dce3bf0dd3908457323d69c2caa6fbed4c5169e3e18362e421104020b258c695b789cfa9040ee4ec0acd59c8c89242a83a3b73323
TLSH
T1FAD09741E040E020C229803EDC8C6D4A94895ADB60D8E008A1D133278513AA11824A54
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/MY-ff-plus.gif

SHA256 2a53232674221831084b23ca6fc250bd8527640522f5059a29cfadcd38fdd9cb
MD5 fc6733a8bb03a9310b96c32097e9389a
SHA1 c5b9ad0eac7ba1c4a5a1612c16cb59010dcda56f
SHA512 8f6c5620448a2863267144093fd657d8fd4fa1020b4ee1776478d4f9878fe420a688af750a0b1510eb9f287b02ebad5c45f5bd9100fc508247dcbf4ae1f3f72c
TLSH
T1DEC02B26E313CAB8F74200301EB4D980010C0FFCC3B8529A533035086228A651532B5C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/Thumbs.db

SHA256 5c1b58a5f846055ef159d71092856ae21b93b5295007382ded6273ad280fd1c3
MD5 4a769bde0845f7707f248fb4971676ae
SHA1 07f3b01e0fed65bd527470cb65368dc6b6262f89
SHA512 5078489b53ce7a0aa4644dfb559a8dde7b812022e6c9113deb96b322f2e6ce71bbdfceaa0d6bb862be10aafbd91c3c3398fed9a7354a524e899868f5e99c0de6
SSDEEP 384:5HqBk1PS3cCxfxd1SzPwQteBRKnmh6T4/X0:JSk1PS3cCxD1SzZt0ROY6TI0
TLSH
T172B2A52A7B4257D0FC2786FA99159D52D2EDFE427DD0270B3AE077EAC530EC89448A4C
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

skin/classic/ytoolbar/chevron.gif

SHA256 e4d3142285919c89231b43f82246db29572515dfa6750605909e4e58f0ed9174
MD5 ad83ff0bfece86e8bf751de431a580b3
SHA1 6d0397d7a7cf6eff9e3c80c80fc1c907519fdef8
SHA512 72bb46a8a8496f483e9bbda65e6e98e27209be33b5b852734c2d1abc6288aeeafa2566197f2c669e5bbbf251d1de3f646389eb04b4160f812432d7a86b7942fb
TLSH
T1CC900444FDD0D014C1115330CDF717543D0D5104DF0413031457100C5CD47735303057
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/contents.rdf

SHA256 acafbc34f9fe4240be6b47573267d0b05a86ab2530fe3e119a897bbd3d633b8a
MD5 194f7d8ab22f0fdf655e6d4d25d92ab0
SHA1 a1fdd4c50ab67ab85f700601e0f0128c95384824
SHA512 4400cac27fd1f09ba61d5fe0fbd3421cf5d5682ca7d82bcf05f035ad23c78cb83915f207e30d6b5bfb7078b953c86829ac5973ac129b80496e109926f536b85e
TLSH
T12E213D1202C69C34E5364CCB6AD414D5EF036367C0A81445BD6E266B5FFB752826F6EC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ed.gif

SHA256 baca550ecf0adacd12ba2a664d6a1f260f13503161e1c766ac2460c3e95ff510
MD5 bd4b12fe1d494903d3f776cfc27079ae
SHA1 bf91acd9314d8cb8c768642de145ca300ba5c26d
SHA512 35d16d49878ded8a3b9b0d6dd580e42e7df5ac95e0f2a97323fdf8dc11fbceaf4a02f434804820e56192c0580a7f6def6f7d19de755b035e6e6dea28dd460bf5
TLSH
T143C02B3AE070C030CF1D4434005E6C043703F5402100B65CBEB8431A184011B2011E61
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/logo.gif

SHA256 0edb9e51d303efac9219c473fad8e9db268659c37d2e2581f93b93284913f236
MD5 8a632151ebca8b2c9709c3afec1282c8
SHA1 b5e9b36ac38b9552f106916094d5f0d2d6519bf9
SHA512 e2e5bb617afedf7bc0be7e5d017736eff0761dbcce7bb6be0e254a9b4e7d63790d36b98431e004930d65268bfa2f95903d2a520436a18a5e405a2b7409ef6bcd
TLSH
T1FBC0C0005408C030C024413C0C3DB201205030A3C8109517E97CE3CD509D31C0106556
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/mno2.gif

SHA256 71fce619ea2aeceb0e2430d136cb75ae4ab8f2178bb6d6d0242bc0b380ed88b0
MD5 5e390f6136038d68b8abc7a69dffbd93
SHA1 39fce2076947370ccc76b679add27e9613e26723
SHA512 05b64cc0990e37d3ffe4fbe0722b2ecd0727714802a643682d245646485e810783308c353a3937959b5981a5c17162d4a390b7593a7d2ed94180e5ca9c19d939
TLSH
T156F05470E9318BBDCACFA2F1E848614491A5EACB44155E903D953ED704D1627C54831C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/my.gif

SHA256 a5a0171f98a79e0754150343b9e55bb0fe85ea96efbf7723a63fa2e000cfe58a
MD5 05c4c898db20d8fb246ef1bea3c179b2
SHA1 ffbdaff86c93d2833067c5d58b4d21f453fa9fb4
SHA512 be95c3c15dd1e2a663b3749d57e7a0b613c690a1c182e90740077be2ad147163e3f181090a2a5fe68e09279b86daf5edbadcdfb466155bef95900307bace2567
TLSH
T1A0D02347B378DC55C51CC03D48C59763245B75ECC7CE327537D1526D851D5670431C94
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/new3.gif

SHA256 ef1565d54eff058bf1a88c26d851c584145e1d682a38807c9dd4a84429662eb2
MD5 3b5aafac577427fe8ea7c7e65677cfda
SHA1 823e70aea2315313e3455089455857bdf80222cd
SHA512 3c2e1173c70d8ce4b1bf740ffcdb3c253b7ac34176521735b07fdcab03ffc7e4eb3cd15b92c3f85aafa333e0ea95abb457e6766ffefe55b7250663a3c5283707
TLSH
T181B012614FECCE00DC62E2269D463648323DD42283014662073F1CD9F3031530DA600D
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/option.gif

SHA256 baca550ecf0adacd12ba2a664d6a1f260f13503161e1c766ac2460c3e95ff510
MD5 bd4b12fe1d494903d3f776cfc27079ae
SHA1 bf91acd9314d8cb8c768642de145ca300ba5c26d
SHA512 35d16d49878ded8a3b9b0d6dd580e42e7df5ac95e0f2a97323fdf8dc11fbceaf4a02f434804820e56192c0580a7f6def6f7d19de755b035e6e6dea28dd460bf5
TLSH
T143C02B3AE070C030CF1D4434005E6C043703F5402100B65CBEB8431A184011B2011E61
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/slider.gif

SHA256 5f992054571692247a16823c408e80b925d8b8db1966e6afafefb5c918ca1f5b
MD5 8838499dd2b5fe061cbe7b2ad26e3503
SHA1 e6a3358eefb2ebd0b0102577dfbcd180ad6ad58b
SHA512 89c0c61030a1a1a6100183996a463c369be6162029a9c75ddb39b00c2903d9bf33bb67aa59b10c2f002f66e165b8c1c8a9d4dc67f7edd501872dd14fec2a02fd
TLSH
T140A0110280A8F0C0820E38BB0A08CE2032B0A800A2A08883A8BC8A38202A2AA200F000
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/tot.gif

SHA256 e07cae3fdb9f961901265f44c2592303f1b16fa46f7b86cdc79852f6f61e3dae
MD5 1e7c125ae9cb0b0cfa8bd51692b0a590
SHA1 a53ac2bfbe29c8a53ce160aeca0ef93b4fe105bd
SHA512 e8c9b075ed66551e386d5b67e3138b7356c9d584ab656d614059060fec43377c273262a461dec3139f0c8633572560eeb0fbea01fa546054a712293cf9e08e71
TLSH
T1F6B01212C35AC239E1045430970CC18C6840207F29508680FF9D6F0D7C140121551415
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/yahooicon.png

SHA256 0c441c3d8d437098b6340a209e6b60bdf97b0c59f993d442cc0db2e969c346cc
MD5 b83ae46c0bb5d55c44849c69930935e8
SHA1 401afc141ced31ae52175b8b8a1f9d825112ba21
SHA512 583e2054a681ccc48e831e2863e612c7a027197c82aafa4c94fc6e23aa2227c42f3182d20584cdd6d4e818715376e39056195a17ef97e035a8154bf7a684d17d
SSDEEP 768:IBhzUKJEyYpZ5iEicNxBdUR8/D2lwW8y9WvHOJX3nn5vKmKw:ehz/kZ5iUxL1/DGWvHMH5vvKw
TLSH
T1D3D2E013BA87D61DECED917DD8C46AD46387D89FCB73C8850537800DC988E2B4EE6616
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

skin/classic/ytoolbar/yma1.gif

SHA256 4bb0a9ebc97fe793cf9adb0c85fa3d30181dfbdd43719d58f401065f093a92aa
MD5 6e78ea49c2e9c1ecac056ecf51ac94f5
SHA1 b89385706392419e2e608ed2a6b95f0173c257e9
SHA512 3e8f3ded1baf0d6ba5c3cc2feacb8ff3370f83fd70ecb692ded0b4cd87362487ba1ec067ccd8b5acc89eea74209124ece6651cafa7a94e3c61968fd1fec78c87
TLSH
T124F060A770E2E43DF53F8AFE1CAC47C00281B9C1AA3D61A72C3BE3E35C24810521011C
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.css

SHA256 eac285d43e4807bc0d59c148a82d9312bcbe15bdbcb8e82f5949b40644870e25
MD5 319c5d48086ed4fbeee409c789ad20b3
SHA1 7b57893d45726ec9983e50ae5cf8aeb14a653d8e
SHA512 67553017bb6a4c731110b4f1c626c42538dddf99450874ba1046b4d672bfb2dc857f6f7d0d9ec7db7241fd6fc55b8b510963350a0ef34fac27464147c3fe0241
SSDEEP 48:glMOGwS/61YCiz9Vz24SXSuSVSwS2SoOM5K9+NOdcExvDzZeGByEAsz1jDt1Saot:gWVwS/uYvKuK6sZeGBAS1jDt1Saot
TLSH
T139816CCFB0F3D23A4F57462D82E7AA106F9E2A506E8B64D63CB170D410DD59C938B52E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-de

SHA256 1fc3a3c5b5f978c7aedb5b730d39c320aa8cfa9b94fb710df8a9ab734f88f8e0
MD5 104cf9fd261ce1f8f86b58e7cf389e66
SHA1 2ab05b2abc844996c66f2f63e5c0a8126a44bb86
SHA512 e94112a75c9cd0369427f2ceb832ab52c9c0db7fbddf8bcefe48d67dad62297ae5341fd13165582403df1f8f0a6955b98c32771da3a5a07312e1bd326619e46d
TLSH
T1E5F0788F2E93F487B7258472A8052E3030E0AA800A7820E076F1E0B526206DCDF9B1F1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-es

SHA256 b3337ba7672bdb26fb66e8f2b6b29813f1549d098f26e603d981bf1b21547c2b
MD5 0c29c76655afe382bd6d3b61383a456f
SHA1 351b07eb0269f6d330dcd52b28ad245f105cd625
SHA512 94b73036c984f2c949e414441eb17d9882694b935a7695070b5dd861746ef75d7b60af2192b7810f81cafc4a9767274274980a0c495e6c0176d4ccc86da513e3
TLSH
T149F0464F6DF6C49378B59176A9012E30B1B08A91592871E179FAE1A45830BCCEBA71B1
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-fr

SHA256 5503b3acec066dfe50d7bf621ea4911cd824592078d61ef0464aef24ceddf194
MD5 09ad660d7a18b89d5a7a9408c1c63b70
SHA1 52a65defcd8f97b79208b9d0a9033f1a395e1c45
SHA512 b8dae7d210857cdbd122db9e4e046837578f0b64e48e8d093e4a1950b532418fc2bc2217532b47c7ae7a6430b92822b55022e147ccd1641a26849b80befb4d87
TLSH
T18BF0A21F7B6590A37D62903A69016F2070E09F80956930D079F2D1F81530FC9DB972B4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-hk

SHA256 809b9c65643fa20ca0d0836511c6bc32da80be8f0b6791cec0dfa5ed73d6e1c4
MD5 72bd04435b0b9b361a386c37b72d7e6c
SHA1 9905f4a915cccff9705dd7c0408239b9cc8585f4
SHA512 036427a7d0f095062027419689ac680c7d6d7e06839d99ef1f3dfc0e919a7887042571c8302ac5c83a6202be2bbc938fb88fd1a6316cf15f516be0380f723615
TLSH
T1E8F0289F2967A8933A629132E5422F2470A0EB60586830E178F2D5E45960BC8E7F61B4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-kr

SHA256 fdcb1873f463af51efc1be5e38912f08aae0184620b35ce25c2cccf20cd36646
MD5 6f5289c309a3058416b472bfc7a94321
SHA1 0209a58f102b4e5bde0497fe56292d8db228e971
SHA512 67eb012c04cccad97967e34a9fd40e042cc26d0e50c279d99c502433132b1422e79bd0a7c586ecf5ba7a8dbaba5485a4bd58bbe49c2c97ee359278a525c7325c
TLSH
T12A01706F68F7D0CB7A92543265013B1461F1AA50676A30E079F2CCB855306CCC793376
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-tw

SHA256 feb5d2f3d292ce1f0219ab67073ac83ed358af1360cc59307aaa4454345233b6
MD5 8e1e5c8e9db7ae1084cf68d4aaa26afe
SHA1 5aeacbd19fafbff9af272d5613b5f5f018f0063c
SHA512 7f32b680e4859ef8918130e3561fc847aecb43e58fe2f051df0e51c3c2109006ec3825711cc47c34754a16435765f1b8de4d4957b85d45632fe455c43c399e86
TLSH
T1F8F0229F6E67D8D33561C133A5412F2470A0EB5018A820E175F2D9A84820BC9E7A7274
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-uk

SHA256 9e107d0e98f8bab20e489cdcd2f08f3b8fe19e92f975c32eda8236f536c0bd95
MD5 5bf3d8a5c27e3c8cbf68f809542c37a1
SHA1 4696aa87bbc573d9f917ac4eccf35c8ce8230d3f
SHA512 78150063f9f8b545552296e3afe3de105fc21b246cb33130eeb18f105104904c84b7299f3ff2ab834588a627455d565e07ad23e11ee00c43a08344d70ad8a7cc
TLSH
T1BCF08B1F6EBAC4933CA59176A8013E2471F08B90192875E178FAE1A41530ACDD7B71B0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

skin/classic/ytoolbar/ytoolbar.properties-us

SHA256 7348407d59f0c7c82e05e6a6332403db227dc396e5c0248f1b7cecbe69489955
MD5 a6f6ccbf493990fd4461ac597a8ede95
SHA1 aeca3d922b075d094764237218b7302f3b1c33cc
SHA512 89ef87e06e4cf731744f7c4db9cc60917ec149649ccf6efd38071efc9606481a627a1e333fc8493d9b633a4b6b018ad203b119575ca5a7b272636d8e8398e1b4
TLSH
T1C0F08B1F2EBAC4933CA59175A8113E3071F09B90192871E178FAE1A41530ACCD7B71B0
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.js

SHA256 146c9d3cfe74e1700eda4d81e798d9b1401117405898cd4b50fee172062d3510
MD5 a6e0d3856b8effa0075519d616df29b3
SHA1 39ac6d2a143284bf034299efc76993209bf865bc
SHA512 8ed85c305bd94d144927c4834d7d8b4a1b18c45613c88d9a2a966bc751f34b6f803b3d2d75de929c1f854792428ed7fcd04bdad6f683e3ea137195b7521c8843
SSDEEP 384:gTR+KvLCu7lasXrXi7UZPW5QgYIDNjx2nSowakzZYco:gTR+KvLT7las7Sh5QgYCZakzk
TLSH
T1AAE293BB736D323F2AA41156A97565D0FCAED132810B94F9B89EECD9C15CC8803F4978
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooDomBuilder.xpt

SHA256 70f0db3db23024c874c2c167bacedd0950801676dd909891799cc9f8c1fc7778
MD5 c2e224bc167beaddda73a844ba153173
SHA1 3ffd6085ff5bc3899de90a4b74a8af0516ef1de5
SHA512 153d1e4cd05882b04d34566c334a99ef0e7d32afa7215bcd316ad16bce945e2f6996e9242f7da041b17abc4979f87243411d519d5f7a94d5333678255bb78a9a
TLSH
T101114847BFB7E689D0290B3CE2D76200B5668EB8B1D325226F12367DC1A1AC14EC4B05
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.js

SHA256 e96fe86f982a389a62969eb30fe11cace3f663a02d0b4f4086aa81f60ae89fe4
MD5 b8588fc3f00aa2551f720a0c081fa8b2
SHA1 3934910691f978ba97ba1c51c2a2b610b10b12fb
SHA512 32e82dda5f1f870b3a88ec6144dcc6979644f6dd1217d1698830d836562a7ae73412943b2f1d5134ad03d90311d8a201cc279a1ebe65359637dd367d29ffd4cb
SSDEEP 96:gdDC1kigwyxAbfeZoMfpk6YpuFpB4QTPTt83J6AJXnXewU/2ic5Xac:gdDOQK67F/4QjGnXXewU/2icZ3
TLSH
T180A17694B35C124967B122A193326B93DDDFE476825260FDBCDC44C463B0816439EAF9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedNode.xpt

SHA256 a9240bf31d2d5a80cbc63dba8b99044c097c6e589391e669103dfa887b5401b6
MD5 4090d0499bea0aa743748f5b091906c7
SHA1 8632cbb509cf517761cee3b33f90daecf8f89de6
SHA512 d6194459581399678e7255fd1170e3bc95079c273817198cbb8c9e233d6730e1df45d1e12ecbdea8eed82f726f5e1e93dbd66b598033d38912f3a159b145b274
TLSH
T14B2190979373F297E125593F16B35B037801C8FF562222690AEDB7C3AA513850F47D84
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.js

SHA256 10ef5d880238aef54d44fdc2bbd9c7776c12ed2412e9d8e519b8bed3ad588ea5
MD5 8324f21fe2dacf148bb540327399beaf
SHA1 8ec8c12bc6acafdb9ac03a5be7ec7c3b27eb7d0f
SHA512 bee4a7d28bf91dd8d01cd3bf0d63f750d3ef65edf54cf500b0c4bb77c9f884de721ebc215968cd41cbd203ca2918886d2c8ec7db808347e333c32b44f0215225
SSDEEP 768:gtufcHsYq2PV5viPGULc7F5sMoBC3FXN+39f2iICHa/ZdJfVtERabXkNX9:erHE5kboB4FXN+39eiINRdJfVtERazkX
TLSH
T1E123A595371C450E56E013416A3E23D1DE6FC833926460FDB5DEBAD9E3A881803EDEB9
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/components/nsYahooFeedProcessor.xpt

SHA256 c345c57e15ac0806c51a94d4ad87f1eab0a7a4d4a33b71660f70dcb1413f8c9e
MD5 f4f1ceb9a2af7f227e8c5f71785bb84f
SHA1 5f653b1cfd89b1bf5723ff1cceef9579f3747cc4
SHA512 548b23f02f8efd3785b38eb2c3d071dca13e42234bf0c8628e45e44a102880a43bcc12c43fa63702dfc0d4a1168ca962253a2e8dda3cf3513ccbf1d15cfdbd14
TLSH
T131216AA39EB7D9A4D4B04A7FE4F38704F910C639C60120666B5AABD9A8789814F49980
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/defaults/preferences/yahoo.js

SHA256 d71fa9d32a3062f97fad34b95e42734df70eed0823892df99b0f6ea2b4b9acd5
MD5 e84f0717870cd1eb7926dbc57788de40
SHA1 0e917395f0db4c47c3de527310c500beb255d06e
SHA512 7db1653f0b81f86dd817fe2e459d1c9fd6db0b2808c16dcba7789cc5c169c008f3d4a3154e49a61e57469322ba07d8b3da1e89f086fd5b5c5043957882b326b9
TLSH
T181B02B15F824CC7135FF98CF9C50080489350110615E10E07EEB107204CD3FD0BE6301
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.js

SHA256 c99a0696648300e162895a18f91ca8dc4feb60bdbc52370fcdd22ab0232c1bf4
MD5 03f20f67fc8646dc91da7e08346c8649
SHA1 db3acb73dc15c4332804a7cab7dcb79ef5134f56
SHA512 577bead4f18a0cb968833927ed098942aae8234e033f21e5bff8851090a70a0582bc56b36a36e9c23be7d9728a90d5fcf05814973c94451acf815b0859b77b5e
SSDEEP 96:gKGanzogsog2ouUGnWogcNlR0G/a/z/3efQDu1+:gMzo/o5oQnWorwG/a/z/3efQDu1+
TLSH
T175A1A68F22A007365931CB52B61C1D55EBA6C13809F1C12D789E825867373F096BF6FC
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/install.rdf

SHA256 0dffc955c29f9599b991e01998f58f7de4ee11a55696df12fd1b47af6e59e94e
MD5 22db2cfe087cc706b6a3c3633521d57c
SHA1 7827d4b347681ba149e6c93af5c94b493e0ae8f3
SHA512 7f197ce4620bf458af11530fd8b77d9ec185dfcf23f9c5c449805d483af82ddca0b5968350db69e73e2c0e99dfae815a31ec327f2c80640a310297e8a7e1bfef
TLSH
T118412725D55B6EB305EB89EF6C54380001BE27AAD44F99C4ADB37C509FCC3AD42DA352
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/InetLoad.dll

IMPHASH c8b9238dbe1f44a22cec478a21053323
SHA256 a5d6ce0e726832447fe09c52bd3475626e878b21a84b407fd69e541eb3f1afb0
MD5 c3a09178c2ac083be6b2230fe806779c
SHA1 30cd61ac880d70124c9e4db9a3dbda96c8ddf708
SHA512 cc03f6f757f0ec63574a8c02b602de2d4a77819a48e318c3d6c43bdffcf587f55425d9744d25c0c51cb0f72242ae4dd94276c19336592b855487e3b2793c5b45
SSDEEP 384:nNrOZTOthDtbSoI8ZdOegqY1TPrHE0dKyV1lpp7yPksyT:nNJDIsdOegqY1vk0dvFjT
TLSH
T13AA2091017F19BF7F5319A352C31971486B9B9902520E09E87508F8D3C9C74BEA79BBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_initterm malloc _wtoi __dllonexit _onexit wcscpy calloc _wcsicmp _wopen wcscat _close _wunlink free swprintf memset wcsstr wcstol wcslen wcsncmp wcstoul _write time wcsrchr wcschr _adjust_fdiv wcscmp

kernel32

lstrcpynW WideCharToMultiByte CreateThread WaitForSingleObject TerminateThread CloseHandle GetModuleHandleW lstrcpyW GlobalFree LoadLibraryW GetProcAddress Sleep SleepEx FreeLibrary GetLastError MulDiv lstrlenW GlobalAlloc

user32

SendMessageW SetWindowTextW wsprintfW SetWindowLongW RegisterWindowMessageW CallWindowProcW PostMessageW DestroyWindow EnableWindow GetWindowLongW CreateWindowExW GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxW SendDlgItemMessageW SetDlgItemTextW SetTimer LoadIconW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindow CreateDialogParamW FindWindowExW GetWindowTextW GetDlgItem

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoW InternetQueryOptionW HttpSendRequestW HttpAddRequestHeadersW InternetSetOptionW HttpOpenRequestW FtpOpenFileW InternetGetLastResponseInfoW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/MoreInfo_U.dll

IMPHASH 04bea62c622b74699ee34d943d29d01a
SHA256 d77ef48fab0c91b6fa101786009ccaece4ae0767e1b3cd6269b845579f1310e2
MD5 bcbb3d47b901167a04ca309597384859
SHA1 9e21d55fe18fddc4f6054c2ec6d1dd2ee79f6057
SHA512 370d25e82952f8bf5853ee1a5285bdc52e64995aa1b42c9f205f67c0426d526ee09a7c817b78877a1a391fbb62349f395906e0a48aac752f02094f4f901c7403
SSDEEP 768:4dUibnu1u6HQiuqCX9rNYnjvtVDAOVYx/kQX0fIgkPZtbIsdRAU2UZ:5T1uyQxX90jvgmI8mwIgitEV2
TLSH
T14E5319197853C0B3E00A053492C587C15FFE6D0336E7B46FFF9A068959E12D896BAAF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\YTB\Toolbar\Installer\Scripts\_utils\nsis_unicode\Plugins\MoreInfo_U\Release\MoreInfo_U.pdb

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

InterlockedIncrement GlobalFree lstrcpyW GlobalAlloc lstrcpynW LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLastError HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree RaiseException SetLastError InterlockedDecrement Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection RtlUnwind LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize MultiByteToWideChar GetLocaleInfoA

ole32

CoCreateInstance

oleaut32

SysAllocString SysFreeString

$PLUGINSDIR/System.dll

IMPHASH bd0c5e2173fde31d22cb05fc3c2a33dc
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/YDefUser.dll

IMPHASH eb9b12f933fc102c731bc4f747f068e1
SHA256 0a8f2196e9114b272cae8de252ded061332f964dcdc93cf79d5eb0e74d911cc3
MD5 f900f596ce75096901906b47b0837d04
SHA1 8f3400b8a1c5ee5500e995f9b90954a498409344
SHA512 8036423bfb561599e6b600b54b68571ed25d0e0115bf70339b0688027c42a2e722d9813cd7edc34509aa38471692bf730849f9165dca4aedf0a986e7839be74c
SSDEEP 768:t25ruOUYavAPWRlNQnLJc/L0UUBXcI2uvBJeFrYDXobqUbv0NL3I1b0M:alUYauKlN6LG/LFUlVvB4CDYbHgNcdp
TLSH
T186337D12799150F2C99A4AB455D89F175B7BA5000FF040875FB64A5EAE623F0BB3B30B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

89:91:ce:c9:0a:1c:f0:8b:d2:31:c0:3e:85:ce:2a:bc

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

7177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrcmpiA GetModuleHandleA DisableThreadLibraryCalls GetCurrentProcess GetLastError CloseHandle ExpandEnvironmentStringsA GetCurrentThreadId GetCommandLineA GetVersionExA HeapFree HeapAlloc ExitProcess GetProcAddress TerminateProcess TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree UnhandledExceptionFilter WriteFile LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetACP GetOEMCP GetCPInfo InitializeCriticalSection RtlUnwind InterlockedExchange VirtualQuery LoadLibraryA HeapSize GetLocaleInfoA GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA LCMapStringW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime VirtualProtect GetSystemInfo

advapi32

RegDeleteValueA RegEnumKeyExA RegLoadKeyA RegOpenKeyExA RegUnLoadKeyA RegEnumValueA RegSetValueExA OpenProcessToken RegCloseKey RegQueryValueExA RegCreateKeyExA AdjustTokenPrivileges LookupPrivilegeValueA

$PLUGINSDIR/bootstrap.ini

SHA256 bea9efa8eb69c341238cd9ddc44048f96df1c9050f9eb09ae16a3a79b083ada6
MD5 edb27b2af10a157d9d461c8b5a581ea1
SHA1 b68b415c2919e2c60a2e96564b40a92b74292902
SHA512 19c947b1ce03a22afa69a5490080d54db71f010d17787ba73681f08edfeac588064499e85380aa49e5cb0a2cc5f240822374e4477114abbb8fb2013af9f26e4d
MD5 SHA1 SHA512

NSIS installer

installer

$PLUGINSDIR/nsisProcMgr_U.dll

IMPHASH 8848858a0a943c58ced94c70d01fbd7f
SHA256 657fb9d2407e65eb4f8ea74ec97cbcfd2c85c2e06422836ddbf3688b3c4da0fe
MD5 c4d19cd1dc5af2e7d045605f3f27b565
SHA1 984b531409b257554c2b3077e3ff0768436dee70
SHA512 2546410cf269a58f1a5c0b8d61b568a1c529e3ea9d2a24b0be568a885b7045e8e2ba68b4fe1310473b48a68a697f28d6d71398efdd91280c0081cfbac5d75d3a
SSDEEP 768:VXj62WD6/RfbNmRAs/EC1yXSpi00VtN7Y:NFWEhWECcX1jtN
TLSH
T1493308097C438073F146493892C596C55FFE6D033AF370AFEFA602495AE12D861BAAF5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

e:\code\projects\nsprocess_u\release\NsProcess_U.pdb

$PLUGINSDIR/ytb_setup.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 d5832cf2b429e366e9642fef77839606697f47dbbb98d8f201022e2cfabaab45
MD5 1db10164064e0b881f984c37b64e1529
SHA1 6f72e0e49098f2083d1dea202a6d77350edd29d0
SHA512 9ea92d9f6e991fc281d41162409451dca4148b7b13883069997503c48596e9ce5986038fe156125d5c0800fb3641a24fe19ad1cfa6c53bba76d21ff66015ca0c
SSDEEP 49152:XmqjbQpRwQEr6OjTxA5PXnT/XAcgG4mBPdeRT/oj:XmkspRwQ466TxEXnDAGJmRboj
TLSH
T1C39533E39B579543ECA68B31A067863587476E4F6BF0633BA353B9CEBA30103D905721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d4:4f:89:88:3b:4f:74:95:94:c5:20:27:d9:37:40:12

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InetLoad.dll

IMPHASH c8b9238dbe1f44a22cec478a21053323
SHA256 a5d6ce0e726832447fe09c52bd3475626e878b21a84b407fd69e541eb3f1afb0
MD5 c3a09178c2ac083be6b2230fe806779c
SHA1 30cd61ac880d70124c9e4db9a3dbda96c8ddf708
SHA512 cc03f6f757f0ec63574a8c02b602de2d4a77819a48e318c3d6c43bdffcf587f55425d9744d25c0c51cb0f72242ae4dd94276c19336592b855487e3b2793c5b45
SSDEEP 384:nNrOZTOthDtbSoI8ZdOegqY1TPrHE0dKyV1lpp7yPksyT:nNJDIsdOegqY1vk0dvFjT
TLSH
T13AA2091017F19BF7F5319A352C31971486B9B9902520E09E87508F8D3C9C74BEA79BBB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_initterm malloc _wtoi __dllonexit _onexit wcscpy calloc _wcsicmp _wopen wcscat _close _wunlink free swprintf memset wcsstr wcstol wcslen wcsncmp wcstoul _write time wcsrchr wcschr _adjust_fdiv wcscmp

kernel32

lstrcpynW WideCharToMultiByte CreateThread WaitForSingleObject TerminateThread CloseHandle GetModuleHandleW lstrcpyW GlobalFree LoadLibraryW GetProcAddress Sleep SleepEx FreeLibrary GetLastError MulDiv lstrlenW GlobalAlloc

user32

SendMessageW SetWindowTextW wsprintfW SetWindowLongW RegisterWindowMessageW CallWindowProcW PostMessageW DestroyWindow EnableWindow GetWindowLongW CreateWindowExW GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxW SendDlgItemMessageW SetDlgItemTextW SetTimer LoadIconW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindow CreateDialogParamW FindWindowExW GetWindowTextW GetDlgItem

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoW InternetQueryOptionW HttpSendRequestW HttpAddRequestHeadersW InternetSetOptionW HttpOpenRequestW FtpOpenFileW InternetGetLastResponseInfoW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/InstallOptions.dll

IMPHASH 8fbbf807b5bf33729f0092d4b8c483c4
SHA256 a0bbb60b8651fb0f10384f38c33fd16600996b6c2c041480326d3cf5d0f54ec4
MD5 049a962ab217f6e55e5e4209a9d4a1f0
SHA1 f24156bb5c6540be11ffbe0cb9d739ad9ad1a00f
SHA512 f9f94c4d429ba213c0cccf447b727813ef5b2d2c6f1dda5d4620eadbb3ea7d8415b0a9fc900821f83cc8f69501b8b568c948eeabafcb455f8fab1de181aaa3a8
SSDEEP 384:3LbZ+21yxu6kGxPcSkfWpATCziU8OvNV:7bj1yomESkQNIi
TLSH
T15C624C2137D51073DEA126B26AFB63179FA2B61124D24C0B8E736EC71D2D681DE34763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7524

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GetPrivateProfileIntW lstrcmpiW GetModuleHandleW GetPrivateProfileStringW lstrcatW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree GlobalAlloc GlobalLock lstrcpynW

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW ShowWindow SetWindowLongW GetClientRect SetWindowRgn LoadIconW LoadImageW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW EnableMenuItem GetSystemMenu EnableWindow GetDlgItem LoadCursorW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW CharNextW wsprintfW MessageBoxW GetWindowTextW SetWindowTextW SendMessageW DestroyIcon

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/MoreInfo_U.dll

IMPHASH 04bea62c622b74699ee34d943d29d01a
SHA256 d77ef48fab0c91b6fa101786009ccaece4ae0767e1b3cd6269b845579f1310e2
MD5 bcbb3d47b901167a04ca309597384859
SHA1 9e21d55fe18fddc4f6054c2ec6d1dd2ee79f6057
SHA512 370d25e82952f8bf5853ee1a5285bdc52e64995aa1b42c9f205f67c0426d526ee09a7c817b78877a1a391fbb62349f395906e0a48aac752f02094f4f901c7403
SSDEEP 768:4dUibnu1u6HQiuqCX9rNYnjvtVDAOVYx/kQX0fIgkPZtbIsdRAU2UZ:5T1uyQxX90jvgmI8mwIgitEV2
TLSH
T14E5319197853C0B3E00A053492C587C15FFE6D0336E7B46FFF9A068959E12D896BAAF1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\YTB\Toolbar\Installer\Scripts\_utils\nsis_unicode\Plugins\MoreInfo_U\Release\MoreInfo_U.pdb

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

kernel32

InterlockedIncrement GlobalFree lstrcpyW GlobalAlloc lstrcpynW LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA GetLastError HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetProcAddress GetModuleHandleA ExitProcess WriteFile GetStdHandle GetModuleFileNameA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree RaiseException SetLastError InterlockedDecrement Sleep SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSection RtlUnwind LoadLibraryA GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize MultiByteToWideChar GetLocaleInfoA

ole32

CoCreateInstance

oleaut32

SysAllocString SysFreeString

$PLUGINSDIR/System.dll

IMPHASH bd0c5e2173fde31d22cb05fc3c2a33dc
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/finish.unicode.ini

SHA256 ee6c0881f8f07bb515a8261fc219fd857c99bfade854c64fb92f680e25d233c7
MD5 9939d283edae18934b124903d5a2d0ae
SHA1 32f55b2e6efe3231613cacb29a85bf61570fce7a
SHA512 75e4e095c07fd7082daea15fd3afe4a065677ef0cda133a53c2ef17ecfe42a2c3cb91a4820b70c096b993409132b5ef6c4f8fd952667a29f8254bc653dfe85e7
TLSH
T1F301C9533EFD4126F1AAA24CFBF6407997387445482EC95EC5E10A0F84E9781406BBDF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/privacy.unicode.ini

SHA256 f703479245e5b1af2d6943540e9a318ed3b31bce480c3a2b4a40610e243c1c24
MD5 971960c080b2e3855e9e07ee66814274
SHA1 377eca9aed2afa0a624c42bdc829d8f2834deb7d
SHA512 8cdfd5633f9baacfa4f58984534ce09f3479cda2c14f999d3e891df58147b8bdff0ee57c9981bfe51379f6288262daf1c545762dc78605d05462f369ee1a2fdf
TLSH
T1484102473EF98115E4AAB20CEBF684B597383001181EC94ED1E14E0E98E9AC0402BBEF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/timet.dll

IMPHASH 68e139293453d6683bd25e6139dc2380
SHA256 248b3209a1a3c7ec9a56df7a113b3a52f85f5c1d25e4a9b7778373121edef521
MD5 29dd90a1a32084f30f99a12195009076
SHA1 60bf8178ddff81fa471eeea724e9c3b6e9cb5e64
SHA512 a812add8ec26dd382413105756f6fc734f1401487971bac31c16a89dac5fe01fbc4f5347c8251a6000e3466d5e10a67155747102c7b66811f51d5107c6f35134
TLSH
T1075156B753F49AF6D04C073F05CB1919F27B737453A6505B99529E083810AE95A38F17
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/toolbar.bmp

SHA256 519a623dfd484da3aa32bef4a00eae3105203dd3e6a54f1bc9b6e96170515a9d
MD5 6f2393754689a218d4d7447e1ab8f67b
SHA1 43cce294918c2b2675a14b039abdb14d9fa342ac
SHA512 bb93cdd664bc3646d3428e70e0f867b1308dff73289dfd5e6e3d1f9a4bdea3caf9ccdf86546bcc3f43827379eb84793034f61e60279a289fec11a703d5c077f6
SSDEEP 384:ucYaFV7cbb1Fy8rbHSpEA1EXuqa0ERIE2i697u:ucYaFV7cbbKEXuqa0Efc7u
TLSH
T1BA33FC24F4F53725667F8B34D60A6478A9CFC5FA181616B24C2AFCA3C8A06164FD613F
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/welcome.unicode.ini

SHA256 c9a8b9af16c87eb74d7e1bc0bc5f453e566d07b2f9e66e463bf059d654f83186
MD5 53418d1c42c5dfbf867d070a952aed30
SHA1 464894d4f989b2511d8e5317eb5897ec47ec1e95
SHA512 1207435899ab1e3a29996418239d9f640bf2fae43ad0af741345d655b9681fa3360f588a18474dcf3ea160cc2c7797f96c6b039207f769fed2fc7ec093837c62
TLSH
T1943108133DE94020E0AEA64CFBF68476D7387446581DC94EC1E50F0E88E6682446BBDF
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/ymailadv_setup.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 d87e075d27b3a04ba5edabd22ea61807bcb9979257cac31a973bcc6b30c7b30f
MD5 32719874d734766bf5cc7ce516c0d50c
SHA1 0639c9415b3836d61306876c090839ed07bc4fee
SHA512 de92fcf3c008377381a1cf351434103f6e98d9b3dfcb8b43ba473a7b75e94ac735155fed19e9d527ae6dc2c25a041f9411672d5e162075e5bec7a8a35b705ea0
SSDEEP 6144:7BrF/loIxs5PycQE7rn30qBY58kd5pXLzjElTuc/BeGO/Q5UsGHsW9A:7Bp5xEZQkEqBodLxzYlaIlO/Q6OWe
TLSH
T10744120AB1F1C0A7EEB645701A2A0354EB6EA654E4F0D32FC7640899BF756D4CD297C3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$2

IMPHASH 301fa0e5aedcc20300cbf69edb3f6515
SHA256 aa6d2e40a034c2b6ba977da27a9c9d781b2170d19e86071a589c4f8e8ed13f4a
MD5 4af21656b2ca07a323105aae2604f482
SHA1 7ebb23691544fa6e8ed16d986a37251451887033
SHA512 66c281614aa2f320feaa03c05a5a3607006a1c58b6aaf493f36f6313fc947cebe7f71309f939c0baf3565b424e6cc466a23ce79c5581219c432764e89aa8bc88
SSDEEP 6144:n1L/mX8eImDVOhNlnhLByNuJqvDbniODprKLz8c9Vdz:x/mX8e1hObLByNuJiHniODQLz/5
TLSH
T174547C22BBA9C8B0C64D107518AF6F1E6126EE044BE5DEC367943D5DE972BD0213D2CB
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

69:b2:60:ef:00:59:c0:a5:42:4b:a5:5a:03:1e:07:7e

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

141425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Development\Visualstudio\Ymmapi-mb\ReleaseMinDependency\YMMAPI.pdb

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetCreateUrlA InternetCanonicalizeUrlA InternetWriteFile HttpAddRequestHeadersA InternetCloseHandle InternetReadFile HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpOpenRequestA InternetConnectA InternetOpenA InternetCrackUrlA

kernel32

FreeLibrary GetProcAddress LoadLibraryA FindNextFileA lstrcmpA GetSystemTimeAsFileTime RemoveDirectoryA FindClose FindFirstFileA CopyFileA lstrcpynA MultiByteToWideChar GetShortPathNameA HeapAlloc GetProcessHeap HeapFree GetFileAttributesA GetCurrentProcess GetSystemDirectoryA WaitForSingleObject CreateProcessA SetEndOfFile SetFilePointer GetWindowsDirectoryA MoveFileExA SetFileAttributesA lstrlenW GetModuleFileNameA CreateDirectoryA DeleteFileA QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetNumberFormatA SetEvent MulDiv CreateThread CreateEventA Sleep lstrcmpiA InterlockedIncrement EnterCriticalSection InterlockedDecrement IsDBCSLeadByte LoadLibraryExA GetModuleHandleA GlobalUnlock GlobalLock GlobalAlloc DisableThreadLibraryCalls FlushInstructionCache GetCurrentThreadId HeapCreate GetCommandLineA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess HeapSize HeapReAlloc HeapDestroy GetTickCount GetCurrentProcessId SetUnhandledExceptionFilter TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue TerminateProcess GetOEMCP GetCPInfo GetStringTypeA GetStringTypeW SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW CreateFileA GetLastError GetFileSize CreateFileMappingA MapViewOfFile GetSystemTime lstrcatA UnmapViewOfFile CloseHandle lstrcpyA IsBadReadPtr IsBadWritePtr lstrlenA FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException WideCharToMultiByte GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetEnvironmentStringsW UnhandledExceptionFilter WriteFile IsBadCodePtr LCMapStringA LCMapStringW SetStdHandle FlushFileBuffers LeaveCriticalSection

user32

GetMessageA PeekMessageA InsertMenuA MsgWaitForMultipleObjects TranslateMessage DispatchMessageA DestroyWindow IsRectEmpty IntersectRect CharNextA GetClassNameA GetParent RedrawWindow InvalidateRect GetUpdateRect UpdateWindow EndPaint BeginPaint IsCharAlphaA CharUpperA PtInRect UnionRect SetWindowPos SetWindowRgn OffsetRect EqualRect ReleaseDC GetDC SetWindowLongA GetWindowLongA CallWindowProcA GetKeyState IsWindow GetClientRect IsChild GetFocus ShowWindow SetFocus CreateWindowExA RegisterClassExA LoadCursorA GetClassInfoExA DrawTextA SendMessageTimeoutA DialogBoxParamA EndDialog IsDlgButtonChecked SetWindowTextA GetDlgItem CheckDlgButton SendMessageA IsCharAlphaNumericA wsprintfA LoadIconA MessageBoxA UnregisterClassA DefWindowProcA

gdi32

GetTextMetricsA GetTextExtentPoint32A SetBkColor ExtTextOutA DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SelectObject SaveDC CreateMetaFileA DeleteDC SetViewportOrgEx SetMapMode LPtoDP CreateDCA CreateFontA GetDeviceCaps DeleteObject GetStockObject LineTo MoveToEx CreatePen TextOutA SetTextColor SetTextAlign SetWindowOrgEx CreateRectRgnIndirect Rectangle

advapi32

RegDeleteValueA RegDeleteKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA FreeSid OpenProcessToken EqualSid RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryInfoKeyA

shell32

DragQueryFileA ShellExecuteA

ole32

OleSaveToStream CoUninitialize OleInitialize CoInitialize ReleaseStgMedium CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder CreateOleAdviseHolder StringFromGUID2 OleLoadFromStream OleUninitialize WriteClassStm CoCreateInstance

oleaut32

LoadTypeLi VariantClear VariantChangeType VariantInit SysFreeString SysAllocString OleCreatePropertyFrame SysAllocStringByteLen RegisterTypeLi UnRegisterTypeLi SysStringByteLen SysStringLen OleTranslateColor LoadRegTypeLi VarUI4FromStr SysAllocStringLen

shlwapi

StrCmpNIA wnsprintfA PathFindExtensionA StrStrA StrRChrA StrChrA

urlmon

CoInternetParseUrl

$PLUGINSDIR/System.dll

IMPHASH bd0c5e2173fde31d22cb05fc3c2a33dc
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisProcMgr.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 b6d97f3bf30b3ee951b4a014d21171e6921144ceee857eaa6c9660a3729e3f14
MD5 b9f5546d5e8e56e0b5cafcfe19d47cd1
SHA1 8dcdb464903bf643f2fe02e04d2fc75ea88268ec
SHA512 4634e483acd26a07005e224c8c82df71317ce396bda9a87fbe15db0afbed5b833f7a58d8c7a85ef3551124bb160dfedf856021786c42d2e9745cf95acefd3c3d
SSDEEP 48:qYpMMYBzjYBFxMWY/aOOdkNaCox5sRtyUqBEAa4GEVIjP:/YBnYBLTYyPF5smw4GEVy
TLSH
T11A91736353E534E2C1C64B72218318EBB677C97043A5911E0A931395A9E11A7EA78B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

YMMAPI.exe

IMPHASH af58d8c3d3fb29bae73a20d49cb6d509
SHA256 9855e993b1dff73e42bb8d8c5826babe593467ffd25a8b1e14e10d33a5b57a5b
MD5 1db458da6e4c1e34c6d0838178b67c53
SHA1 54ac9ca1e37a85a7cbbf48798e969450f6cf1d51
SHA512 0e3b31a8bbc19c8f37b2f192a7bc283e63d13d6bbe34a8b2e8c1ee607bd534c87c9cfeb2c0e8a187cac12213572da4c0fbe582ad0218b8dd4f27d61b1e5a9748
SSDEEP 1536:mOHn6Lu5UT4qItPbQo1ID7gmyFcc2H2cQoTQisOl5fT6cMnuS1kv+cdd:THn6LxTxmbQWSySbTQiLl5rI6tz
TLSH
T1F0A38D037282C470E44640315D9E9BA967B6FD508FF49E837B683B4E2EB53D1A6393C6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

67:7d:36:b5:47:21:1e:c4:e7:f1:46:68:d0:53:c2:9c

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

33009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\Development\Visualstudio\Ymmapi-mb\Ymmapi_exe\Release\YMMAPI_EXE.pdb

kernel32

lstrcmpiA lstrlenW lstrlenA lstrcpynA InterlockedIncrement InterlockedDecrement IsDBCSLeadByte GetModuleFileNameA EnterCriticalSection LeaveCriticalSection FreeLibrary SizeofResource LoadResource FindResourceA LoadLibraryExA GetModuleHandleA OutputDebugStringA FindResourceExA CloseHandle WaitForSingleObject Sleep CreateThread CreateEventA lstrcpyA lstrcatA GetCurrentThreadId SetEvent GetShortPathNameA LocalFree GetCommandLineA FlushFileBuffers SetStdHandle DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP LockResource InterlockedExchange SetFilePointer IsBadCodePtr IsBadReadPtr LoadLibraryA GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetStdHandle WriteFile GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA GetCPInfo GetOEMCP TlsGetValue TlsSetValue TlsFree HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery ExitProcess RtlUnwind GetStartupInfoA HeapCreate VirtualFree IsBadWritePtr GetProcAddress TerminateProcess GetCurrentProcess QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetUnhandledExceptionFilter TlsAlloc SetLastError

user32

CharNextA CharUpperA DispatchMessageA TranslateMessage GetMessageA PostThreadMessageA

advapi32

GetSecurityDescriptorLength ConvertStringSecurityDescriptorToSecurityDescriptorW RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryValueExA

shell32

ShellExecuteA

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoUninitialize CoRevokeClassObject CoRegisterClassObject StringFromGUID2 CoCreateInstance CoInitialize

oleaut32

SysFreeString LoadRegTypeLi LoadTypeLi RegisterTypeLi UnRegisterTypeLi SysAllocString SysStringLen VarUI4FromStr

shlwapi

PathFindExtensionA SHDeleteKeyA

YMailAdvisor.exe

IMPHASH 6f38c1405b8bc610ae9c8c1554c9c250
SHA256 df43ab9f53d8beafaa0abc60ed609ec16bafa154da1bf0bb30688c2723297dc5
MD5 dc42fa40848ce3d14308c4a1a80de3ad
SHA1 46f4abd176c812d8d5cc3431abeb4348f6ce7aa3
SHA512 473032fdffb8740fcf14500a430aa16d9de20a8648824297d1b42878a4e09ee54e5efce18ae7e214c6750082cd797a8b5465d7bab71f4bbcd9f5df28fba2ea8b
SSDEEP 1536:SyyV/mVI+A4CMWGVWA8NCPPCPXr/Dw5qZ/tpzyk8TORYYlXO/Xe6Cdx6l:xykI+Z7QA3C/w5qskaORYYlXQuxWl
TLSH
T1AEC36A1276E284B1C5A10570CEA887ED9376EE7F0F7CD90717583A0F2E739D2452AB86
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

75:46:89:d5:92:2f:77:d6:58:01:7c:1b:14:61:cc:d1

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

46254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Proj\YMailAdvisor\ReleaseU\YMailAdvisor.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryW GlobalFree GlobalHandle GetModuleHandleW CloseHandle GetCommandLineW GetStringTypeW GetStringTypeA GetCPInfo GetOEMCP IsBadCodePtr IsBadReadPtr LoadLibraryA GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings GetCurrentThreadId UnhandledExceptionFilter GetStdHandle WriteFile LCMapStringW WideCharToMultiByte LCMapStringA MultiByteToWideChar GetSystemInfo VirtualProtect TerminateProcess TlsGetValue TlsSetValue TlsFree TlsAlloc IsBadWritePtr VirtualAlloc VirtualFree HeapCreate VirtualQuery SetUnhandledExceptionFilter GetModuleFileNameA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoW GetModuleHandleA RtlUnwind ExitProcess HeapSize HeapReAlloc HeapDestroy GetVersionExA GetModuleFileNameW lstrcmpW lstrlenW GetCurrentProcess FlushInstructionCache HeapAlloc MulDiv InterlockedExchange lstrcpyW LeaveCriticalSection EnterCriticalSection GetLastError GlobalAlloc GlobalLock GlobalUnlock SetLastError ExpandEnvironmentStringsW GetProcessHeap HeapFree FindResourceExW FindResourceW LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException GetVersionExW GetThreadLocale GetLocaleInfoA GetACP FreeEnvironmentStringsA

user32

SystemParametersInfoW GetWindow GetClientRect MapWindowPoints SetWindowPos SendMessageW GetWindowLongW EndDialog GetIconInfo DrawIconEx FindWindowW GetWindowRect GetMessageW TranslateMessage DispatchMessageW DialogBoxIndirectParamW KillTimer SetTimer PostMessageW wsprintfW CreateAcceleratorTableW CharNextW GetClassNameW RedrawWindow IsWindow GetFocus IsChild SetFocus CallWindowProcW GetDesktopWindow InvalidateRgn InvalidateRect ReleaseDC GetDC FillRect SetCapture ReleaseCapture DestroyAcceleratorTable GetWindowTextLengthW GetWindowTextW DefWindowProcW RegisterWindowMessageW GetClassInfoExW LoadCursorW RegisterClassExW CreateWindowExW MapDialogRect SetWindowContextHelpId LoadImageW ShowWindow BringWindowToTop SetForegroundWindow SetWindowTextW SetWindowLongW DestroyWindow UnregisterClassW GetDlgItem LoadBitmapW BeginPaint GetSysColor GetSystemMetrics EndPaint GetParent

gdi32

GetObjectW CreateCompatibleDC CreateCompatibleBitmap SelectObject GetDeviceCaps CreateBitmap SetBkColor GetBkColor CreateSolidBrush SetTextColor DeleteObject DeleteDC GetStockObject BitBlt

advapi32

OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid GetTokenInformation EqualSid FreeSid RegSetValueExW RegCreateKeyExW RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegOpenKeyExW RegCloseKey RegEnumValueW

ole32

CoCreateInstance CLSIDFromString CLSIDFromProgID CoGetClassObject OleLockRunning CoTaskMemAlloc StringFromGUID2 OleUninitialize OleInitialize CreateStreamOnHGlobal

oleaut32

LoadRegTypeLi VariantInit VariantClear OleCreateFontIndirect SysStringByteLen SysAllocString SysStringLen SysAllocStringLen SysFreeString LoadTypeLi

uninst_ymailadv.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 294c441fd19f08af891dae5a4de8587ea8b5624e93172ce4e4419d253bb42da2
MD5 f2d9c27d3b87c296e9f5e2929d904dd2
SHA1 41390d6b0f4165bb8219116961055dda43fcc90f
SHA512 7e3e0e5f4308e719f64ebee2d3c470b9ee1dbde69c7e49be86d3fcb214b2717ea3a324f4cf4875452de292aff2fbf6ddac72bf2f6fe9e683c1a3f4637ba13281
SSDEEP 768:9puEEp7cJ+k1/pJMQ95HkJdH7YcPl8nu7ygVovUITyn9gCI5JRnmysWXVg+HOKyy:CEEQJ+kVzMQ9wY68jgVoW6CIYysWlg+X
TLSH
T187238C1A25B0C1B7E9A30A702D72567A9FFFEA0154B5E70F47500A49FA321C5CA1D7B3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH bd0c5e2173fde31d22cb05fc3c2a33dc
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisProcMgr.dll

IMPHASH c9fc7f6df8fedf8f8f1f9f820c072664
SHA256 b6d97f3bf30b3ee951b4a014d21171e6921144ceee857eaa6c9660a3729e3f14
MD5 b9f5546d5e8e56e0b5cafcfe19d47cd1
SHA1 8dcdb464903bf643f2fe02e04d2fc75ea88268ec
SHA512 4634e483acd26a07005e224c8c82df71317ce396bda9a87fbe15db0afbed5b833f7a58d8c7a85ef3551124bb160dfedf856021786c42d2e9745cf95acefd3c3d
SSDEEP 48:qYpMMYBzjYBFxMWY/aOOdkNaCox5sRtyUqBEAa4GEVIjP:/YBnYBLTYyPF5smw4GEVy
TLSH
T11A91736353E534E2C1C64B72218318EBB677C97043A5911E0A931395A9E11A7EA78B26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ymmapi.dll

IMPHASH 301fa0e5aedcc20300cbf69edb3f6515
SHA256 aa6d2e40a034c2b6ba977da27a9c9d781b2170d19e86071a589c4f8e8ed13f4a
MD5 4af21656b2ca07a323105aae2604f482
SHA1 7ebb23691544fa6e8ed16d986a37251451887033
SHA512 66c281614aa2f320feaa03c05a5a3607006a1c58b6aaf493f36f6313fc947cebe7f71309f939c0baf3565b424e6cc466a23ce79c5581219c432764e89aa8bc88
SSDEEP 6144:n1L/mX8eImDVOhNlnhLByNuJqvDbniODprKLz8c9Vdz:x/mX8e1hObLByNuJiHniODQLz/5
TLSH
T174547C22BBA9C8B0C64D107518AF6F1E6126EE044BE5DEC367943D5DE972BD0213D2CB
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

69:b2:60:ef:00:59:c0:a5:42:4b:a5:5a:03:1e:07:7e

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

141425

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Development\Visualstudio\Ymmapi-mb\ReleaseMinDependency\YMMAPI.pdb

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

wininet

InternetCreateUrlA InternetCanonicalizeUrlA InternetWriteFile HttpAddRequestHeadersA InternetCloseHandle InternetReadFile HttpQueryInfoA HttpEndRequestA HttpSendRequestExA HttpOpenRequestA InternetConnectA InternetOpenA InternetCrackUrlA

kernel32

FreeLibrary GetProcAddress LoadLibraryA FindNextFileA lstrcmpA GetSystemTimeAsFileTime RemoveDirectoryA FindClose FindFirstFileA CopyFileA lstrcpynA MultiByteToWideChar GetShortPathNameA HeapAlloc GetProcessHeap HeapFree GetFileAttributesA GetCurrentProcess GetSystemDirectoryA WaitForSingleObject CreateProcessA SetEndOfFile SetFilePointer GetWindowsDirectoryA MoveFileExA SetFileAttributesA lstrlenW GetModuleFileNameA CreateDirectoryA DeleteFileA QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetNumberFormatA SetEvent MulDiv CreateThread CreateEventA Sleep lstrcmpiA InterlockedIncrement EnterCriticalSection InterlockedDecrement IsDBCSLeadByte LoadLibraryExA GetModuleHandleA GlobalUnlock GlobalLock GlobalAlloc DisableThreadLibraryCalls FlushInstructionCache GetCurrentThreadId HeapCreate GetCommandLineA VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect RtlUnwind ExitProcess HeapSize HeapReAlloc HeapDestroy GetTickCount GetCurrentProcessId SetUnhandledExceptionFilter TlsAlloc SetLastError TlsFree TlsSetValue TlsGetValue TerminateProcess GetOEMCP GetCPInfo GetStringTypeA GetStringTypeW SetHandleCount GetStdHandle GetFileType GetStartupInfoA VirtualFree FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW CreateFileA GetLastError GetFileSize CreateFileMappingA MapViewOfFile GetSystemTime lstrcatA UnmapViewOfFile CloseHandle lstrcpyA IsBadReadPtr IsBadWritePtr lstrlenA FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection RaiseException WideCharToMultiByte GetVersionExA GetThreadLocale GetLocaleInfoA GetACP InterlockedExchange GetEnvironmentStringsW UnhandledExceptionFilter WriteFile IsBadCodePtr LCMapStringA LCMapStringW SetStdHandle FlushFileBuffers LeaveCriticalSection

user32

GetMessageA PeekMessageA InsertMenuA MsgWaitForMultipleObjects TranslateMessage DispatchMessageA DestroyWindow IsRectEmpty IntersectRect CharNextA GetClassNameA GetParent RedrawWindow InvalidateRect GetUpdateRect UpdateWindow EndPaint BeginPaint IsCharAlphaA CharUpperA PtInRect UnionRect SetWindowPos SetWindowRgn OffsetRect EqualRect ReleaseDC GetDC SetWindowLongA GetWindowLongA CallWindowProcA GetKeyState IsWindow GetClientRect IsChild GetFocus ShowWindow SetFocus CreateWindowExA RegisterClassExA LoadCursorA GetClassInfoExA DrawTextA SendMessageTimeoutA DialogBoxParamA EndDialog IsDlgButtonChecked SetWindowTextA GetDlgItem CheckDlgButton SendMessageA IsCharAlphaNumericA wsprintfA LoadIconA MessageBoxA UnregisterClassA DefWindowProcA

gdi32

GetTextMetricsA GetTextExtentPoint32A SetBkColor ExtTextOutA DeleteMetaFile CloseMetaFile RestoreDC SetWindowExtEx SelectObject SaveDC CreateMetaFileA DeleteDC SetViewportOrgEx SetMapMode LPtoDP CreateDCA CreateFontA GetDeviceCaps DeleteObject GetStockObject LineTo MoveToEx CreatePen TextOutA SetTextColor SetTextAlign SetWindowOrgEx CreateRectRgnIndirect Rectangle

advapi32

RegDeleteValueA RegDeleteKeyA RegEnumValueA RegSetValueExA RegCreateKeyExA FreeSid OpenProcessToken EqualSid RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegCloseKey RegQueryInfoKeyA

shell32

DragQueryFileA ShellExecuteA

ole32

OleSaveToStream CoUninitialize OleInitialize CoInitialize ReleaseStgMedium CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder CreateOleAdviseHolder StringFromGUID2 OleLoadFromStream OleUninitialize WriteClassStm CoCreateInstance

oleaut32

LoadTypeLi VariantClear VariantChangeType VariantInit SysFreeString SysAllocString OleCreatePropertyFrame SysAllocStringByteLen RegisterTypeLi UnRegisterTypeLi SysStringByteLen SysStringLen OleTranslateColor LoadRegTypeLi VarUI4FromStr SysAllocStringLen

shlwapi

StrCmpNIA wnsprintfA PathFindExtensionA StrStrA StrRChrA StrChrA

urlmon

CoInternetParseUrl

$PROGRAMFILES/Yahoo!/Common/$PROGRAMFILES/Yahoo!/Common/unyt.exe.nsis

SHA256 36d6bccf265836fb4cfb5252578bd25971d48e64844c6533d4d0fcb5fa3a908b
MD5 a467a8c6c5accc63deddeb032da25a23
SHA1 2b020be0af309a96d4e44d132988d019e1a07bfa
SHA512 0024c50abca5cb8c453d700a3264e9cdb82bfbc76e280ae5f8a4cf64103c09f271dc65d3d533fbd094b59f0247e8c37238ae9565b9557c7a8ac849b022ccee9f
SSDEEP 768:QGHtEkSODBqdeAQgELLYzzWhEqc9rl29QoqAd15lMtHmKIcjg+HOKyG:7221S1ELkuhEqIg/9MBJ1g+uKyG
TLSH
T1FE03F263EF46EA0DA507F3844D9E4715C40DE4AAFBBB932A541AB48287F1307D874A62
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PROGRAMFILES/Yahoo!/Common/unyt_wrap.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 028a901f766490739161a65fc40ca1f7f878b95793482d91e4744811477d6f3d
MD5 969ae4d624b267793ef045ce84d4a88b
SHA1 3f294b8dea67deffb02b6baa07fe8678239c55aa
SHA512 9730931977a07653a9fb268dc7e71bb6318d2daac6c797c515d403e823ca610cd6b018a7feeb932fd08e1cf7037c5238397c2f965bb7e85a508b3bc83d6f794a
SSDEEP 1536:ZEEQJ+kVzMQ9wY68jgVoW6CI3M27fA97g+uKyrl95yCDvoviIJB:ejJ+0zD7zguW6CIffo6LyCDSH
TLSH
T149838CC33AA3D967C56315302C224676DBAABD0F9861573F53833ACEF976587C809362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/System.dll

IMPHASH bd0c5e2173fde31d22cb05fc3c2a33dc
SHA256 fd58286ab8abf3400912809a78d679f75b8054878e804a8e9767b2379f184f71
MD5 9c32a7501c959b4aed7fd64313137ecc
SHA1 f59b561fe96bcc3ce3967ebb8811d8a98a34f134
SHA512 2db04fdb6c77cfe09db8a4d4b33ab20561544eb8344e15bec521e62a49225389ae612feef127a8b1af2858d2e0517d0bbb71510482a19466be309f7bffe3bc28
SSDEEP 96:rDhuJxuSaQJOhgO0nOQ3MnU+RyWg1sMI45CS5bGCs5/LxLo5R4uaGZef4cX1l8Sy:rVS+6dMU+wWg1sMI4/5aCs51gHDFaeN
TLSH
T158122A251F6081F3C660C1B88C5621623F3E325856B14FA7EFA78C897E646C67E39362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PROGRAMFILES/Yahoo!/Common/unyt_bs.exe

IMPHASH afe04f6b32f7770e9292abfe4124f932
SHA256 5fb61c8eebda9c4980c967473106b4768cd77d02257eefd5d4b666ff09d4a313
MD5 2a57d693bf086a2eea30a555141ec106
SHA1 f98ff14ac06e154c8fb51100cab7cded857f6f17
SHA512 5811587e76750e568463bed5c9ac8effa9c10f33649ebdcfc8e92715ecd3dab8770bb7c4380417c325fb3b0a9bcbac7caa905a05eebe7101494cbbf582b6718b
SSDEEP 1536:ZEEQJ+kVzMQ9wY68jgVoW6CI3M27mCASDBYg/ph:ejJ+0zD7zguW6CIfmCntYgD
TLSH
T150636CD33AA3C467C4A306301D2282B5ABAABE0F58A5573F578337DEF931487D5053A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

13241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileTime CompareFileTime SearchPathW GetShortPathNameW GetFullPathNameW MoveFileW SetCurrentDirectoryW GetFileAttributesW GetLastError CreateDirectoryW SetFileAttributesW Sleep GetTickCount GetFileSize GetModuleFileNameW GetCurrentProcess CopyFileW ExitProcess GetWindowsDirectoryW GetTempPathW GetCommandLineW SetErrorMode CloseHandle lstrlenW lstrcpynW GetDiskFreeSpaceW GlobalUnlock GlobalLock CreateThread LoadLibraryW CreateProcessW lstrcmpiA CreateFileW GetTempFileNameW lstrcatW GetProcAddress LoadLibraryA GetModuleHandleA OpenProcess lstrcpyW GetVersionExW GetSystemDirectoryW lstrcpyA RemoveDirectoryW lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalAlloc WaitForSingleObject GetExitCodeProcess GlobalFree GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW WideCharToMultiByte lstrlenA MulDiv WriteFile ReadFile MultiByteToWideChar SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW lstrcpynA

user32

ScreenToClient GetMessagePos CallWindowProcW IsWindowVisible LoadBitmapW CloseClipboard SetClipboardData EmptyClipboard OpenClipboard TrackPopupMenu GetWindowRect AppendMenuW CreatePopupMenu GetSystemMetrics EndDialog EnableMenuItem GetSystemMenu SetClassLongW IsWindowEnabled SetWindowPos DialogBoxParamW CheckDlgButton CreateWindowExW SystemParametersInfoW RegisterClassW SetDlgItemTextW GetDlgItemTextW MessageBoxIndirectW CharNextA CharUpperW CharPrevW DispatchMessageW PeekMessageW wsprintfA CreateDialogParamW DestroyWindow SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW LoadCursorW SetCursor GetWindowLongW GetSysColor CharNextW GetClassInfoW ExitWindowsEx IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint FindWindowExW

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor SelectObject

shell32

SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW ShellExecuteW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegEnumKeyW RegOpenKeyExW RegCloseKey RegDeleteKeyW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegQueryValueExW RegEnumValueW

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

$PLUGINSDIR/InetLoad.dll

IMPHASH e696e07b83b539424aa19037b7e73b21
SHA256 55fdc93f63d7d15f1cd9473d192e05265595833ab1e97c9ed4847ad1396662b4
MD5 ee8ba3125ab40c31503864a32a246cfa
SHA1 d3c5d0eaec17f4808c5aec75997d3f0cdaed5122
SHA512 97cec106feafa151243012e1cbef537f01f0a6346f14bc0ff50314188aadc2403a2d534920efa79b94e9423a8ff9e7783ef529e4db0be69db5ba0587d7218b0a
SSDEEP 384:T0MCLUOTOv/08C5B5A/rvW4G9IC0UKsV1lpf7yPGzca:RCLq/08C/5AT610UBDNzb
TLSH
T109A2195107F04BF7F5315B362D7197248ABC7D941831D49E96108F8C3C98747EAA8BA7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

11975

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

__dllonexit time _adjust_fdiv malloc _initterm _wtoi wcstol wcscpy calloc _wcsicmp _wopen wcscat _close _wunlink free memset wcsncmp wcstoul _write wcschr _onexit wcsrchr

kernel32

lstrcmpW GlobalAlloc lstrcpynW CreateThread WaitForSingleObject TerminateThread CloseHandle GetModuleHandleW lstrcpyW GlobalFree LoadLibraryW GetProcAddress Sleep SleepEx FreeLibrary lstrcmpiW GetLastError MulDiv lstrlenW

user32

SendMessageW GetDlgItem wsprintfW SetWindowLongW RegisterWindowMessageW CallWindowProcW PostMessageW DestroyWindow EnableWindow GetWindowLongW CreateWindowExW GetWindowRect GetClientRect ShowWindow IsWindowVisible GetFocus MessageBoxW SendDlgItemMessageW SetDlgItemTextW SetTimer LoadIconW DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW IsWindow CreateDialogParamW FindWindowExW GetWindowTextW SetWindowTextW

wininet

InternetErrorDlg InternetSetFilePointer HttpQueryInfoW InternetQueryOptionW HttpSendRequestW HttpAddRequestHeadersW InternetSetOptionW HttpOpenRequestW FtpOpenFileW InternetGetLastResponseInfoW InternetConnectW InternetCrackUrlW InternetOpenW InternetReadFile InternetCloseHandle

comctl32

ord17

$PLUGINSDIR/YExecShell.dll

IMPHASH 27acbdad9c6b9b9dea67557b6e7b8a67
SHA256 ce5f87a2080c8e6ca6ec1b9d11369b1a5554e8eb5d69672fc6e04bd6bc95fc05
MD5 e92a6284042cbb30e52cb64d3355f1e7
SHA1 c8d6ab39bb5ffaf7da78143103d5bfdaa146b91e
SHA512 32f5f2d10f13d62c501f44346879be8e116761510011daa391c3dd2e53a27f760f892b78de1ee31fb12563484fd1eca29675302ba900025d990f8cb7c3c111a8
TLSH
T1605121B747B486F0C598433505CB89775BB7D664034A5C4B89560A4E66607DF5C3A310
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/timet.dll

IMPHASH 68e139293453d6683bd25e6139dc2380
SHA256 248b3209a1a3c7ec9a56df7a113b3a52f85f5c1d25e4a9b7778373121edef521
MD5 29dd90a1a32084f30f99a12195009076
SHA1 60bf8178ddff81fa471eeea724e9c3b6e9cb5e64
SHA512 a812add8ec26dd382413105756f6fc734f1401487971bac31c16a89dac5fe01fbc4f5347c8251a6000e3466d5e10a67155747102c7b66811f51d5107c6f35134
TLSH
T1075156B753F49AF6D04C073F05CB1919F27B737453A6505B99529E083810AE95A38F17
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$_30_/Data/dlg_anstip.html

SHA256 bd23a2d793476c5110a15a90173652b3a9bcc053f2c5d0e4024bcee1387c6483
MD5 305fcdd79f823736c352fdfc849f6829
SHA1 ea1d3757e39986f43f924a9ce4f1fda2a7c3afac
SHA512 5e61613f87153120cfda29c04affb9a2755de5bb862631aa0d860b8ec1bddc9353b47ff049d8c909d47785108bbdf1595c2d945279dfa19876cea2505dcb2039
TLSH
T11FE068753DC29C6A6233A6B425DFF15C60524820824AEC85E09063DB2CD57C9EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_anstipg.html

SHA256 bd23a2d793476c5110a15a90173652b3a9bcc053f2c5d0e4024bcee1387c6483
MD5 305fcdd79f823736c352fdfc849f6829
SHA1 ea1d3757e39986f43f924a9ce4f1fda2a7c3afac
SHA512 5e61613f87153120cfda29c04affb9a2755de5bb862631aa0d860b8ec1bddc9353b47ff049d8c909d47785108bbdf1595c2d945279dfa19876cea2505dcb2039
TLSH
T11FE068753DC29C6A6233A6B425DFF15C60524820824AEC85E09063DB2CD57C9EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_as.html

SHA256 055d390247e484809bcd775e701f44b01c3f9927521cf15f8a76594430846727
MD5 27ae97148c928e538082fc4b3e7fb723
SHA1 c010372f85e40fe706f090c0ba450d7aa4a589e1
SHA512 b7d1d4393b8a6ac49a317f2e01e5bb6a4896179cfc18fbaa302cf74cb09aaef84489c021c5bb83acc1704f18ac4e9099c4c394e48e28952de4ca72eb097306be
TLSH
T18F31547326415C3D427340B65456EB98F9A2801197037494B85F11C3BFD0DA7C0EBB59
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_atb.html

SHA256 dcbef8a6cee4ef947d73f902dc6791d6d298b137020db86eafccb59b4c11909f
MD5 589e8a2f1ec39ae864e4853b5c595b76
SHA1 d077f4a9fda1c5934598e06ed35dc1b65f14a651
SHA512 bf77d88881fb090ef39317d2628e72a651a3070fe5be277bdf952b545a540b48e411cc5093609292d0735a15c70b8c784200c4828ab16c172c40a90a1577a98d
TLSH
T1E431157231467D3885730D3A915FE344F8A140116357BA50ED8E83C3FE90923C5BB65C
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_auttip.html

SHA256 f4997f86b8278c054495e77107e34c7e475f00ecc23d3c98fb02a801aa38175f
MD5 169e1835e7fd684e17032f984122efc2
SHA1 57632b1abe5fb3e4f7c3b4a15136556ee3235993
SHA512 d3590e238cdb4015f2ad25baf63f54b302a2f3859269f485819413f3bc9f93da55aff0bfb159cb845cd0964cadc1a0d7be53729bd6acf193e20543d7c3877f54
TLSH
T18CE068753DC29C6A6233A6B419DFF15C60424820824AED85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_auttipg.html

SHA256 f4997f86b8278c054495e77107e34c7e475f00ecc23d3c98fb02a801aa38175f
MD5 169e1835e7fd684e17032f984122efc2
SHA1 57632b1abe5fb3e4f7c3b4a15136556ee3235993
SHA512 d3590e238cdb4015f2ad25baf63f54b302a2f3859269f485819413f3bc9f93da55aff0bfb159cb845cd0964cadc1a0d7be53729bd6acf193e20543d7c3877f54
TLSH
T18CE068753DC29C6A6233A6B419DFF15C60424820824AED85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_bootip.html

SHA256 1619fdeb8a280902d4d1c585ded31dd34d302bef4fe9804a4abd7c0a104abbcd
MD5 9b374f870ffc3bc88e62db53c16205b1
SHA1 1586996bbfe1f3aaae050f06d0a4bd5e21317370
SHA512 6dd511e0da3415704fdd71f9d9623c4e31c82ce4ab8fe5184e1699189414113d3ac1e2f6b64835bb6d31a62ef521eb4b7922cfd92db8140dafec3f5cc433f4ee
TLSH
T15FE068753DC29C696233A6B819DFF15C60424820824AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_catb.html

SHA256 7f52baf699060afee2952843f07808936017e320317dd4f75398a20c6fb7431b
MD5 df0b2eaea99b3fec3bbe9884d5dfe2bf
SHA1 b7a2f5f8f0a310ff3013b6c88c4c09daf430a8ea
SHA512 fff2883cf7cb94c1763cc0168553f971ae7a7f80311a2a4f615e89f315205c36aa824a868cee82d389169c47359e1f95696a1935d54e096593e2c6e1f92c5c1b
TLSH
T17F4124F22146AD394673183A926B9244FCB10011E7237590FD8E86C7FFD5A23C66B97C
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_clutip.html

SHA256 f2c98c1434cb21e718ff107e5ec7c43e86fec7e23ed1cc6f167c33deedd68fb7
MD5 185d41ffae8a783e4847d1e2d7c851f9
SHA1 0343527ffb1d129eb27e251b2e9b7acc6e2ea764
SHA512 c621324e29e2c75f275234fa9987782f8b0103e4c81f555eec3cf4e7ad12c07bdbb837f321ca7cd4aed1c4134a140a31588304c71e6a918d725a4a3834df1cf3
TLSH
T124E068753DC29C696233A6B419DFF15C60424820824AEC85E09063DB2CE57D5EEC3792
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_clutipg.html

SHA256 f2c98c1434cb21e718ff107e5ec7c43e86fec7e23ed1cc6f167c33deedd68fb7
MD5 185d41ffae8a783e4847d1e2d7c851f9
SHA1 0343527ffb1d129eb27e251b2e9b7acc6e2ea764
SHA512 c621324e29e2c75f275234fa9987782f8b0103e4c81f555eec3cf4e7ad12c07bdbb837f321ca7cd4aed1c4134a140a31588304c71e6a918d725a4a3834df1cf3
TLSH
T124E068753DC29C696233A6B419DFF15C60424820824AEC85E09063DB2CE57D5EEC3792
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_cnf.html

SHA256 b6d2af4a0c82e92cb73ea3f5af128ab7fa307295b2f737dd9802a21147c93e60
MD5 dfa8a4d5f662ba95046f128c16bebbdf
SHA1 5b6cfeda376143fa4515a694d938d9a93959ae8d
SHA512 ee9e4fbcf0c0c29024f99444663ca499cca977a0cf621d45170056e8befcc7c1b748f25350e8550dbcb6cc63aff59125f02d8d64a59ee33cf002f81f3ac827be
TLSH
T1EB5165F320078E2B85A7843210A6E7843C62811A7F052594EC2E82D6FFC4D32D59B2AD
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_cotb.html

SHA256 18c113e09a8c3db2a75156f827a3c64af8bb6d631413cfb6c641a50fce766154
MD5 3d5a24ccc052ed3bbd0674ba7300fcb9
SHA1 3b51120aacc6c0218940d8cdf54a9285c7e55962
SHA512 ae82dcc283283d7d7bbdca8254b192e5e38d7c3b0b5cb9edf28d3ad61a0c0f4a346d25d12d66221389a8233f69b545974b533143f081b48b829686b52689b4de
TLSH
T1644157F2214AAD3942B3083AD36B9284FCA10015E7137950FD4E86C3FED1A23C66B57C
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_ctb.html

SHA256 c51e47170d0012d569da34635c33ef4a4cbc689173e8d4bae56cceb876ef0371
MD5 7dec0c20390685d0224659666b744d98
SHA1 6a1d08e2fcd8fb066053956cd0803454c69d29cd
SHA512 2a25f6ada9841085a820f7bd43e791ad8fb388e6ba9497bebfd41aa0cdd6990c768e17a53f584d76f7f73a6d8b250f72d36587c5400428b14f545f1b595d5b6e
TLSH
T1435165F361499E3486731879D35BA344B9A10001A7177690ED8E86C7FFD6A23C26BA6C
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_fantip.html

SHA256 4ad1fb21e6024c1004c7ce385159503dda10683f0ff293c3a4656c6f5853ff96
MD5 1704e178c172f7b5863c559d6c49f35f
SHA1 0b834d268eead47529252f00ed7415ae80b74691
SHA512 07fe6aeab423af69f82dfab36c1353942c0e53aec650a34cbf69c48cf13a26a5ef4eda27d9ea4c905f6b407377f9d5b7039e530b9d4e9408156c3ce5d9a0a8b6
TLSH
T1E3E068753DC2AC696233A6B459DFF15C60424820924AED85E09063DF2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_fantipg.html

SHA256 5ab35a301af6d64fc0137a7496442bae4d64aba869ee49a6415024842d65b6dd
MD5 0f4325f42e23a17cfc5c63ea3aa64578
SHA1 0979532736f59368dee0bce33deda179874cdef7
SHA512 ea58998590f9314e938c56a495f30bcf72d741bc8bfd1d440c0a8318004c0871c26628bdbc7981fbed5cd5a73710dab27f1d6bedfc901b289bce8f4c7cf1fe12
TLSH
T1C2E068753CC2AC69623362B859DFF15C60924820924AED84E09073DF2CD5BC5EEC3362
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_fintip.html

SHA256 01fbcdac48296fecca8ab47e980007e56385928653f4c38f79fced61cb4d08b4
MD5 9aa76d70200729f90ac35cbc25aed3f4
SHA1 0f09b8a09857ad27b667ecc8866a81a31c7e243c
SHA512 db6a5313262daf0d38c49849409a389f1c08a892f8019589f1e4214cb968fe3e728d09fbc17162d28f5308242b0a096473669a0be56f2394de925247f4766407
TLSH
T11EE068753D82AC696233A6B455DFF15C60424820924AED85E05063DB2CD57C5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_fintipg.html

SHA256 01fbcdac48296fecca8ab47e980007e56385928653f4c38f79fced61cb4d08b4
MD5 9aa76d70200729f90ac35cbc25aed3f4
SHA1 0f09b8a09857ad27b667ecc8866a81a31c7e243c
SHA512 db6a5313262daf0d38c49849409a389f1c08a892f8019589f1e4214cb968fe3e728d09fbc17162d28f5308242b0a096473669a0be56f2394de925247f4766407
TLSH
T11EE068753D82AC696233A6B455DFF15C60424820924AED85E05063DB2CD57C5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_flktip.html

SHA256 97e541e87e3051fc650a179d87dca32783f543f7bf50ec7d6cc0fdecb23f3f4f
MD5 5096c0cbbffcb2e3f1c5def9411b9a30
SHA1 bbe1c51cdf242bfb23b618beb53e379f81574765
SHA512 88a1a3d11ca7a5fc39b1015253fd88626c32608b2416d62f174621a113e5c9d843a6c4e63faa7d4f6e896dcf396b68751b0a2d855639916f97d67bad1b7dcbd6
TLSH
T19FE068753DC2AC696233A6B415DFF25C60428820824AED85E09063DF2CD57C9EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_flktipg.html

SHA256 97e541e87e3051fc650a179d87dca32783f543f7bf50ec7d6cc0fdecb23f3f4f
MD5 5096c0cbbffcb2e3f1c5def9411b9a30
SHA1 bbe1c51cdf242bfb23b618beb53e379f81574765
SHA512 88a1a3d11ca7a5fc39b1015253fd88626c32608b2416d62f174621a113e5c9d843a6c4e63faa7d4f6e896dcf396b68751b0a2d855639916f97d67bad1b7dcbd6
TLSH
T19FE068753DC2AC696233A6B415DFF25C60428820824AED85E09063DF2CD57C9EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_grptip.html

SHA256 7d48707e30a33b22ee3bd4e606eeac4b435112a0b598f3acadd210b579ac545d
MD5 0c69c6bebb377eedbd2a012e34215631
SHA1 2a6b8f655930ff4deeb80077a5f190fa42a7adbc
SHA512 db35d78aa0408997f73b05d98b93ec311163f2e8d19e6661cb7608b6302d9c8bbbdb924a98240f74b170b2ac7f9e0a8a96c4027e77472784d0958e4a04ceecde
TLSH
T15EE068753D829C696233A67855DFF16C60424830924AED85E05073DB2CD57C9EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_grptipg.html

SHA256 7d48707e30a33b22ee3bd4e606eeac4b435112a0b598f3acadd210b579ac545d
MD5 0c69c6bebb377eedbd2a012e34215631
SHA1 2a6b8f655930ff4deeb80077a5f190fa42a7adbc
SHA512 db35d78aa0408997f73b05d98b93ec311163f2e8d19e6661cb7608b6302d9c8bbbdb924a98240f74b170b2ac7f9e0a8a96c4027e77472784d0958e4a04ceecde
TLSH
T15EE068753D829C696233A67855DFF16C60424830924AED85E05073DB2CD57C9EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_loctip.html

SHA256 2a0f0f15796a8e422a14eb7e3f940236caa650b4ba384da020a43fdf381da3cb
MD5 3f90e0a3e15f67c4e7c5a8186a1023fb
SHA1 40f2b251f9d81366ab0d77c90783cd568e3b5498
SHA512 417f145b35ff8295564f0e67054f306ec691ff1d1ebf7861130896261cfc55a410fcb61fd1591db762db836d1484bf8a360985e7715426c64208c61aa68e40e9
TLSH
T14AE068753DC29C696233A6B419DFF15C60424820824AEC85E090A3DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_loctipg.html

SHA256 2a0f0f15796a8e422a14eb7e3f940236caa650b4ba384da020a43fdf381da3cb
MD5 3f90e0a3e15f67c4e7c5a8186a1023fb
SHA1 40f2b251f9d81366ab0d77c90783cd568e3b5498
SHA512 417f145b35ff8295564f0e67054f306ec691ff1d1ebf7861130896261cfc55a410fcb61fd1591db762db836d1484bf8a360985e7715426c64208c61aa68e40e9
TLSH
T14AE068753DC29C696233A6B419DFF15C60424820824AEC85E090A3DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_logtip.html

SHA256 991ef2b35228eb532c8c91f4b132eef7650cd0d64b1f1b76ed9bf76b6dcd4a94
MD5 d809333fe9e641e9b716079d66b846b3
SHA1 972044ed77de37f94d93cd91ef9c550e9179fd40
SHA512 e58c26ce7f9b1a3be442e3632d9b0ec2580a054ef9760456277158256465eb13abf8daf057f9e51206543b992d0e25d0c8a97e1dcef297c67655b6f3fd392471
TLSH
T1BBE068753D869C696233A67415DFF25C60424920D24AE985E05063EB2CD57C5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mailatip.html

SHA256 ca075094980e012d229636e306c5f7bd7f4c64b289b9ae9e6c10235b33bc76f2
MD5 795578f31388f59a4f756cf414709b03
SHA1 713ca93085f7fafb0ede21afd7b1967b0fa83b97
SHA512 d4899ae1b3bfee9813559cf40faa8231214c40fd850f997432098d601f02f61ab142c646425389944e6231d617baec69396dcf168362d3a53dba5ba9eaf8daca
TLSH
T162E068753D829C696233A67825DFF16C60524820924BE985E05063DB2CD5BC5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mailtip.html

SHA256 8de926799383eb7512b984ba933ff500eac0e5a2bb3ab92d4bba0f1581a16e57
MD5 ed44f4353185287d4df96162e25fbc0a
SHA1 ece7396fb50bfa5ebe5306419df34b4ae6d1bce7
SHA512 1026b29a89ca8492ed016725d5b483c3463246c2b5eb925b4a9ef7f9d206813f706ec29dfa06783fb6ef17d824fcc43aa14f1c6c18a0423c2d36d0bee59d1140
TLSH
T18DE068753D829C696233A67425DFF15C60424820924AE985E05063DB2CD5BC5EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_map.html

SHA256 04e8828804d80cad0180b26c26ad2f8cfe6c6d050fac423aae3418ab74fecf58
MD5 d916eac821e4404ce049fa45017ed826
SHA1 b73e4de8cad6ca0a4a37378f93bb8c3006df9b47
SHA512 111abf679343dc66cead076127a6c20523deeda0bc6607165abfcffab89e8b3b5ad88751f6b2981a9c36fa78d51c7f26e243b4de5881d5ad18364d2aaf221783
TLSH
T1724140B3528A8D34467300756267AB48F4924011E71F2AC0FC8946C7FED2E33C6A779D
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mlbtip.html

SHA256 9bfa65e6988edc56e43457b6ccbe5baea4cb9456eaeff6dc7cddaea92c159df7
MD5 d4191fe550973a78c7ec668c7fe6c6ea
SHA1 ded7935eef822c2896d0f7a97b1a8cc7aaa54145
SHA512 46a68061a90e811dfe6d5b230a569d8895290226da23f001692de59003a6522be8f9590078a892bce523a3bedf7fcd9d94f1cd5c3122d40878c860a454f7a172
TLSH
T139E068753D829C6A6233A67415DFF15C60424820928AE985E05063DB2CD57C5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mlbtipg.html

SHA256 9bfa65e6988edc56e43457b6ccbe5baea4cb9456eaeff6dc7cddaea92c159df7
MD5 d4191fe550973a78c7ec668c7fe6c6ea
SHA1 ded7935eef822c2896d0f7a97b1a8cc7aaa54145
SHA512 46a68061a90e811dfe6d5b230a569d8895290226da23f001692de59003a6522be8f9590078a892bce523a3bedf7fcd9d94f1cd5c3122d40878c860a454f7a172
TLSH
T139E068753D829C6A6233A67415DFF15C60424820928AE985E05063DB2CD57C5EEC33A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_movtip.html

SHA256 52e481e13b174611027027e4f2b91825f769fc2be24ded7090e9202c0f62203d
MD5 bee7973aeecda288e32d0ceaa396d910
SHA1 f72462e2564e4dfac40ae4437ee895b3dc721920
SHA512 de017a47e7cd913eab708334d81dd499ce1a6e4271f73c689d26a4da5d1dec6987da285698491e5317ef637dc770dd78a4cfe1e9cd8a1a9aa5fb623a8d808ac2
TLSH
T1B4E068753DC29C696233A6B415DFF15C60424820824AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_movtipg.html

SHA256 52e481e13b174611027027e4f2b91825f769fc2be24ded7090e9202c0f62203d
MD5 bee7973aeecda288e32d0ceaa396d910
SHA1 f72462e2564e4dfac40ae4437ee895b3dc721920
SHA512 de017a47e7cd913eab708334d81dd499ce1a6e4271f73c689d26a4da5d1dec6987da285698491e5317ef637dc770dd78a4cfe1e9cd8a1a9aa5fb623a8d808ac2
TLSH
T1B4E068753DC29C696233A6B415DFF15C60424820824AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_msgratip.html

SHA256 6baeee72f8bfacd6781dc6700c44b254bb5eae2f564e152085537e4a63994555
MD5 61c44f2b7792ed0282d7a5fe8bb1dcca
SHA1 717139c3680a9cff0a41442a249ee8c842c3380a
SHA512 1eb44d20bb62eb858c175c19074a08f1d74707a9407eca25334c4fe4c88aa812cfdaa67847e72db4623cbefd14f47c49b6149bf123807347d9d678c59d3b847c
TLSH
T16EE068753E829C69A233A67415DFF26C60428820924EE985E05073DB2CD57C5EEC37A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_msgrtip.html

SHA256 6606917e5cc61ca4fb113abc997fe89a9fd37a40d47cc25b13c446529f9f806a
MD5 b1aa92941b5f9c84beb46272aad5a545
SHA1 176896106305d20ea7623beafe91f291e4ac1b68
SHA512 d5045d9aac41cd939ecf386b5244683a67ae1b8fa3b67f9b73b55bc0a4547289f395f8d02efc84ae62e15d6bc9b3b789c5654f643ef96b69a3f354cfcc117831
TLSH
T17FE068753D829C696233A67415DFF25C60424820924AE985E050B3DB2CD57C5EEC37A2
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mustip.html

SHA256 7e11e743e510e85394b444045ddd32e1df0989ce009ac087482c35842c39c81f
MD5 52fce84185a03b7af0e44455e15aa010
SHA1 58c5d8a2690ac4c8964d8acec319a649ad66cea4
SHA512 b01501903fb5dfcefe54d7b47348779bfedb00540589843284b343ff9a3f2236d71decf23321f54e601e4441d3390e7278082ca80fb861906ecf7559bbedeebc
TLSH
T179E068753DC29C696233A6B415DFF15C60424820824AED85E09073DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_mustipg.html

SHA256 8ec15c00554977c1d479c60e85655939fb8766f813a131ad7ab96c540f3d7851
MD5 4dba0b149959d53c43d34fbea9e8f7a2
SHA1 11782b87259ff1e41cce8ddc461c464e646c15dc
SHA512 80bab4986f81482f3799da30dce6e867e2aacb07571bd07a62a6ba32595efb70e55eada72333754d09121116da0470e7beab9d291236290e4fa6f8914ef6c5a0
TLSH
T162E068753DC29C696233A6B415DFF15C60424820924AED85E09073DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$_30_/Data/dlg_nbatip.html

SHA256 054e2c85438ac10cb42fa1ff168f2219b275194e40a17d49c8a6ff2b84569891
MD5 a5fddc5d4a68287aafb2f62b0106aa0b
SHA1 5b55dc37dbe6d5f2b1c6bcbea7941be773044d4c
SHA512 c1c5a9017418cc61dec84daf861c83f340d867d232079c4f007a6c63eded91657637237d9ef13b8ff252e49c2ed04c237bce31402e652800e864549b1df72943
TLSH
T18DE068753DC2AC696233A67415DFF26CA0424820924AE985E050A3DB2CD5BC5EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_nbatipg.html

SHA256 054e2c85438ac10cb42fa1ff168f2219b275194e40a17d49c8a6ff2b84569891
MD5 a5fddc5d4a68287aafb2f62b0106aa0b
SHA1 5b55dc37dbe6d5f2b1c6bcbea7941be773044d4c
SHA512 c1c5a9017418cc61dec84daf861c83f340d867d232079c4f007a6c63eded91657637237d9ef13b8ff252e49c2ed04c237bce31402e652800e864549b1df72943
TLSH
T18DE068753DC2AC696233A67415DFF26CA0424820924AE985E050A3DB2CD5BC5EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_newstip.html

SHA256 33df84a9bd49e4c4035818f9a9e6341e86cedea36a03fc8fc807e30bbd0652e2
MD5 1c87734e815b5442dec3e32ac1f4ddd3
SHA1 60c6b127763a788803114623b88aab867b37b3bf
SHA512 95efb539668c0979817f027046c6dbce2539dfa4908886956b71e8e0633505ef78ec08872c90d1b4484e349a43be2b34278c0086651f877cda2b3b7d493e253f
TLSH
T1B6E068753DC29C696233A67425DFF15C60824820924BE985E050B3DB2CD57C6EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_newstipg.html

SHA256 33df84a9bd49e4c4035818f9a9e6341e86cedea36a03fc8fc807e30bbd0652e2
MD5 1c87734e815b5442dec3e32ac1f4ddd3
SHA1 60c6b127763a788803114623b88aab867b37b3bf
SHA512 95efb539668c0979817f027046c6dbce2539dfa4908886956b71e8e0633505ef78ec08872c90d1b4484e349a43be2b34278c0086651f877cda2b3b7d493e253f
TLSH
T1B6E068753DC29C696233A67425DFF15C60824820924BE985E050B3DB2CD57C6EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_newtip.html

SHA256 c33810eb1b7a7303209fa8916ec1eecf7284c5efe2b3119eb8ab6f3b0c5eeac4
MD5 0a72c141312023f12ac2a6d06b3f0fdd
SHA1 1249c02c242cc5042dc85617e0c551914e50c3b1
SHA512 fe1e956fa5e012d108e5c8e8f936caaa660f04f4728e68775cd8a54a34c35ad187e02dd2fb1c20cda552b4df6b4746ba6899fc8fc077f1d70ff5d65fca801567
TLSH
T184E068753DC29C696233A6B425DFF15C60824820824BEC85E090B3DB2CD57C6EEC3396
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_newtipg.html

SHA256 c33810eb1b7a7303209fa8916ec1eecf7284c5efe2b3119eb8ab6f3b0c5eeac4
MD5 0a72c141312023f12ac2a6d06b3f0fdd
SHA1 1249c02c242cc5042dc85617e0c551914e50c3b1
SHA512 fe1e956fa5e012d108e5c8e8f936caaa660f04f4728e68775cd8a54a34c35ad187e02dd2fb1c20cda552b4df6b4746ba6899fc8fc077f1d70ff5d65fca801567
TLSH
T184E068753DC29C696233A6B425DFF15C60824820824BEC85E090B3DB2CD57C6EEC3396
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_nfltip.html

SHA256 f553233dc9272b7802abe365c06d869aa1d64268508b499ec91cde164cc224c9
MD5 9a597d15a20cbc6a7b953c69160e8345
SHA1 dd315ea199d23a34fc49719c4d3011e136657a7d
SHA512 77da948d15cb69c7886b100ccf2dfadf9de1083c564fd5cadea2d0dffb7ead73e67c9cfdc8641bea2db61f9559f861117e35ca62294bd4bc9a72f56b85683ec2
TLSH
T181E068753D82AC696233A67415DFF25C60424820D24EE985E05063DB2CD5BC5EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_nfltipg.html

SHA256 f553233dc9272b7802abe365c06d869aa1d64268508b499ec91cde164cc224c9
MD5 9a597d15a20cbc6a7b953c69160e8345
SHA1 dd315ea199d23a34fc49719c4d3011e136657a7d
SHA512 77da948d15cb69c7886b100ccf2dfadf9de1083c564fd5cadea2d0dffb7ead73e67c9cfdc8641bea2db61f9559f861117e35ca62294bd4bc9a72f56b85683ec2
TLSH
T181E068753D82AC696233A67415DFF25C60424820D24EE985E05063DB2CD5BC5EEC33A6
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_opt.html

SHA256 5b2a5558cdf0136e7efe705ac6405bb2e3ddcdb3e22c80f0d0ab2245b8fce874
MD5 c390b0f37094a51f7fa9755c21093efc
SHA1 d870ed381311160bff95cee35e351c0b1a23f16e
SHA512 29bbf6f894e936676b2de77d10ef513ebf16c6f568fbc88afd57526d2975c1c285ba7a37bee237a7a029748cd170c6e6d1204c38d04154ed6b0428ac4cf8fef9
SSDEEP 192:pyhjM23cLbnPUcCqgj8p0LOQbtJhAn/FpQMuN6KJ/uAyyUSEm:8h4L0js61AndpQMIJ/uQEm
TLSH
T17B52B7C2814A9C3B8F370864610297C5FEA548064B515690FC2ECD8F7FE5DA896EBE78
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_pub.html

SHA256 2fe728542c07e2763c6ad87dbd5beae6dad83c5d0f5254a15e05c4473440a651
MD5 c37b8f5f0be97e5f94ea825cdd55c656
SHA1 cec3494b61bc0e3b30bdac5bc3257cff8c137c5f
SHA512 59d0a657bf9789ed8b7d11e3012d33d6ce6769f80e4fa802b3efa00cbe2429d4eea3711126a68bbd8596ecab430100e4bfa1e032c86cae10a032fbb5438eb94c
TLSH
T1157154772251EF3945B700B69567AF58B4B611119B021500EC2EA1C7BBB2823C6EFB7E
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_shotip.html

SHA256 50993bb6ad0b22c36d1ac40eb9095945b9cbd07bbd8bf5be12b7d7eda51e5e62
MD5 155617489139227d76033951d6a5b16a
SHA1 bf51bed637a45c32369892dfecacd8cc169926a9
SHA512 97f2972ce99e3e8dde992945983ff2b6543a7fdde7c4755f66013b4cfea98cad502e55c7a6410a963ea6e6d8ddddd70875b80215f896b29805ebe5ab360cc5b3
TLSH
T15AE068753DC29C696233A6B815DFF15C60428820C24AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_shotipg.html

SHA256 50993bb6ad0b22c36d1ac40eb9095945b9cbd07bbd8bf5be12b7d7eda51e5e62
MD5 155617489139227d76033951d6a5b16a
SHA1 bf51bed637a45c32369892dfecacd8cc169926a9
SHA512 97f2972ce99e3e8dde992945983ff2b6543a7fdde7c4755f66013b4cfea98cad502e55c7a6410a963ea6e6d8ddddd70875b80215f896b29805ebe5ab360cc5b3
TLSH
T15AE068753DC29C696233A6B815DFF15C60428820C24AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_srchtip.html

SHA256 8c38b283093979eb0fb3a65e0ab16a7ceb4606248afa35825edae95767946bff
MD5 deded03163e0ae51398686aec08b6cbe
SHA1 2d4b53bde1ade49c9f271a56668cc9ba56cf2cfb
SHA512 bacab5957dede55574c03125fe30d566a4802d9aa2f57ea3e539d77669cc9ed97472f5a0ae4a3cf2b0c803f51dbb6cd29a1db9e240a5455bee6db2542903f1c3
TLSH
T1C0E0C6742C8AAC6A3233A6B841DFF11C60424820928BE880E050A38B2CD539AED83291
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_tratip.html

SHA256 a96ba598fb8e3264f9319c0abebb07a37c728991df50fb380288c5d5538a0032
MD5 5301bb56668988a06ff470e91dda7525
SHA1 03db2f4a7859bb323e45ca6a5f4b7b3c36a4f1be
SHA512 19e3561742a14aadd994fee0255ab41bdbd660db0da46362e412bdb1555dde7fe26599c2debba496a0099f4ce96b04c7aba41fbaeeb13783f60076fd5590d31d
TLSH
T1F8E068753DC29C69A233A6B415DFF15C60424820828AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_tratipg.html

SHA256 a96ba598fb8e3264f9319c0abebb07a37c728991df50fb380288c5d5538a0032
MD5 5301bb56668988a06ff470e91dda7525
SHA1 03db2f4a7859bb323e45ca6a5f4b7b3c36a4f1be
SHA512 19e3561742a14aadd994fee0255ab41bdbd660db0da46362e412bdb1555dde7fe26599c2debba496a0099f4ce96b04c7aba41fbaeeb13783f60076fd5590d31d
TLSH
T1F8E068753DC29C69A233A6B415DFF15C60424820828AEC85E09063DB2CD57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_upg.html

SHA256 0d3b69f4c12bf6898b2174b25abac9277bf9e21e46e08b278f144a662b4a4ec0
MD5 fc9096c0837dc77b1a68d8b1dbd2c0f9
SHA1 4141da7b9b80c14023fc57de998b259fdedffb13
SHA512 3a56bd57a9ecff48ec88ac466a9419a732b0f3c5229f4ded62dc3acf651d53dcb165ac1058361b9e2c9dd2da55c98ea08fb5e07ece5691e58e8d11911faf686e
TLSH
T1EBF0C09C3402881F556324758A291984526612720243DB01B1C8CC9EBD9C2E5E6CB9DE
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_weatip.html

SHA256 f5e7c96a1d11a9e905aaf40f2fd6e1e665dea37950bf2feae55403a1094817c0
MD5 855fda424fdccce659d8bf77f7f94ef1
SHA1 bddbe24a9ecaeb2abdeecdd098ba055eabdf6bae
SHA512 ea06c7001e14db93b745c7b6f9d74f5aa2171122a0c95b9452717b4523a9f01a1264f8b8b1226911634fb27fdc77de6d8ca582863b5a21317961d0b3d5f6f7f5
TLSH
T178E068753DC29C696233A6B425DFF15C60824820828AEC85E09063DB2CE57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_weatipg.html

SHA256 f5e7c96a1d11a9e905aaf40f2fd6e1e665dea37950bf2feae55403a1094817c0
MD5 855fda424fdccce659d8bf77f7f94ef1
SHA1 bddbe24a9ecaeb2abdeecdd098ba055eabdf6bae
SHA512 ea06c7001e14db93b745c7b6f9d74f5aa2171122a0c95b9452717b4523a9f01a1264f8b8b1226911634fb27fdc77de6d8ca582863b5a21317961d0b3d5f6f7f5
TLSH
T178E068753DC29C696233A6B425DFF15C60824820828AEC85E09063DB2CE57C5EEC3392
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_wp.html

SHA256 7a60b084b034e963daf1973a3f89a4635045e28bc500961cbe5c6646767fc5b7
MD5 e3155d81042eb08cc983eace9ea85a71
SHA1 50a40f28d05f90ca33bb280689e9a06546102cd1
SHA512 9283710f8b02b913d566f86075b0f6c1220c1f83e1b7d3262927a7f21a7ca7b6b11bc25f6e31078d8c52c7d836fb5bfdd86558c975263d8a8519891cdf6fa256
SSDEEP 96:JbmjebhEy5NJRJ6JY5lSExoTeUPTHRaeTye8RkOU2LRDAJgi:JpGy5R5lSEbORahkOUv
TLSH
T1B9A17576734EA11896630750E57F9B45E50DD40B3203D4A1BAE68A33E9CB483F73A7AC
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

NSIS installer

installer

$_30_/Data/dlg_wp2.html

SHA256 32b234ac10b7e1ccead717c307eb39c812efc9b5b83233df6eb8f147909f75f6
MD5 f485f7785515df9a70f985f1175bea3d
SHA1 b8647075536a0d60a48765c4528a5132ebd805e9
SHA512 f112cbc24a145e794db1dd80088d6dc03327c6b3d0632512567d258fb994c34c8d8f8ddece5ed74b92e150fb937e5bef2962250fbe133c688c052a0bcc7046ff
TLSH
T1A601D0291C6448B8F031E570A2AAA1C8A48201234181DB88B48C729F5FB0AF6D6876F5
MD5 SHA1 SHA512 TLSH

polyglot

NSIS installer

installer

YCAPlugin.dll

IMPHASH 3ead64331cd4b4ae74f81a705b453b34
SHA256 29ef05384ab0728b43fe5ff40ce14852bda11c35180b4b7a0d854c404bb5b4e8
MD5 3fe1db89c149406e78fdca005f09b689
SHA1 89a7836c5ad01d03d5577c5c03bf93b3bc275f29
SHA512 73e11788f22c16fec9eb1773cefc28d08900e76afbbef1fda048956e0e6b8959602bce55530642966058060ca50d9253f351eb7188310b1e17bc9c640c5d9248
SSDEEP 1536:DwZnd9GmJrtZeSW4ZBVlaxvzHxFRhjiz+NrcqOtQx/vi3kKCdJ:DwpGGt1W4STRhjvBcqOtQ1igj
TLSH
T1DAB37C5231D5C4B2F86D007E4846C762973BBDA0CEA599833FA4278E5EB63D1DF29342
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

21:c2:f0:5a:ad:08:dd:98:c3:67:59:31:05:f8:8a:6d:b7:79:b2:0e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

40500

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ycaplugin\release\YCAPlugin.pdb

kernel32

SizeofResource RaiseException LeaveCriticalSection LoadResource FindResourceA GetLastError LoadLibraryExA GetModuleHandleA InitializeCriticalSection InterlockedIncrement FreeLibrary GetModuleFileNameA InterlockedDecrement WideCharToMultiByte lstrlenW lstrcmpiA ReleaseMutex CreateMutexA CloseHandle lstrlenA WaitForMultipleObjects GetVersionExA LoadLibraryA GetProcAddress CreateFileA GetConsoleMode GetConsoleCP SetFilePointer GetStringTypeW EnterCriticalSection IsDBCSLeadByte MultiByteToWideChar DeleteCriticalSection SetThreadLocale GetThreadLocale WaitForSingleObject GetStringTypeA RtlUnwind FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStartupInfoA GetFileType SetHandleCount Sleep GetStdHandle WriteFile ExitProcess HeapSize VirtualFree HeapCreate HeapDestroy GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings InterlockedExchange GetACP GetLocaleInfoA HeapReAlloc HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapFree GetCurrentThreadId GetCommandLineA GetProcessHeap GetCPInfo GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LCMapStringA LCMapStringW FreeEnvironmentStringsA

user32

UnregisterClassA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetDesktopWindow CharNextA

advapi32

RegQueryValueExA RegQueryInfoKeyA RegSetValueExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegEnumKeyExA RegCreateKeyExA RegOpenKeyExA

shell32

ShellExecuteExA

ole32

CoTaskMemAlloc CoCreateInstance StringFromGUID2 CoTaskMemFree CoTaskMemRealloc

oleaut32

VariantInit SysAllocStringLen LoadRegTypeLi SysStringLen RegisterTypeLi LoadTypeLi SysAllocString VarUI4FromStr UnRegisterTypeLi SysFreeString VariantClear

YMERemote.dll

IMPHASH d5a024598a4bf0997e9e697c67bd4b82
SHA256 9e584ae8492842724884a380864c7e34e564f28a1a7a18d4090ebaa47df4f477
MD5 c0439467fa3896ae7eff772b16cbd70d
SHA1 66fbfc47408ccbc0d18cb85d0081f814a4d2f466
SHA512 dc521223159a1b5a8b45bf5f600d6e80f0055358feeb7b63f47b320814358971e04b34c46a0d81d7397597e257146105d631e824a71ac85ff75811ab8e5f3c41
SSDEEP 3072:cEIlvh2uNsjFuG2SjWsef8jzYk7m0YQPtuAEFkfCchIiB:cEihixuG2SjWxf8hM/tu
TLSH
T13814AE21B751C4B7F8A701708062CB69D6B2BC54CF218157B39CA6CE9E35392EB393D6
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

58:54:93:e8:7d:d6:91:c1:3d:67:21:2f:3b:d4:2d:4a:5e:1f:e3:f8

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

72813

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ymeremote\release\YMERemote.pdb

comctl32

ImageList_AddMasked ImageList_Create ImageList_DrawEx

kernel32

LockResource LoadLibraryA GetProcAddress GetVersionExA WaitForMultipleObjects WaitForSingleObject GetACP FlushFileBuffers CreateFileA WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer RtlUnwind GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStdHandle WriteFile HeapCreate HeapDestroy ExitProcess HeapSize Sleep LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetFileAttributesA VirtualQuery GetSystemInfo VirtualProtect HeapReAlloc GetLocaleInfoA InterlockedExchange VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetCurrentProcess GetCurrentProcessId lstrcpynA CloseHandle CreateMutexA OpenEventA SetThreadLocale GetThreadLocale GetCurrentThreadId SetLastError LeaveCriticalSection MultiByteToWideChar GetLastError LoadLibraryExA FindResourceA GetModuleHandleA LoadResource SizeofResource InitializeCriticalSection WideCharToMultiByte lstrlenA IsDBCSLeadByte lstrlenW FreeLibrary DeleteCriticalSection ReleaseMutex InterlockedDecrement InterlockedIncrement RaiseException EnterCriticalSection GetModuleFileNameA lstrcmpiA FlushInstructionCache

user32

CallWindowProcA DefWindowProcA GetWindowLongA SetWindowLongA CharNextA CreateWindowExA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetMessageA PeekMessageA EndDialog RemovePropA SetWindowRgn SetPropA GetWindowRect IsZoomed GetWindowThreadProcessId RegisterWindowMessageA EnumThreadWindows FrameRect FillRect UnionRect DialogBoxParamA DrawTextW EndPaint FindWindowA InsertMenuItemA LoadStringA GetMenuItemCount AppendMenuA BeginPaint DestroyMenu GetDlgItem TrackPopupMenu KillTimer ClientToScreen CreatePopupMenu SetTimer TrackMouseEvent MessageBoxA GetCursorPos GetDlgCtrlID ScrollDC PtInRect IntersectRect MapWindowPoints GetPropA SetForegroundWindow GetClassNameA ShowWindow LoadImageA GetClassInfoExA RegisterClassExA SetWindowPos PostMessageA LoadCursorA LoadBitmapA InvalidateRect InflateRect DrawTextA OffsetRect ReleaseDC GetDC SendMessageA SendMessageTimeoutA GetParent GetClientRect DestroyWindow IsWindow UnregisterClassA

gdi32

ExtCreateRegion LineTo MoveToEx CreateFontIndirectA CreateCompatibleBitmap GetClipBox GetStockObject SetBkColor SetTextColor CreatePen CreateSolidBrush SelectClipRgn CombineRgn CreateRectRgn BitBlt DeleteDC CreateCompatibleDC DeleteObject GetObjectA SelectObject SetBkMode

advapi32

RegCreateKeyExA RegOpenKeyExA RegSetValueExA RegDeleteKeyA RegCloseKey RegQueryValueExA RegDeleteValueA RegEnumKeyExA RegQueryInfoKeyA

shell32

ShellExecuteA

ole32

CoCreateInstance StringFromGUID2 CoTaskMemRealloc CoTaskMemFree CoTaskMemAlloc StringFromCLSID

oleaut32

LoadTypeLi UnRegisterTypeLi SysAllocStringLen VariantClear VariantInit LoadRegTypeLi VarUI4FromStr DispCallFunc RegisterTypeLi SysFreeString SysStringLen SysAllocString

YPUBC.dll

IMPHASH f063b20f8606a0032283d06ba86aaa26
SHA256 f77591d4f966d22438345fbd718e80edc1fc447e9ca8ccb2efea21706acdda58
MD5 92af662a98bc68cb79d64bd27c99ee8e
SHA1 c8a48ee6242516a90e9270c05314a4bf84458a21
SHA512 1a065d5ce03462e6494a25d420003b16b876332fcc4304f27b1b5918db4751f9de080c64eb9317eb09d67b202bbd511c2a8c69b885508b94a4e74bc83c777083
SSDEEP 3072:z9WaYWUbRboV8dmDZl2XgkWpJQBhgtCt4bvIwShyp4+NuRasyIltpfLaU11/1:avotD/pwgt7byhypWcUg6/
TLSH
T1E5148D1273D2D472D157003C4A67ABA6BBFFE9100F734843238907AC9E766C6E639729
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

95185

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

d:\Development\Visualstudio\YBrowser_v34\src\Ypub\RelCompanion\YPUBC.pdb

kernel32

MulDiv lstrcpynA InterlockedIncrement InterlockedDecrement IsDBCSLeadByte Sleep GetCurrentThreadId GetModuleFileNameA FreeLibrary LoadLibraryExA GetModuleHandleA HeapAlloc GetProcessHeap FlushInstructionCache GetCurrentProcess GetTickCount IsBadWritePtr IsBadReadPtr HeapFree CreateMutexA CloseHandle ReleaseMutex WaitForSingleObject QueryPerformanceCounter UnmapViewOfFile GetSystemTime MapViewOfFile CreateFileMappingA OpenFileMappingA GetDateFormatA InterlockedCompareExchange lstrcpyA lstrcatA GlobalAlloc ReadFile SetStdHandle SetFilePointer IsBadCodePtr LoadLibraryA GetStringTypeW GetStringTypeA WriteFile UnhandledExceptionFilter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount SetUnhandledExceptionFilter GetSystemTimeAsFileTime GetCurrentProcessId TerminateProcess LCMapStringW LCMapStringA GetProcAddress TlsGetValue TlsSetValue TlsFree SetLastError TlsAlloc GetCPInfo GetOEMCP VirtualFree HeapCreate GetCommandLineA InterlockedExchange GlobalLock GlobalUnlock FindFirstFileA FindClose lstrcmpiA lstrlenA OutputDebugStringA EnterCriticalSection LeaveCriticalSection FindResourceExA FindResourceA LoadResource LockResource SizeofResource DeleteCriticalSection InitializeCriticalSection GetLastError RaiseException lstrlenW WideCharToMultiByte MultiByteToWideChar GetVersionExA GetThreadLocale GetLocaleInfoA GetACP FlushFileBuffers RtlUnwind ExitProcess VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapSize HeapReAlloc HeapDestroy

user32

PtInRect UnionRect CharNextA SetWindowPos SetWindowRgn OffsetRect EqualRect IntersectRect ReleaseDC GetDC UnregisterClassA SetWindowLongA DefWindowProcA RegisterWindowMessageA SetWindowsHookExA UnhookWindowsHookEx GetClassNameA GetPropA PostMessageA CallNextHookEx MessageBeep RegisterClassExA GetClassInfoExA LoadCursorA CreateWindowExA wsprintfA GetParent SetFocus ShowWindow GetFocus IsChild BeginPaint GetClientRect EndPaint InvalidateRect IsWindow DestroyWindow GetKeyState CallWindowProcA GetWindowLongA

gdi32

CreateDCA LPtoDP SetMapMode SetViewportOrgEx DeleteDC GetDeviceCaps CreateMetaFileA SaveDC SetWindowOrgEx SetWindowExtEx RestoreDC CloseMetaFile DeleteMetaFile CreateRectRgnIndirect SetTextAlign TextOutA

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc OleRegEnumVerbs OleRegGetUserType OleRegGetMiscStatus CreateDataAdviseHolder CoCreateInstance CreateOleAdviseHolder StringFromGUID2 OleSaveToStream WriteClassStm OleLoadFromStream

oleaut32

RegisterTypeLi UnRegisterTypeLi SysAllocString SysFreeString SysStringLen VarBstrCmp VariantInit VariantClear SysAllocStringLen SysStringByteLen VariantChangeType VarUI4FromStr SysAllocStringByteLen LoadRegTypeLi LoadTypeLi OleCreatePropertyFrame

shlwapi

PathFindExtensionA

YTAntiSpy.dll

IMPHASH b9926d7ffd0efba81ed49dd7de4fdb2d
SHA256 b0eadd30d1b8d21c4b7fd51bdd13d9a0f863b21d226cf8bedda08a0219871c0c
MD5 bf08b70afbf0bd7102713b4eccd07afc
SHA1 3aee842e7325a6a53829b3c7995c7c8caa7ca2ba
SHA512 70ed1112e0e9e4ab0bcd70e57bf0df7100ff4fbed48d94d4a053d6941afec36b97723f3dd6ff40b8c8833d591b2c78d4b14a08c4a9796636f7988a3096514a0f
SSDEEP 1536:Nac8i6fyddCnEsJrbJm6RWy5X4E2x1qeq9/7U:NcfyddC1Jrbg91qdU
TLSH
T1AD338D0272D9D0B3D66603342A2997661BFDFE005CD0A14A5B337ACD2EB0F96EF19752
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7f:a1:3b:0c:e1:75:71:60:76:b9:a5:bd:04:af:79:92

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

57:64:6e:2b:55:00:23:d4:90:53:4a:55:3e:ab:0d:0a

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2009

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

73:45:1f:8f:5c:64:a3:d4:37:dd:09:2d:d4:9d:83:65

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 1, 2005 - Aug 21, 2006

Minor OS version

0

Major OS version

4

Entry point

28639

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\work\Yahoo\depot\toolbar\Main\ytie\plugins\YTAntiSpy\ATL30 Release\YTAntiSpy.pdb

msvcrt

_adjust_fdiv _initterm ??3@YAXPAX@Z _purecall realloc memcmp _wtoi toupper tolower wcscspn _wcsnicmp memmove wcsstr _mbsnbcmp strcat malloc wcslen memcpy free atoi strchr memset strlen strcspn strncmp ??2@YAPAXI@Z strncpy strcmp strcpy strrchr

imagehlp

ImageEnumerateCertificates ImageGetCertificateHeader ImageGetCertificateData

kernel32

CloseHandle GetShortPathNameA LoadLibraryExA GetLastError FindResourceA SizeofResource DisableThreadLibraryCalls lstrcatA lstrcpyA HeapDestroy lstrcpynA IsDBCSLeadByte lstrcmpiA InterlockedIncrement CreateThread Sleep MultiByteToWideChar LoadLibraryA GetProcAddress FreeLibrary DeleteCriticalSection InitializeCriticalSection lstrlenW WideCharToMultiByte lstrcmpA CreateFileA GetModuleHandleA EnterCriticalSection LeaveCriticalSection GetModuleFileNameA LoadResource InterlockedDecrement lstrlenA

user32

GetDesktopWindow CharNextA LoadStringA SetForegroundWindow SetWindowPos FindWindowA

advapi32

RegQueryValueExA RegQueryInfoKeyA RegDeleteValueA RegCloseKey RegSetValueExA RegEnumKeyExA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegCreateKeyExA

shell32

ShellExecuteExA

ole32

CoTaskMemAlloc CoTaskMemFree CoCreateInstance CoTaskMemRealloc

oleaut32

SysAllocStringLen SysFreeString SysStringLen VariantClear VarUI4FromStr LoadTypeLi RegisterTypeLi LoadRegTypeLi SysAllocString

YTBM.dll

IMPHASH de8aaf85132cce953d28f81eeb7b96a5
SHA256 4c123e02ccc95ac70a7f68cee57ad709d1b30b0338316f5196bc5151cd5c5b91
MD5 28090b517d6c72729a2f7a575e891670
SHA1 b5941d4a454b9197fee3f2964e72b6d844ca0781
SHA512 3fc9ae3a8fe5e55425c26a3035798a83090d3a7f1d415cb2a0070008a3d6dfc4c7b5b56ce03d5c59630ee2746a8357ec9a70b1f35b8241f4a41d35dde954cbd2
SSDEEP 6144:394S8lp2zA587POOocm0ZCZK78KZjd7jmn4N5A:3uS8b2U5fqm47Hh1mnH
TLSH
T16B649E02F2C19472EC6515317057D3BD4B7ABE73A951C643B350FA8EED331E29A2938A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

6e:ec:b9:0c:b5:1b:5f:16:48:2a:7f:9d:bf:47:5e:8c:de:48:43:d7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

170491

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ytbm\release\YTBM.pdb

wininet

InternetCrackUrlA

kernel32

GetACP GetThreadLocale SetThreadLocale EnterCriticalSection IsDBCSLeadByte SizeofResource InitializeCriticalSection FindResourceA GetModuleHandleA LoadLibraryExA DeleteCriticalSection DisableThreadLibraryCalls lstrcmpiA GetLastError GetModuleFileNameA LeaveCriticalSection SetFilePointer WriteFile GetCurrentProcess LocalAlloc LocalFree MultiByteToWideChar FreeLibrary WaitForMultipleObjects CreateEventA CreateThread SetThreadPriority GetExitCodeThread GetCurrentThreadId SetEvent GetStdHandle GetTickCount QueryPerformanceCounter GetCurrentProcessId GlobalMemoryStatus SetStdHandle FlushFileBuffers GetConsoleMode GetConsoleCP GetEnvironmentStringsW FreeEnvironmentStringsW lstrlenA GetVersionExA ReleaseMutex CloseHandle ReadFile GetFileSize RaiseException CreateFileA CreateMutexA InterlockedIncrement GetProcAddress LoadLibraryA LockResource LoadResource FindResourceExA WideCharToMultiByte lstrlenW InterlockedDecrement WaitForSingleObject GetEnvironmentStrings FreeEnvironmentStringsA SetEndOfFile WriteConsoleW GetConsoleOutputCP GetStartupInfoA GetFileType SetHandleCount HeapSize Sleep ExitProcess VirtualFree HeapCreate HeapDestroy LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA SetLastError TlsFree TlsSetValue TlsAlloc InterlockedExchange GetLocaleInfoA GetFileAttributesA DeleteFileA HeapAlloc HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetSystemTimeAsFileTime GetCommandLineA GetProcessHeap RtlUnwind TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCPInfo GetOEMCP IsValidCodePage TlsGetValue WriteConsoleA

user32

MsgWaitForMultipleObjects DispatchMessageA UnregisterClassA GetMessageA PeekMessageA TranslateMessage CharNextA

gdi32

DeleteObject

advapi32

RegQueryValueExA RegEnumKeyExA RegSetValueExA RegQueryInfoKeyA RegDeleteValueA RegDeleteKeyA RegOpenKeyExA RegCreateKeyExA RegCloseKey

ole32

CoInitializeEx CoUninitialize CoInitialize CLSIDFromString StringFromGUID2 CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString SysAllocString VariantClear VariantInit SysStringByteLen SysAllocStringByteLen LoadRegTypeLi SysStringLen RegisterTypeLi LoadTypeLi VarUI4FromStr UnRegisterTypeLi SysAllocStringLen

shlwapi

StrStrIW

YTMsgr.dll

IMPHASH 5f29b990f25ab18739b103cb53ae77b2
SHA256 ac2d4ed38263e283419d27fef25612345f150503a87d644c54782a4171dd8efd
MD5 84d2e4b6e068c867906b4bb35a37cae5
SHA1 599a1314156ab38ae5ed7186e279817a609fa670
SHA512 412bfb7667b6f21b0b7e61df4e77285bcdcdd08569d4505e2f205c96649b06139085f5ebdc05eb8b7e57476781ed230e9f031a85f63a24067d6e549b9997563b
SSDEEP 3072:q3pGNoBmAfe5MsDik/2jCg7RQV7d97OiGphOng+tj/Jgh54vqDL:GpGGoB9/PgS7U5l4kP
TLSH
T1E4049F1231C0C476D25F013C8847EB2667FABCA04FB5C6837BA59DCE9E34566DB2A346
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

ae:6e:6d:b9:c8:bb:7d:4c:7c:48:ae:b8:8a:a6:64:da:20:78:1b:d6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

88371

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ytmsgr\release\YTMsgr.pdb

kernel32

GetModuleFileNameA GetProcAddress LoadLibraryA DeleteCriticalSection WideCharToMultiByte lstrlenW MultiByteToWideChar GetACP EnterCriticalSection LeaveCriticalSection InitializeCriticalSection lstrlenA lstrcmpiA DisableThreadLibraryCalls IsDBCSLeadByte SizeofResource FindResourceA LoadLibraryExA GetModuleHandleA SetThreadLocale GetThreadLocale GetTickCount CreateMutexA WaitForMultipleObjects WaitForSingleObject GetComputerNameA FreeLibrary SetEvent GetCurrentThreadId CreateThread CreateEventA Sleep CreateWaitableTimerA SetWaitableTimer CancelWaitableTimer GetConsoleMode GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA HeapSize RtlUnwind GetStartupInfoA GetFileType SetHandleCount GetStdHandle WriteFile FindResourceExA LoadResource GetExitCodeThread LockResource CreateFileA GetCurrentProcess GetLastError LocalAlloc LocalFree CloseHandle RaiseException GetVersionExA ReleaseMutex InterlockedDecrement InterlockedIncrement SetThreadPriority ExitProcess WriteConsoleW GetConsoleOutputCP WriteConsoleA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA VirtualFree HeapCreate HeapDestroy LCMapStringW LCMapStringA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP InterlockedExchange GetLocaleInfoA HeapFree HeapAlloc GetFileAttributesA HeapReAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA GetProcessHeap GetCPInfo

user32

UnregisterClassA GetMessageA TranslateMessage DispatchMessageA MsgWaitForMultipleObjects PostMessageA EnumChildWindows IsWindow GetClassNameA IsWindowVisible GetForegroundWindow GetWindowThreadProcessId AttachThreadInput SetForegroundWindow IsIconic ShowWindow LoadStringA CharNextA FindWindowA PeekMessageA

gdi32

DeleteObject

advapi32

RegCreateKeyExA GetUserNameA RegDeleteKeyA RegOpenKeyExA RegEnumKeyExA RegSetValueExA RegQueryValueExA RegQueryInfoKeyA RegDeleteValueA RegCloseKey

ole32

CoUninitialize CoInitializeEx StringFromGUID2 CoTaskMemRealloc CoTaskMemAlloc StringFromCLSID CoTaskMemFree CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoCreateInstance CoCreateGuid

oleaut32

VariantClear SysAllocString SysFreeString SysAllocStringLen VariantCopy LoadRegTypeLi SysStringByteLen SysAllocStringByteLen VarUI4FromStr RegisterTypeLi UnRegisterTypeLi LoadTypeLi SysStringLen VariantInit

shlwapi

StrStrIW

YTNavAssist.dll

IMPHASH 535baadf423fcfb0121e54841b4f3d79
SHA256 f6155e734dfe11cffc93d5d6d9a47678009392327c1e7a37bc16a2f5bd4ea5a6
MD5 4d5ea8fa713123404fd372c59d8e94a3
SHA1 89701f49c78105900ef6bdefc11daee2a3ef5ebd
SHA512 185badb6b1070f8c33d8cbe69d30ed4a5b3a667103b0b8574f4c8a69021a647734ab7b753f22763384eccab91b2e90de5dfedd7277b74170627afeb38c0fdc7d
SSDEEP 3072:pnUzqf3uyZyOabq72pMafjXZdMkvHxPTBfr2iUd9tIjEF33LGbxLz:pOO8qcMsjXA2RPTBlo4gN7W
TLSH
T1E7048E023285C0F2E5AE003D4C56DBAAA377BD508FE5C6837F888B8F5D752959B36385
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d5:07:a3:ab:37:b3:79:ad:b8:1b:b2:c2:cc:de:98:b4:1d:e1:65:fa

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

68533

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ytnavassist\release\YTNavAssist.pdb

wininet

InternetOpenA InternetCloseHandle InternetReadFile HttpQueryInfoA InternetOpenUrlA InternetSetOptionA InternetQueryOptionA HttpSendRequestA HttpOpenRequestA InternetConnectA

urlmon

ObtainUserAgentString CoInternetGetSession

kernel32

GetTickCount DeleteCriticalSection InitializeCriticalSection WideCharToMultiByte SizeofResource LoadResource FreeLibrary FindResourceA MultiByteToWideChar LoadLibraryExA LeaveCriticalSection GetModuleHandleA lstrlenA InterlockedIncrement GetModuleFileNameA lstrcmpiA RaiseException EnterCriticalSection GetLastError IsDBCSLeadByte lstrlenW InterlockedDecrement ReleaseMutex CreateEventA CreateThread CloseHandle SetThreadPriority HeapFree GetCurrentProcessId CreateFileA WriteFile GetCurrentThreadId HeapReAlloc SetEvent Sleep GlobalFree HeapAlloc GetProcessHeap GetThreadLocale SetThreadLocale CreateMutexA WaitForSingleObject WaitForMultipleObjects GetVersionExA LoadLibraryA GetProcAddress QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW GetSystemTimeAsFileTime RtlUnwind GetExitCodeThread FlushFileBuffers SetFilePointer WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetStringTypeA GetConsoleMode GetConsoleCP LCMapStringW LCMapStringA IsValidCodePage GetOEMCP GetCPInfo HeapSize IsDebuggerPresent GetCurrentProcess TerminateProcess SetLastError TlsFree TlsSetValue TlsAlloc TlsGetValue SetUnhandledExceptionFilter UnhandledExceptionFilter GetStdHandle ExitProcess HeapCreate HeapDestroy VirtualFree InterlockedExchange GetACP GetLocaleInfoA VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetCommandLineA

user32

UnregisterClassA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetMessageA PeekMessageA CharNextA

advapi32

RegQueryValueExA RegEnumKeyExA RegQueryInfoKeyA RegCloseKey RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegSetValueExA RegOpenKeyExA

ole32

StringFromGUID2 CoUninitialize CoInitializeEx CoTaskMemAlloc CoGetClassObject CoTaskMemRealloc CoTaskMemFree CoCreateInstance

oleaut32

UnRegisterTypeLi SysFreeString LoadRegTypeLi VariantClear LoadTypeLi SysAllocStringLen DispCallFunc SysStringByteLen SysAllocStringByteLen VarBstrCmp SysStringLen RegisterTypeLi VariantInit SysAllocString VariantCopy VarUI4FromStr

YTSingleInstance.dll

IMPHASH 0507ac23b4583714fb1a8963dc21ef7c
SHA256 2602f6939a595b54d69f9fe023e044a085a9554f0829a9a9991999c6130b1aa3
MD5 f64c4241fe5e519f62c47c361dc671d7
SHA1 165ad669bc3dbdad4ef02c48b7b335fbbbf14151
SHA512 b562c37c22d61fd6eff789c02ad09458dccf8ec4a6eded9758d59d5ac7aa0d8137faf11ee9a04346dfbb1b0d635852c2c2a277567b959c0ad628d39b0e163606
SSDEEP 3072:ow6b+d44Dt93i94grh+DicrNP8DNtthxWWg:Dd44Dt9WncmrR7Wb
TLSH
T1E7F39E2377E2C972C99F023D5411C7A6A7B7BE52DFA081037B682F4E1F742905E2A716
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

7e:16:74:b5:7e:63:81:ab:5e:25:73:9f:f6:e7:13:b3:91:66:d0:c7

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

56724

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ytsingleinstance\release\YTSingleInstance.pdb

oleacc

AccessibleObjectFromWindow AccessibleChildren ObjectFromLresult GetRoleTextW

wininet

HttpQueryInfoW InternetCanonicalizeUrlW InternetConnectW InternetCrackUrlW HttpOpenRequestW InternetCloseHandle InternetOpenA HttpSendRequestW

kernel32

FlushFileBuffers CloseHandle CreateFileA LeaveCriticalSection GetLastError InitializeCriticalSection InterlockedIncrement lstrcmpiA InterlockedDecrement GetModuleFileNameA WideCharToMultiByte lstrlenW GetThreadLocale SetThreadLocale DeleteCriticalSection IsDBCSLeadByte RaiseException SizeofResource LoadResource FindResourceA LoadLibraryExA MultiByteToWideChar FreeLibrary lstrlenA GetModuleHandleA GetCurrentProcessId GetVersionExA LoadLibraryA GetProcAddress WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle InterlockedExchange GetConsoleMode GetConsoleCP SetFilePointer RtlUnwind TlsAlloc TlsSetValue TlsFree SetLastError LCMapStringA LCMapStringW EnterCriticalSection GetLocaleInfoA GetStringTypeW GetStringTypeA TlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess GetProcessHeap GetCommandLineA GetCurrentThreadId HeapFree HeapReAlloc VirtualQuery GetSystemInfo VirtualAlloc VirtualProtect HeapAlloc GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapSize Sleep GetStdHandle WriteFile ExitProcess HeapCreate HeapDestroy VirtualFree

user32

RegisterWindowMessageA UnregisterClassA CharNextA GetWindowThreadProcessId SendMessageTimeoutA ShowWindow GetWindowPlacement GetClassNameW EnumChildWindows EnumWindows SetForegroundWindow

advapi32

RegQueryValueExA RegOpenKeyExA RegQueryInfoKeyA RegCloseKey RegDeleteKeyA RegSetValueExA RegDeleteValueA RegEnumKeyExA RegCreateKeyExA

ole32

CoCreateInstance StringFromGUID2 CoTaskMemRealloc OleRun CoTaskMemAlloc CoTaskMemFree

oleaut32

VariantCopy VariantInit VariantClear SysAllocStringLen LoadRegTypeLi LoadTypeLi SysAllocString UnRegisterTypeLi VarUI4FromStr RegisterTypeLi SysFreeString BSTR_UserSize BSTR_UserMarshal BSTR_UserFree BSTR_UserUnmarshal GetErrorInfo SysAllocStringByteLen SysStringByteLen SysStringLen

rpcrt4

NdrCStdStubBuffer2_Release NdrDllRegisterProxy IUnknown_AddRef_Proxy IUnknown_QueryInterface_Proxy IUnknown_Release_Proxy NdrStubForwardingFunction NdrStubCall2 NdrOleFree NdrDllCanUnloadNow NdrDllUnregisterProxy NdrDllGetClassObject NdrOleAllocate

shlwapi

StrStrIW

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.orpc

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

YTabBar.dll

IMPHASH d5e3568eeebf5616fe26cd79f6f4b7af
SHA256 aebfbb62e7ae9b34b03a77baabd23b1ae59172c0bc69a380159d63ec36c0c12c
MD5 e6cb7b225623c6e23dd6660ec6ae640d
SHA1 8ea8af036db21ff371238756c4e46c9038c492d1
SHA512 acd4efcdc8f604f95299281a1b3e5c8fba49e0ea28dcccfd492e0ac4ab42506442244a37aa52f2b8fe4cc37bf4c572e725b16fb3c8133922a5f2e36f76775590
SSDEEP 3072:4hyacuL7y1xE2KR/vLi1r5GaeHKYdf7LtKcA2GDuMM0G:OyaOqR/vLi3ex74HG
TLSH
T1E5248D52B181E7B1D8D302314953CB63B23ABD94567543E33BD43A4EAE352A7E72B306
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

a0:ff:7e:52:2a:3e:1f:33:50:2a:7e:60:53:0e:1f:a0:ed:6d:c4:87

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

83283

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\ytabbar\release\YTabBar.pdb

comctl32

ImageList_Draw ImageList_Remove ImageList_SetImageCount ImageList_ReplaceIcon ImageList_Create ImageList_Destroy

wininet

InternetCrackUrlA

oleacc

CreateStdAccessibleObject LresultFromObject

kernel32

GetVersionExA DeleteCriticalSection GetModuleFileNameA EnterCriticalSection lstrcmpiA LeaveCriticalSection lstrlenW IsDBCSLeadByte WideCharToMultiByte SizeofResource LoadResource FindResourceA LoadLibraryExA GetCurrentThreadId InitializeCriticalSection CreateMutexA WaitForSingleObject WaitForMultipleObjects GetACP lstrcpynA DisableThreadLibraryCalls GetThreadLocale SetThreadLocale GetCurrentProcess FlushInstructionCache FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount HeapSize Sleep GetStdHandle WriteFile ExitProcess HeapCreate HeapDestroy GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA TlsFree TlsSetValue TlsAlloc TlsGetValue IsValidCodePage GetOEMCP GetCPInfo IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA HeapReAlloc VirtualQuery GetSystemInfo VirtualProtect VirtualAlloc VirtualFree LoadLibraryA FreeLibrary ReleaseMutex GetModuleHandleW LoadLibraryW SetLastError GetLastError MultiByteToWideChar lstrlenA GetProcAddress OutputDebugStringA GetModuleFileNameW GetModuleHandleA CloseHandle RaiseException CreateFileA InterlockedDecrement InterlockedIncrement IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetLocaleInfoA InterlockedExchange

user32

LoadIconA CreateWindowExA IsWindow PostMessageA DestroyIcon CopyRect CharNextA SendMessageA InsertMenuItemA GetDC CreatePopupMenu CreateDialogParamA DestroyMenu DrawTextW SystemParametersInfoA TrackMouseEvent InvalidateRect PtInRect GetCursorPos IsWindowUnicode GetSysColor GetSysColorBrush FillRect DrawTextA TrackPopupMenu ScreenToClient ReleaseDC GetClientRect GetSystemMetrics MapWindowPoints IsWindowVisible UnhookWindowsHookEx LoadCursorA SetWindowsHookExA DestroyWindow GetClassInfoExA RegisterClassExA GetParent MoveWindow GetClassNameA CallNextHookEx GetAsyncKeyState IsWindowEnabled IsIconic SetForegroundWindow SetWindowPos ShowWindow UnregisterClassA MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetMessageA PeekMessageA GetWindowLongA DefWindowProcA SetWindowLongA CallWindowProcA GetWindowRect IsZoomed

gdi32

RoundRect CreatePen SetTextColor SetBkMode DeleteDC BitBlt SetBkColor CreateCompatibleDC CreateFontIndirectA GetObjectA SelectObject CreateCompatibleBitmap DeleteObject

advapi32

RegQueryValueExA RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegDeleteKeyA RegCloseKey RegEnumKeyExA RegQueryInfoKeyA

ole32

CoTaskMemAlloc CoTaskMemFree CoMarshalInterThreadInterfaceInStream CoGetInterfaceAndReleaseStream StringFromGUID2 CoCreateInstance CoTaskMemRealloc

oleaut32

SysAllocStringByteLen SysFreeString VarUI4FromStr SysAllocString LoadRegTypeLi LoadTypeLi VariantInit SysStringLen VariantClear DispCallFunc SysAllocStringLen UnRegisterTypeLi VarBstrCat SysStringByteLen RegisterTypeLi

inyt.exe

IMPHASH 1ee0c47671c74b65bc79dddfdfface52
SHA256 6cb622ef92b7d2f0f619221b6edf2e2b134daf2b76d403001adc97ac40132401
MD5 3a084aafb7442a601268c88adae64487
SHA1 46f4e6e87fe40d5e962dc4096dc54ffd439c5347
SHA512 54e4d5478125ae6aed44dd0cede169c515b298fbce3df912d3686adf9af59ab3a44d1f78b6d2b601ca78aab40aa36ce8b2e69e29d3e29ae7cd0c97a5086749e1
SSDEEP 1536:AMq9qmTNWndj8ndBolvXQedL0nAZ8hlrxf9Ky5wq+R3f/jJT89mptZzlBcdQ:AMq4GNmN8n/ohXQsYLBklT89AtZpaG
TLSH
T198C39E1331D4C4F3E85601768885CB665FF3F8B5493587837FE8458A9E292E69B2B383
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

d7:3b:9f:c9:8e:a3:5c:a1:27:72:14:fa:82:69:97:1d

Digest Algorithm

md5

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jan 1, 0001

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Time Stamping Services Signer,O=VeriSign\, Inc.,C=US

Serial Number

0d:e9:2b:f0:d4:d8:29:88:18:32:05:09:5e:9a:76:88

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2008

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

52042

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\projects\ytoolbar-pf\Toolbar\yt-blackhawk\ytie\inyt\Release\inyt.pdb

setupapi

SetupIterateCabinetA

kernel32

CreateThread CreateEventA InterlockedIncrement GetCommandLineA CreateDirectoryA MultiByteToWideChar WideCharToMultiByte lstrlenW InitializeCriticalSection lstrlenA GetModuleFileNameA GetModuleHandleA GetCurrentThreadId SetEvent GetVersionExA GetProcAddress LoadLibraryA DebugBreak OutputDebugStringA MoveFileExA WriteFile SetFilePointer ReadFile GetFileSize GetShortPathNameA CreateFileA GetWindowsDirectoryA SetEndOfFile DeleteFileA CopyFileA Sleep FindNextFileA FindFirstFileA RemoveDirectoryA ReleaseMutex GetCurrentProcess LockResource LoadResource FindResourceExA CreateMutexA WaitForMultipleObjects lstrcmpA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW DeleteCriticalSection RaiseException InterlockedDecrement WaitForSingleObject CloseHandle LoadLibraryExA GetLastError FreeLibrary FindClose GetConsoleCP FlushFileBuffers WriteConsoleW GetEnvironmentStrings GetConsoleOutputCP WriteConsoleA FreeEnvironmentStringsA RtlUnwind GetStdHandle HeapCreate HeapDestroy VirtualFree GetStringTypeW GetStringTypeA ExitProcess HeapSize LCMapStringW SetStdHandle GetConsoleMode InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale EnterCriticalSection LeaveCriticalSection HeapAlloc HeapFree VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery GetFileAttributesA GetProcessHeap GetStartupInfoA HeapReAlloc GetCPInfo GetOEMCP TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LCMapStringA

user32

MsgWaitForMultipleObjects CharUpperA CharNextA PostThreadMessageA GetMessageA TranslateMessage DispatchMessageA LoadStringA UnregisterClassA PeekMessageA

advapi32

RegSetValueExA RegQueryValueExA RegOpenKeyExA RegCloseKey RegDeleteKeyA RegQueryInfoKeyA RegEnumKeyExA RegCreateKeyExA

ole32

CoCreateInstance StringFromGUID2 CoInitialize CoUninitialize CoRegisterClassObject CoRevokeClassObject

oleaut32

SysFreeString SysStringLen SysAllocString LoadTypeLi UnRegisterTypeLi RegisterTypeLi

shlwapi

StrStrIA

imagehlp

ImageEnumerateCertificates ImageGetCertificateHeader ImageGetCertificateData

inyt.exe.manifest

SHA256 ee590d7f8aff545f64451cc61ca92ea5c6e30dc8f3ff9efa99ad283ffca5592c
MD5 6c5ee63d8e649b75c991214bbdc5344e
SHA1 e3c5ed3a0b81c10b0cfa1f241ee49b4784dbf5d5
SHA512 16a28a336fc61a7f28cb1005a8cccc83051e8669ca00d7722ef225dd8340c3a007ddc050064b64afc917f1bebcc7944379f6475e12d60495259982ac8d0d9f9f
TLSH
T130F0C0818884D615837100612E72D108E678630715CE049C78DC57BB6F175D789931B6
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

pubmod.dll

IMPHASH 919456bd8223cb451bada44a8e9c14df
SHA256 c72e2e748569b32373f946c867257ba4e0a666508b00acbf7d4b43277ae572e6
MD5 43b96eceae39133222914160ed16c4e4
SHA1 0337f6b7b15fb1c638bffb3a3103b422d90edcba
SHA512 39cad8d2d3e9d8715f1d3098cb7ba1d1fb2557506db2c3a867372e81eceffe14d901fb07859361e10842b9144c882392cbdf64e25bb208fdb686fd76a38b5585
SSDEEP 3072:uH4TySSILi9vv5XgHORuPFZir8GEC6X+zSYVUrg7mthqNopPqt9BjUCXnH0gj3eo:7ySSFvRXyORuKk+zVVvrkuBCKwc
TLSH
T18A248C3333D1C0B2D84700748906FBADA67AFE659B3455837BE4178E5F711AF922E286
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

97:12:60:6e:c1:1c:40:21:ff:76:3d:52:eb:88:77:9f:c0:d9:c5:e6

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

105053

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\plugins\popupblocker\release\pubmod.pdb

wininet

InternetCrackUrlA

kernel32

MultiByteToWideChar LockResource SetLastError GlobalAlloc GlobalLock GlobalUnlock GetCurrentThreadId GetCurrentProcess FlushInstructionCache lstrcmpA MulDiv LoadLibraryA GetProcAddress GetVersionExA CreateMutexA CloseHandle WaitForSingleObject WaitForMultipleObjects LocalAlloc LocalFree CreateFileA FindResourceExA ReleaseMutex GetFileSize ReadFile WriteFile GetACP GetCurrentProcessId FindResourceW GlobalHandle GlobalFree RtlUnwind GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA GetStartupInfoA GetFileType SetHandleCount GetStringTypeW GetStringTypeA LoadResource LCMapStringA IsValidCodePage GetOEMCP GetCPInfo GetStdHandle HeapCreate HeapDestroy ExitProcess HeapSize Sleep TlsFree TlsSetValue TlsAlloc TlsGetValue IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetCommandLineA VirtualQuery GetSystemInfo VirtualProtect HeapReAlloc VirtualAlloc VirtualFree IsProcessorFeaturePresent HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetThreadLocale GetLocaleInfoA InterlockedExchange SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers FindResourceA IsDBCSLeadByte lstrlenA RaiseException FreeLibrary EnterCriticalSection lstrcmpiA InitializeCriticalSection lstrlenW GetLastError LeaveCriticalSection WideCharToMultiByte DisableThreadLibraryCalls DeleteCriticalSection LoadLibraryExA SizeofResource GetModuleFileNameA GetModuleHandleA InterlockedDecrement InterlockedIncrement LCMapStringW

user32

GetKeyState GetWindowRect KillTimer MapWindowPoints SetTimer GetSystemMetrics ShowWindow RemovePropA SetPropA GetPropA IsWindowVisible FindWindowExA DialogBoxIndirectParamA EndDialog UnregisterClassA OffsetRect AnimateWindow MsgWaitForMultipleObjects DispatchMessageA TranslateMessage GetMessageA PeekMessageA SetWindowPos RegisterClassExA GetDC GetDlgItem GetClassNameA SetWindowContextHelpId ReleaseDC GetSysColor GetParent SetCapture ReleaseCapture DefWindowProcA SetWindowLongA DestroyWindow CreateWindowExA RegisterWindowMessageA GetDesktopWindow MapDialogRect InvalidateRect SendMessageA CreateAcceleratorTableA InvalidateRgn GetWindowTextLengthA RedrawWindow GetWindowLongA BeginPaint IsChild GetClientRect GetFocus SetFocus GetWindowTextA ClientToScreen SetWindowTextA FillRect ScreenToClient PostMessageA CallWindowProcA DestroyAcceleratorTable MoveWindow GetClassInfoExA EndPaint GetWindow IsWindow LoadCursorA CharNextA DialogBoxIndirectParamW

gdi32

GetDeviceCaps DeleteObject DeleteDC SelectObject BitBlt CreateSolidBrush CreateCompatibleDC CreateCompatibleBitmap GetStockObject GetObjectA

advapi32

RegCreateKeyExA RegQueryValueExA RegEnumKeyExA RegOpenKeyExA RegQueryInfoKeyA RegCloseKey RegDeleteValueA RegDeleteKeyA RegSetValueExA

ole32

OleLockRunning CreateStreamOnHGlobal OleInitialize CLSIDFromString CLSIDFromProgID OleUninitialize CoCreateInstance StringFromGUID2 CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoGetClassObject

oleaut32

VariantClear SysStringLen LoadRegTypeLi LoadTypeLi VarBstrCmp SafeArrayDestroy SafeArrayPutElement SafeArrayCreate VariantChangeType SysAllocStringLen OleCreateFontIndirect UnRegisterTypeLi VariantInit SysStringByteLen SysAllocStringByteLen SysAllocString VarUI4FromStr RegisterTypeLi SysFreeString

yt.dll

IMPHASH 4e4b70738f304fceb4cc8cba5effff09
SHA256 8eaa2c37a42bb390dc9c909aa30a26a2ec5836e8606829666e86feda9cfcf478
MD5 6a2e0e49a4f2a9df3e6293e37e7486bd
SHA1 60be9a6966a9b229c0a9013eb77a7a6809182dd9
SHA512 876cb4c9d655ca7138fbf2e75ef6bf5ea08d7fb9ad490172449651827aadbf81a4c3b67c511d4a0469053978c5e94338e457bf82738c33bdf578242d42f4143b
SSDEEP 24576:+me/0k7jZtVTYc6Yo7XiSHHKg7iTcMt/+Xc:+mexbTYc6nHj7iTnV
TLSH
T15B15CF1272D1C0F3D56701784906FBAED2B6EB74A834C55773E23A8E1E752CBD22E14A
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

dd:71:69:b7:bc:b8:a7:00:23:9a:89:5a:5e:09:a1:9d:30:5b:9d:4b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

556151

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

s:\ytb\toolbar\yt-mail\ytie\release\yt.pdb

wininet

InternetCrackUrlA HttpOpenRequestA HttpSendRequestA InternetQueryOptionA InternetSetOptionA InternetOpenUrlA HttpQueryInfoA InternetReadFile InternetCloseHandle InternetSetCookieA InternetGetCookieA InternetOpenA UnlockUrlCacheEntryStream ReadUrlCacheEntryStream RetrieveUrlCacheEntryStreamA GetUrlCacheEntryInfoA InternetConnectA

wsock32

gethostbyname

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked

imagehlp

ImageEnumerateCertificates ImageGetCertificateHeader ImageGetCertificateData

winmm

PlaySoundA

urlmon

ObtainUserAgentString URLDownloadToFileW UrlMkSetSessionOption URLDownloadToCacheFileW FindMimeFromData

msimg32

AlphaBlend

iphlpapi

GetAdaptersInfo

netapi32

Netbios

kernel32

CreateThread SetThreadPriority CompareFileTime GetExitCodeThread GetCurrentThreadId CreateWaitableTimerA SetEvent CancelWaitableTimer SetWaitableTimer SetLastError LoadLibraryW GetModuleHandleW GetModuleHandleA GetModuleFileNameW OutputDebugStringA lstrlenA MultiByteToWideChar GlobalAlloc GlobalLock LeaveCriticalSection GetModuleFileNameA GlobalUnlock MulDiv CreateProcessA LoadLibraryExA EnterCriticalSection FindResourceA GetCurrentProcess FlushInstructionCache lstrcmpA DeleteCriticalSection lstrcmpiA InitializeCriticalSection IsDBCSLeadByte SizeofResource CreateMutexA WaitForSingleObject WaitForMultipleObjects GetACP lstrcpynA GetVersionExA TlsAlloc TlsFree GetThreadLocale SetThreadLocale GetComputerNameA GetCurrentProcessId FindFirstFileA FindNextFileA FindClose GetTickCount CreateEventA IsBadStringPtrA TlsGetValue TlsSetValue Sleep WriteFile GetShortPathNameA DeleteFileA LocalFree CreateDirectoryA LocalAlloc SetFilePointer OpenFileMappingA CreateFileMappingA MapViewOfFile UnmapViewOfFile GlobalDeleteAtom GlobalAddAtomA GlobalGetAtomNameA HeapAlloc HeapReAlloc HeapFree GlobalFree GetSystemInfo HeapCreate GlobalHandle FindResourceW GetExitCodeProcess GetFileAttributesExA GetSystemTimeAsFileTime GetProcessHeap CopyFileA FindFirstChangeNotificationA FindNextChangeNotification FindCloseChangeNotification GetFileAttributesA WinExec CopyFileW FindFirstFileW DeleteFileW FindNextFileW InterlockedExchange GetLocaleInfoA InterlockedCompareExchange IsProcessorFeaturePresent VirtualFree VirtualAlloc ReleaseSemaphore ReleaseMutex CreateSemaphoreA ResetEvent GetLastError CloseHandle ReadFile GetFileSize CreateFileA GetProcAddress LoadLibraryA FreeLibrary LockResource LoadResource FindResourceExA WideCharToMultiByte lstrlenW InterlockedIncrement RaiseException InterlockedDecrement HeapSize ExitProcess GetTimeZoneInformation LCMapStringA LCMapStringW GetStdHandle SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetStringTypeA GetStringTypeW VirtualProtect VirtualQuery GetCommandLineA UnhandledExceptionFilter SetUnhandledExceptionFilter RtlUnwind TerminateProcess IsDebuggerPresent HeapDestroy SetEnvironmentVariableA GetCPInfo GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CompareStringA CompareStringW

user32

RemoveMenu SetMenuItemInfoA GetSysColorBrush DestroyMenu CreatePopupMenu InsertMenuItemA GetMenuItemCount EqualRect InflateRect TrackPopupMenu DialogBoxIndirectParamW CreateDialogIndirectParamA DialogBoxIndirectParamA CreateDialogParamW CreateDialogParamA EnableWindow IsIconic EndDialog EnumWindows EnumThreadWindows TrackPopupMenuEx IsRectEmpty GetDlgCtrlID CopyRect DrawEdge AnimateWindow SendMessageW RegisterClipboardFormatA DeleteMenu FrameRect SetCursor GetWindowDC GetCapture GetDCEx CloseClipboard CreateCaret ShowCaret IsClipboardFormatAvailable DrawFrameControl GetClipboardData GetCursorPos SetTimer PtInRect WindowFromPoint GetPropA EnumChildWindows UnregisterClassA MessageBoxA CallNextHookEx GetWindowRect UnhookWindowsHookEx SetWindowsHookExA SetPropA DispatchMessageA TranslateMessage GetMessageA PeekMessageA DestroyAcceleratorTable GetWindowTextLengthA InvalidateRect CreateAcceleratorTableA GetSysColor InvalidateRgn GetWindowTextA SetWindowTextA GetWindow SetWindowPos RedrawWindow GetWindowLongA SetWindowContextHelpId ClientToScreen GetClassInfoExA LoadStringA CallWindowProcA IsChild ScreenToClient LoadCursorA GetSystemMetrics GetMenuItemInfoA mouse_event TrackMouseEvent SetWindowRgn SetRect OffsetRect SetActiveWindow MapWindowPoints SendMessageCallbackA FindWindowA CreateIconFromResource CreateIconFromResourceEx CreateIconIndirect CopyIcon LoadBitmapA DrawIconEx SetParent IntersectRect ValidateRect GetUpdateRect GetForegroundWindow IsWindowEnabled SetWindowLongW IsWindowUnicode DrawTextA GetActiveWindow SystemParametersInfoA RemovePropA ShowWindow KillTimer IsWindowVisible VkKeyScanA SendMessageTimeoutA GetAsyncKeyState OpenClipboard GetKeyState GetFocus RegisterClassExA DestroyWindow SetFocus MoveWindow PostMessageA SendMessageA BeginPaint GetClientRect SetWindowLongA IsWindow FillRect GetDlgItem SetCapture EndPaint ReleaseCapture RegisterWindowMessageA MapDialogRect DefWindowProcA GetDesktopWindow CharLowerA GetWindowThreadProcessId FindWindowExA GetClassNameA CreateWindowExA ReleaseDC CharNextA GetDC DestroyIcon CallWindowProcW LoadImageA MsgWaitForMultipleObjects GetWindowLongW GetParent

advapi32

RegQueryInfoKeyA RegEnumValueA RegEnumKeyExA RegQueryValueExA RegCloseKey RegCreateKeyExA RegDeleteValueA RegOpenKeyExA RegSetValueExA RegDeleteKeyA RegCreateKeyA GetUserNameA RegNotifyChangeKeyValue

ole32

StringFromGUID2 CLSIDFromProgID OleLockRunning CoTaskMemAlloc CoGetClassObject StringFromCLSID CoTaskMemFree CoCreateInstance CoInitializeEx CoUninitialize CLSIDFromString OleUninitialize OleInitialize CoTaskMemRealloc CoGetInterfaceAndReleaseStream CoMarshalInterThreadInterfaceInStream CoCreateGuid OleDraw RegisterDragDrop RevokeDragDrop ReleaseStgMedium CreateStreamOnHGlobal

shell32

ShellExecuteA ShellExecuteExA SHFileOperationA

oleaut32

UnRegisterTypeLi SysFreeString LoadRegTypeLi LoadTypeLi VariantInit VariantChangeType SysAllocString SafeArrayDestroy SafeArrayCopy SafeArrayGetVartype SafeArrayGetElement VariantCopy SafeArrayPutElement SafeArrayCreate OleLoadPicture VarBstrCmp SysAllocStringByteLen SysAllocStringLen RegisterTypeLi VarUI4FromStr DispCallFunc OleCreateFontIndirect SysStringLen SysStringByteLen VariantClear

shlwapi

StrStrIW PathFileExistsW StrTrimA StrTrimW UrlGetPartW StrStrIA UrlHashW

gdi32

MoveToEx LineTo GetBkColor SetBkMode GetObjectType GetTextColor SetDIBits GetDIBits DeleteObject CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt DeleteDC GetObjectA GetStockObject CombineRgn ExtCreateRegion CreateSolidBrush GetDeviceCaps CreateDIBSection CreateBitmap CreateDCA RestoreDC SetViewportOrgEx SetWindowOrgEx SetMapMode SaveDC LPtoDP CreateFontIndirectA SetTextAlign TextOutA TranslateCharsetInfo GetTextMetricsA EnumFontFamiliesExA SetTextColor SetBkColor SetStretchBltMode StretchBlt CreateBrushIndirect CreatePen Rectangle CreateRectRgn

ytbb.exe

IMPHASH c86687f3d687c82ee92b3a6e4a0bbff5
SHA256 546fa5a9751de06cc6ddc0525440c40ea0143fc7c18c086c709c988759fb9c53
MD5 bcc1da6fe894e755c47ac2ec2ffc3213
SHA1 b66b9cb3d897dd6aa0d14355f68a735e22c64615
SHA512 2c25a6e990039e384a49e3c0cb50763dff8bcc6cb8fdcbb4aad1ab086d83c4ce2e01ddaf393d214ae2268c245911c15a3e34fbd48db340dd3361cd7af6131b80
SSDEEP 1536:8/VN2rxb9fh0cUIrVtXmy4RDgxcbfpjBw4KeGZOEvmVsDb1ZG7EBtmcriucCdr:gVgb9ycUIPadEuVsDU8tNhvd
TLSH
T1E8E3AE0239C1C4F3D88901B10955CF956BBAFE626F6641C7F7B63A8E5D302E50B3A2D6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

96:95:5c:bc:7d:d3:ce:1b:42:99:7c:e6:4b:5d:b5:69:97:db:40:09

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Chains

Jul 28, 2008

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Yahoo! Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Yahoo! Inc.,L=Santa Clara,ST=CA,C=US

Serial Number

5a:2d:0e:95:59:2b:51:5a:5c:f3:f5:c5:d5:9c:88:b7

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Aug 11, 2006 - Sep 3, 2009

Minor OS version

0

Major OS version

4

Entry point

64435

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

s:\ytb\toolbar\yt-mail\ytie\ytbbroker\release\ytbb.pdb

kernel32

WriteFile SetFilePointer ReadFile GetFileSize CreateFileA DeleteFileA FindClose FindNextFileA FindFirstFileA WaitForSingleObject DeleteCriticalSection Sleep CreateThread CreateEventA GetCommandLineA MultiByteToWideChar WideCharToMultiByte lstrlenW InitializeCriticalSection lstrlenA lstrcmpiA IsDBCSLeadByte InterlockedIncrement EnterCriticalSection LeaveCriticalSection GetModuleFileNameA CloseHandle LoadResource FindResourceA GetModuleHandleA GetCurrentThreadId SetEvent LocalFree ReleaseMutex LocalAlloc GetCurrentProcess CreateDirectoryA LockResource FindResourceExA CreateMutexA WaitForMultipleObjects GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA RtlUnwind LoadLibraryA GetProcAddress RaiseException InterlockedDecrement GetVersionExA LoadLibraryExA GetLastError FreeLibrary SizeofResource FlushFileBuffers WriteConsoleW GetConsoleOutputCP WriteConsoleA GetStdHandle SetStdHandle ExitProcess HeapSize VirtualFree HeapCreate HeapDestroy GetStringTypeW GetStringTypeA LCMapStringW LCMapStringA IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess SetLastError TlsFree TlsSetValue TlsAlloc GetConsoleMode GetConsoleCP InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale HeapFree HeapAlloc VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery HeapReAlloc GetFileAttributesA GetProcessHeap GetStartupInfoA GetCPInfo GetOEMCP IsValidCodePage TlsGetValue

user32

PeekMessageA MsgWaitForMultipleObjects PostThreadMessageA GetMessageA DispatchMessageA TranslateMessage CharNextA UnregisterClassA CharUpperA

advapi32

RegQueryValueExA GetSecurityDescriptorLength RegSetValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA RegEnumKeyExA

ole32

StringFromGUID2 CoCreateInstance CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CoUninitialize CoRegisterClassObject CoRevokeClassObject CoInitialize

oleaut32

SysStringLen SysStringByteLen SysFreeString VarUI4FromStr VarBstrCat SysAllocStringLen RegisterTypeLi UnRegisterTypeLi SysAllocString LoadTypeLi LoadRegTypeLi SysAllocStringByteLen

shlwapi

SHDeleteKeyA

Defraggler.exe

IMPHASH 77167acbcbe6e26614d6232441e96bcc
SHA256 7d5f820d2b17a9592bbc864017996fd811b83b81a9f43d58e6da6874498686ac
MD5 4c4070c098b3cb21be901d3d9cf3dd46
SHA1 79b5235a79175ab72e57ff5e33325d98d1148f02
SHA512 26958b4d6de6e49a15372bb5cab1a045ee356fbe0582f2723fff42c1ab9a8524537e43ea1fc424f20e3c556542137e06d52557e304e9ae575ceff56fd2f15c95
SSDEEP 24576:/UzEYx1XHTk3g8hY1U6NU/HvNjuCt3I07QkqJ+V/i+wc3/Glh0StzQTo+pvJIg9q:qVYwzUz91QkE58Glh0StzQTXttq
TLSH
T1B8856C41FFDAC1FADB83107245B6970F56327E55AB20AAD7A31C2E0A9C716C27C36352
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

40:eb:69:3f:42:a3:b3:85:07:80:b0:ca:6e:0e:38:0e:87:5d:0e:35

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

881736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\projekty\defraggler\build_temp_df\tagged_build_src\bin\defragglergui\release\Defraggler.pdb

wininet

InternetOpenUrlW InternetReadFile InternetCloseHandle InternetOpenW

kernel32

WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetStringTypeW GetStringTypeA GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP TlsFree TlsSetValue TlsAlloc TlsGetValue HeapCreate GetCPInfo LCMapStringW LCMapStringA RtlUnwind CreateThread ExitThread IsDebuggerPresent UnhandledExceptionFilter FormatMessageA CreateFileA GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapReAlloc HeapDestroy VirtualAlloc VirtualFree IsProcessorFeaturePresent LoadLibraryA HeapAlloc GetProcessHeap HeapFree InterlockedCompareExchange GetDriveTypeW QueryDosDeviceW GetDiskFreeSpaceExW SetErrorMode SetFilePointerEx OpenMutexW GetVolumeNameForVolumeMountPointW GetVolumeInformationW ResumeThread ReadProcessMemory SuspendThread GetVersionExA OutputDebugStringA GetCurrentDirectoryA GetModuleFileNameA GetThreadContext GetEnvironmentVariableW GetEnvironmentVariableA OpenEventW GetFileInformationByHandle GetDiskFreeSpaceW CreateMutexW GetOverlappedResult TerminateProcess ReadFile DuplicateHandle CreatePipe FindNextChangeNotification FindCloseChangeNotification FindFirstChangeNotificationW GetFileAttributesExW GetNumberFormatW GetLocaleInfoW FindNextFileW FindFirstFileW FindClose GetFullPathNameW GetFileAttributesW SizeofResource LockResource MulDiv LoadResource FindResourceExW GetModuleFileNameW lstrlenW InterlockedExchange GetModuleHandleW FindResourceW GetCurrentThreadId FlushFileBuffers LoadLibraryW SetEvent CompareStringA SetEnvironmentVariableA CreateProcessA CreateEventA WriteFile AllocConsole CreateProcessW GetStartupInfoW InterlockedDecrement SetUnhandledExceptionFilter GetCurrentThread InterlockedIncrement ExitProcess OpenProcess GetCurrentProcessId GetTickCount GetCurrentDirectoryW WaitForSingleObject Sleep ReleaseMutex CreateWaitableTimerW SetWaitableTimer SetThreadPriority GetModuleHandleA FileTimeToSystemTime lstrlenA CompareFileTime SystemTimeToFileTime lstrcmpiW GetSystemTimeAsFileTime lstrcmpW DeleteFileW GetPriorityClass SetPriorityClass CompareStringW GetSystemDirectoryW DeviceIoControl GetLogicalDrives QueryPerformanceCounter QueryPerformanceFrequency GetPrivateProfileStructW WritePrivateProfileStructW GetPrivateProfileStringW WritePrivateProfileStringW LocalFree FormatMessageW MultiByteToWideChar FlushInstructionCache GetCurrentProcess RaiseException GetSystemWindowsDirectoryW GetHandleInformation CreateEventW GetProcAddress GetCommandLineW GetComputerNameExW ResetEvent LeaveCriticalSection EnterCriticalSection CloseHandle GetStdHandle GetSystemInfo WaitForMultipleObjects SetLastError GetLocalTime DeleteCriticalSection SetConsoleTextAttribute WriteConsoleW InitializeCriticalSection FreeLibrary WideCharToMultiByte LoadLibraryExW GetVersionExW GetTempPathW GetLastError EnumResourceNamesW CreateFileW GlobalMemoryStatusEx GetConsoleOutputCP

user32

TranslateMessage GetWindowThreadProcessId EnumWindows UnregisterClassW DispatchMessageW GetMessageW FrameRect SetDlgItemTextW RegisterWindowMessageW BringWindowToTop DrawFrameControl GetWindow SetTimer KillTimer GetDC InvalidateRect ReleaseDC LoadCursorW LoadAcceleratorsW UnregisterClassA SetCursor BeginPaint EndPaint DrawTextExW SetWindowLongW LoadImageW GetMenu RemoveMenu AppendMenuW LoadStringA SetMenuDefaultItem CreatePopupMenu GetMessagePos GetClassNameW GetCursorPos ReleaseCapture DrawFocusRect GetCapture SetActiveWindow SetCapture SetMenu IsWindowEnabled SetRectEmpty DialogBoxParamW SetRect IsZoomed TranslateAcceleratorW CharNextW PostQuitMessage SetWindowPlacement GetWindowPlacement PeekMessageW SystemParametersInfoW MessageBeep GetMenuStringW TrackPopupMenu GetWindowRect SetMenuInfo GetMenuInfo LoadBitmapW DeleteMenu GetMenuItemID GetMenuItemCount EnableMenuItem PostMessageW CreateDialogParamW GetWindowTextLengthW GetWindowTextW GetActiveWindow GetWindowDC GetSysColorBrush GetClassInfoExW RegisterClassExW OffsetRect GetDialogBaseUnits GetDlgCtrlID SetFocus EnableWindow GetFocus InflateRect DrawTextW SetWindowTextW IsDialogMessageW TrackMouseEvent CopyRect ClientToScreen UpdateWindow DrawEdge GetMonitorInfoW MonitorFromPoint SetMenuItemInfoW GetMenuItemInfoW GetSubMenu TrackPopupMenuEx LoadMenuW IsMenu DestroyMenu SendMessageW CreateWindowExW GetParent ShowWindow IsWindow DestroyWindow LoadIconW GetDlgItem SetWindowPos IsWindowVisible MapWindowPoints GetSysColor GetClientRect DrawIconEx DestroyIcon CallWindowProcW RedrawWindow GetSystemMetrics DefWindowProcW FillRect GetWindowLongW LoadStringW MessageBoxW SetWindowsHookExW CallNextHookEx UnhookWindowsHookEx MoveWindow GetDesktopWindow GetForegroundWindow PtInRect ScreenToClient EndDialog InsertMenuW

gdi32

TextOutW SetPolyFillMode RealizePalette SelectPalette CreatePalette GetTextExtentPoint32W LineTo MoveToEx RestoreDC SaveDC Polygon Polyline CreatePatternBrush PatBlt CreateBitmap GetClipRgn CreateRectRgn CombineRgn CreateRectRgnIndirect GetClipBox SelectClipRgn OffsetWindowOrgEx ExtTextOutW SetBkColor Rectangle GetCurrentObject CreatePen GetStockObject CreateSolidBrush CreateDIBSection GetDeviceCaps GetObjectW BitBlt CreateCompatibleDC SetTextColor CreateCompatibleBitmap SetBkMode DeleteObject SetViewportOrgEx DeleteDC SelectObject CreateFontIndirectW DPtoLP

comdlg32

ChooseColorW GetSaveFileNameW GetOpenFileNameW

advapi32

SetSecurityDescriptorDacl RegCreateKeyExW RegQueryValueExW RegSetValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegEnumKeyExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges InitiateSystemShutdownW RegQueryInfoKeyW GetUserNameA InitializeSecurityDescriptor GetUserNameW

shell32

SHBindToParent SHGetSpecialFolderLocation ShellExecuteW SHGetFileInfoW SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW SHEmptyRecycleBinW SHQueryRecycleBinW CommandLineToArgvW

ole32

CoTaskMemAlloc CoTaskMemRealloc CoUninitialize CoInitialize CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal CoInitializeEx

oleaut32

VarUI4FromStr

shlwapi

PathCombineW PathFindFileNameA StrFormatKBSizeW PathRemoveFileSpecW

comctl32

ImageList_GetIcon ImageList_ReplaceIcon ImageList_Create ImageList_GetImageCount ImageList_Draw ImageList_Write ImageList_Read ImageList_AddMasked ImageList_GetIconSize InitCommonControlsEx DestroyPropertySheetPage PropertySheetW _TrackMouseEvent CreateStatusWindowW ImageList_Add CreatePropertySheetPageW ImageList_SetImageCount

msimg32

AlphaBlend TransparentBlt

version

GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

Defraggler64.exe

IMPHASH 5dbbc46b2baca2fa2363c0251431cfb4
SHA256 73d80c5c2f4ab1ec3db524bb455a4a6fda0064a4aee726dce5d17996175f4354
MD5 82c16bd83125ed7695400582acdfc72d
SHA1 89405c9f0941db9cedf9de0ab8092c17b2b75e47
SHA512 b2d223673422a290cb86acca2ad07b59a55d134aeffbc7ea71f55c3f7b97d495ddea49cbee156ba16ff8d79a6b3e4a46274bcf283a37e014e6c3d218e77625a6
SSDEEP 49152:Q62lFZYp31VuaSp40nxnvF2FvFbEr8r3yZ0EzCvheRdSMCqmcagKUvsz:BKO2ilE3zUqPo
TLSH
T18EE55C16F57440A2D066C1BFC952E74AE2B138911B3097CB0221DBAB2F77AE6593D733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

08:b0:19:3a:0e:94:66:6f:c8:15:9b:a0:3b:6f:1b:4f:e9:4a:da:6d

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

1524480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projekty\Defraggler\BUILD_TEMP_DF\tagged_build_src\bin\defragglergui\release\Defraggler64.pdb

wininet

InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle

kernel32

GetFullPathNameW GetLocaleInfoW GetFileAttributesW GetNumberFormatW GetFileAttributesExW CreateMutexW GetDiskFreeSpaceW FindFirstChangeNotificationW FindCloseChangeNotification FindNextChangeNotification CreatePipe DuplicateHandle ReadFile TerminateProcess GetOverlappedResult GetFileInformationByHandle OpenEventW SuspendThread ResumeThread GetEnvironmentVariableA GetEnvironmentVariableW GetThreadContext RtlCaptureContext GetModuleFileNameA GetCurrentDirectoryA OutputDebugStringA GetVersionExA ReadProcessMemory GetVolumeInformationW GetVolumeNameForVolumeMountPointW OpenMutexW SetFilePointerEx SetErrorMode GetDiskFreeSpaceExW QueryDosDeviceW GetDriveTypeW GetStartupInfoA GetFileType SetHandleCount GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsA IsValidCodePage GetOEMCP HeapCreate HeapSetInformation RtlVirtualUnwind FlsAlloc TlsSetValue FlsFree TlsFree FlsSetValue FlsGetValue GetCPInfo LCMapStringW FindNextFileW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader IsDebuggerPresent UnhandledExceptionFilter CreateThread ExitThread FormatMessageA CreateFileA GetThreadLocale GetLocaleInfoA GetACP HeapSize HeapReAlloc HeapDestroy InterlockedPopEntrySList VirtualAlloc VirtualFree GetProcessHeap HeapAlloc HeapFree InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW FindFirstFileW FindClose AllocConsole CreateProcessW GetStartupInfoW SetUnhandledExceptionFilter GetCurrentThread OpenProcess GetCurrentProcessId ExitProcess GetTickCount GetCurrentDirectoryW SetWaitableTimer SetThreadPriority Sleep ReleaseMutex CreateWaitableTimerW GetModuleHandleA LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode SetStdHandle WriteConsoleA GetConsoleOutputCP lstrlenA FileTimeToSystemTime CompareFileTime SystemTimeToFileTime DeviceIoControl lstrcmpiW GetSystemTimeAsFileTime DeleteFileW CompareStringW GetPriorityClass SetPriorityClass lstrcmpW GetLogicalDrives GetSystemDirectoryW QueryPerformanceFrequency QueryPerformanceCounter GetPrivateProfileStructW WritePrivateProfileStructW GetPrivateProfileStringW WritePrivateProfileStringW FormatMessageW LocalFree GetCurrentProcess RaiseException MultiByteToWideChar GetSystemWindowsDirectoryW FlushInstructionCache WriteFile SetLastError GetSystemInfo WaitForSingleObject WideCharToMultiByte CreateFileW FlushFileBuffers LeaveCriticalSection GetHandleInformation EnterCriticalSection LoadLibraryW GetCommandLineW GetStdHandle GetProcAddress GetVersionExW FreeLibrary GetLocalTime GlobalMemoryStatusEx LoadLibraryExW GetLastError CloseHandle SetConsoleTextAttribute EnumResourceNamesW SetEvent DeleteCriticalSection WriteConsoleW ResetEvent CreateEventW GetTempPathW GetComputerNameExW WaitForMultipleObjects InitializeCriticalSection GetCurrentThreadId FindResourceExW LoadResource LockResource SizeofResource GetModuleFileNameW FindResourceW lstrlenW GetModuleHandleW MulDiv CompareStringA SetEnvironmentVariableA CreateProcessA CreateEventA LCMapStringA

user32

RemoveMenu PostQuitMessage CreatePopupMenu GetClassNameW GetMessagePos MessageBeep GetCursorPos ReleaseCapture GetCapture SetCapture AppendMenuW SetTimer GetWindow DrawFrameControl BringWindowToTop UnregisterClassA RegisterWindowMessageW SetDlgItemTextW GetMessageW DispatchMessageW FrameRect GetMenu SetWindowPlacement IsWindowEnabled GetWindowPlacement SetRect SetRectEmpty DialogBoxParamW TranslateAcceleratorW SetActiveWindow UnregisterClassW EnumWindows GetWindowThreadProcessId LoadStringA IsZoomed SystemParametersInfoW KillTimer SetMenu CharNextW SetMenuDefaultItem GetMenuItemCount TrackPopupMenu EnableMenuItem InsertMenuW GetMenuStringW PostMessageW SetMenuInfo GetMenuInfo LoadBitmapW DeleteMenu GetMenuItemID CreateDialogParamW GetWindowTextLengthW GetWindowTextW GetActiveWindow TranslateMessage LoadAcceleratorsW GetWindowDC GetDlgCtrlID GetClassInfoExW RegisterClassExW OffsetRect GetDialogBaseUnits GetSysColorBrush GetFocus SetFocus EnableWindow SetWindowTextW IsDialogMessageW DrawTextW InflateRect TrackMouseEvent UpdateWindow CopyRect DrawEdge ClientToScreen TrackPopupMenuEx DestroyMenu GetMonitorInfoW MonitorFromPoint SetMenuItemInfoW GetMenuItemInfoW GetSubMenu LoadMenuW IsMenu LoadIconW GetWindowLongW ShowWindow SetWindowLongW GetDlgItem MapWindowPoints GetParent CreateWindowExW IsWindow SetWindowPos SendMessageW DestroyWindow IsWindowVisible FillRect GetSysColor CallWindowProcW GetSystemMetrics DefWindowProcW GetClientRect GetWindowLongPtrW RedrawWindow DrawIconEx DestroyIcon LoadStringW MessageBoxW SetWindowsHookExW CallNextHookEx UnhookWindowsHookEx MoveWindow GetDesktopWindow GetForegroundWindow EndDialog BeginPaint SetCursor LoadCursorW SetWindowLongPtrW DrawTextExW InvalidateRect PtInRect ScreenToClient ReleaseDC LoadImageW GetWindowRect GetDC EndPaint DrawFocusRect PeekMessageW

gdi32

LineTo GetTextExtentPoint32W CreateCompatibleDC SelectPalette RealizePalette SetPolyFillMode CreatePalette GetObjectW GetDeviceCaps SetViewportOrgEx SelectObject DPtoLP CreateCompatibleBitmap CreateFontIndirectW DeleteObject SetBkMode SetTextColor TextOutW CreateDIBSection BitBlt DeleteDC CreateSolidBrush GetStockObject GetCurrentObject Rectangle CreatePen OffsetWindowOrgEx SetBkColor ExtTextOutW SelectClipRgn GetClipBox CreateRectRgnIndirect CombineRgn CreateRectRgn GetClipRgn CreateBitmap PatBlt CreatePatternBrush Polyline Polygon SaveDC MoveToEx RestoreDC

comdlg32

GetOpenFileNameW ChooseColorW GetSaveFileNameW

advapi32

RegQueryValueExW RegSetValueExW RegOpenKeyExW RegDeleteKeyW RegDeleteValueW RegCloseKey RegCreateKeyExW RegEnumKeyExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges InitiateSystemShutdownW RegQueryInfoKeyW InitializeSecurityDescriptor SetSecurityDescriptorDacl GetUserNameA GetUserNameW

shell32

CommandLineToArgvW SHBindToParent SHGetSpecialFolderLocation SHGetPathFromIDListW SHBrowseForFolderW SHEmptyRecycleBinW SHQueryRecycleBinW ShellExecuteExW SHGetFileInfoW ShellExecuteW

ole32

CoTaskMemAlloc CoCreateInstance CoTaskMemFree CreateStreamOnHGlobal CoTaskMemRealloc CoInitialize CoInitializeEx CoUninitialize

oleaut32

VarUI4FromStr

shlwapi

PathFindFileNameA PathRemoveFileSpecW StrFormatKBSizeW PathCombineW

comctl32

ImageList_ReplaceIcon ImageList_Create ImageList_GetImageCount ImageList_SetImageCount ImageList_GetIcon ImageList_Write ImageList_Read ImageList_GetIconSize ImageList_Draw ImageList_AddMasked DestroyPropertySheetPage PropertySheetW CreateStatusWindowW _TrackMouseEvent InitCommonControlsEx ImageList_Add CreatePropertySheetPageW

msimg32

AlphaBlend TransparentBlt

version

GetFileVersionInfoSizeA GetFileVersionInfoA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Lang/lang-1025.dll

SHA256 eb7d4c62ed2c23999bab680722585b72a34613ac8985631a0f5b46f36a740962
MD5 63420726a5a29836071f6330371afe68
SHA1 91f4019d479280ed6eb438df53c4db9745e8d906
SHA512 aac390de0ce2565c1c17763c30461e55e18daa7357caf7743e256a5a08a1a6f06fc2066fd082ada7be8a936d39c1d1ef0559b432c6c2f3e07945c59728cab2d6
SSDEEP 192:3NqX5t87LzNiT/QKbSTNE3pbzTPy9oQGvHMpUyQrVpICDt8d8N8Rf2Qul4ve6ne0:3Yz8nxirQKauNzG9oQyn8XuV
TLSH
T1768235114E68D13DE507C3B6CA47DE1362184A66DECD37394B788E105BE1138ABAF8F9
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1026.dll

SHA256 bb7b0d0c2b3a37d614312891ccb92fe6dd366ed5f40b5a094b7d01ca2d7cce72
MD5 a985dd15f0fa5c65df03ab68902c9901
SHA1 b8a54feff0d9b74c0a3362f143d733156a04163a
SHA512 3529019027fb8e3a6f2976d8148f6b97a5ea1b53d43e6eb65f60a2be63b7b5b7034bac22ddb4858e1aad244c90a8a143cf1f4623a01297ab789bfe5dfffad336
SSDEEP 192:dNqXmC7GbYoBzQ3oIRr3qcyDDeidmKezQXY7CKlfyCnpw1L:dYWGGbYorSOmKejyR1L
TLSH
T13192FD0FBDBDD115FA44E2724F524BEB22BABB05372946C9824F3D65A01D63933146CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1027.dll

SHA256 1d11632f2941817491f5cc5f7c4523a97d1fbccd986a3253581a165fcce5f1ae
MD5 2af4ea94174e411eb39932e5540f91c6
SHA1 1b529efbd783074a85b58bd0b1840afb008a7310
SHA512 03ebbf240c603e29ff742318995163024932418d6b0d24efd974b3c7daff5234b6b963c64f16d76814959b57d1edc8ebaf6ce5a7ac433ad21afb31074e86fc36
SSDEEP 384:jYuoH71PPQ6uU52bn0Ey1ZTzF9mql9c7m:loHxuU52bn0EQzFPl
TLSH
T171829E01AFED2669F2F32F79ADB955154E3ABC96AE39C10D1220655D4CB2F08CD70B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1028.dll

SHA256 0ee0d257d7f012ebbef363260485c90877ebd34a3902370e795f2c8f9b9c3f4c
MD5 ffdf1c517964544839a11048ff5e8195
SHA1 7e8dd24029a1f382b04bf8c9602353fdd407ed66
SHA512 5d62438144b87207d539e66a6bb427a06c79b23c96119fd116dfc29887f227934f0dffac3e9fe1f39aeb2b38c3357b5748d26cc9b59ff0b3fde0bf5aab161c64
SSDEEP 192:ONqXVxrsRDGhothqkSqWKJQw+jok0zEG0:OYToR9ttSqW1w+jokIER
TLSH
T1D312DA43C3C64A6AEBDD917277B328137E3DF15836090F973B40A516E83BF217A16646
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1029.dll

SHA256 993fa6aa82a3baf583563dd689708ad0c481ea41abc1157543d92326c5d3e4ba
MD5 5e985a6e205cd91d79b11523a4235711
SHA1 3a1fe7a5551b397465e8b2ebcfd5ee6c18bb31b3
SHA512 ae00c5237e89504c27010f168b21c82a6486902d228d34de754f6767ce4268f264c4fa5ee2c407ab2265de323d11ab91db8373394ddb504635564a66449cc843
SSDEEP 384:gYji/aou/6l4c0k4+kb2PzPaeMb2omSneIO4OM4:s/kyMbFeM6D14O
TLSH
T13492E30146FC169AF2FBAF3AA9B406618E377D92BB35C10F5160424E5D32FD498A1B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1030.dll

SHA256 8d8cbfbf82f3f6362ffdcb361d847b0c1bfefc92452dac15e26c9cab8068ecc8
MD5 d774128c920990947b42e225889bad92
SHA1 2215f60045413ab22b40899d9cd7d2fc22e86662
SHA512 8b7c39216e9c8fe9277c13ad3dda86b9b6472db3900fde77f1fe9d656ef6bfd5e0042673f123b2476dc94e75e40d7962346c3df8eb3c79f53cc2196097e1a70c
SSDEEP 192:HNqXpPp6xektvpfTueqA4HsSuJ0Tin/3c1a4DWyADEStO85tlPN:HYMeKRf9Uyn/3c0O8DpVtlPN
TLSH
T1A192175093E8261EF2F72B757DB907445A69FDE5AE3AC21C2220509D4C73F98C6B0B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1031.dll

SHA256 173d838e4289f32171088bdc99f636c0e1d3f7d75697a827e3fe41bc2145d2d5
MD5 13b26070b2c44efdefa37f0ab39bf964
SHA1 197cca849044e85d10be1bb5c5a6f6645126d8d8
SHA512 2f1a81c77c59b8ff0f4b7d8acb9c92c1a828b8b13dc0b26a779064e83e82854f7a0b024afff767612443eefbd4940f9666a20b1f7c77f09a5d2a9c3aede693e0
SSDEEP 384:HYKrJVhTg/AJwjeWygigMAptJ9oTXXAQD4/t421nVne9regvqUwAapzuk4ONk:L7wAyP/iRvqUg1
TLSH
T1DA92E01183E9562CF2F36B347EB512542F36FEA6BA7AE50D261060DD5872F00DE21B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1032.dll

SHA256 ffc6899c59e64af3c41081fc3d05f496c410b38e5c4e6bcd7dd77967d01fef28
MD5 bc39d194f384672152191767a31537d4
SHA1 d57940def5da4d3ea0717b206d8b4dce9a015023
SHA512 e5a7c0c5fc205843b306ffff96799bb692613aaf21824aa2322a2c42e587f80933ddf8e6b9bb1ebae6dde8ac29a319b86c0134df496eec72b52397d495dc2b13
SSDEEP 384:AYFdHFYJxTHQxYpM3No8srAhXcuuPOZ7ES5:z9yJeG835CS
TLSH
T16EA2079E0EAF5655EFE55AF3187381264F6FF1924825DE7A32F03048DA6DD024EC2E09
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1034.dll

SHA256 6644bc95d56228b0d00b39c398595ad7a859a8a9b6d4cd708360e1b4ca75f706
MD5 08a2331159b449fc94bb70081a9e12ec
SHA1 d0c02f646725dc27c535dfd61c9077fd06372dd2
SHA512 e0f17f519bd9989fbad83a5f067990da3b4c1928763d3025da04eea007a12dd93aa514402efb206b614149b0ee0afdfba165b1427f3f5ba84706c195a2366677
SSDEEP 384:bYBDM2MCbfkRAmcelYiP7qMzuE2Cue6ka:wDM24LFzuE7
TLSH
T182A25540ABFD671AF1F7BF39AA7916144E3ABD92AE39810D1220515E4CB1F48CD70B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1035.dll

SHA256 6d715bbb5293901fa7bfcd388c995673503e0f8d6f7eaaebf537266bd78df19c
MD5 3ea6d6ee12ca1ea19b3c0441157aba43
SHA1 a0d24c0c36bf8c29ce9e2434a8bc86a89a0cd830
SHA512 159b186b6c81a6e1733ea7c96ab5764f7f7a808a85ef600482f9cb9e34304d75253f3090d4a8b20c49ef89ea71daf7d6bcddfd43e478f1b85fa1ef4316ee1623
SSDEEP 384:zYic54juSvpriJoibknRgi0z9DFPTcmhS7h5OsXEVmHMi:/SS9a5gnRg3cMS7h5OsE
TLSH
T1C982AD4186FCA224F2F79F316EF452110AB77E9B6EB8E21C0B20541D99366C1E9B0777
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1036.dll

SHA256 9a517bc612b16fc2d1c623965ee99fd4c3983bb6f42fd532f5f0a97fefee562e
MD5 6a552f410631df0499d367d88535f8a6
SHA1 6c9d215997416551e11e36ae9686703de5e08793
SHA512 daf138aee0006be4a472334d7cb2c83729c0a4793bcd72fc412b930a957c259a0eab5eef2965744871c404117151ee4eb4af7221cf659148a5a73929c02a9e03
SSDEEP 384:+YsJmki1yrOlGBJ4zfP0SeUVuaIsi76cm8ZX66iTLq/BwqCxvPzjfU1flBY6GTmT:PXHyDGPEuXmV
TLSH
T176A27950A3ED661AF6F73F35A9BA06144E7ABC9A9E39C61D1210508E5C72F48CC74B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1037.dll

SHA256 07d741ecaffc038d48e139e7a243e147e450bf6bb0c984d525428733815aca35
MD5 83c39dfc6e98049bb38c4bfdf061d89d
SHA1 31a2ad80669811f84caf52bb5e07488b995ca28a
SHA512 12c7952cfb82213ad0b04a0e495385d23854fd7bf0a5b12375534682d40c47aa14143d14f8dc49ca86c097d06531e26d87609d5fa91d2b3328b60744582d00a3
SSDEEP 192:4NqXxT+ka7GawB0gHSLfA898G2URPGN9BeCm5hLo6RzMmQnAkRpHiX3XMrscJ7yS:4YBLf0tLfA898G2URPGN9sCm5hPzzQa
TLSH
T12A6227D11E41D2F9FA58EF37923B1D2E8691D70442AC3B27686806502E2EB959B1DF3C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1038.dll

SHA256 ec68bf6909afb1207873b321f63af88b5aeac3052e6099e578bb9c027dfaef55
MD5 5cd52196aae5335d9ce0655476308d39
SHA1 28be6e868e13e08e979fab15ea82dc5c5e644f3b
SHA512 5829cc8466d300465c29d01ff57775398d3be1f0a5b74653900da5917b22f18bb03490c053a82481df814d38173ca10fdada244e5b7f2ea8eb4496eb578a75ec
SSDEEP 384:VYgkCiipGLBYfzmNYCtVCKMi5iX4lOJZJLgwTddfK0RAlBYJJobZ/18/zViVGfez:5k6QbJ9564l4JLTKteJJo/4eJX1whjwC
TLSH
T1EAA2E24063EC125AF5BB8F733EF417954A29BCB4BE3DD21E8540128D5D7AB84D9B0B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1040.dll

SHA256 5fe49cf5bbdd4f6f08b1acc16350cc23836751e41ee3af1f0f83165a0b78ccf2
MD5 571e6b336e8c77da4005d5b30727f657
SHA1 d5122d076517c0dbfe5830cf855cfb7172cee894
SHA512 ca4a358ec1a1478d7c4198febd85bd518ed60f802ca48bb0e4f398490139f2b67213c19a6e3fa857f9409020a88ca6ec1f6c1847358978133bf50a1d2123dbd6
SSDEEP 192:RRNqXenDnOZiV9M0sye18bkthrDzQWT0e0YIjHcn6NHyGZKbYjAdCTe97ybcKWyl:rYu7OiHLejQTj8nmVKjyIwHJ
TLSH
T1B192B211A7FC6604F6F37B34BE7917184E7BBE96AE39D22E0261105D4971F6089A0B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1041.dll

SHA256 b4d18720f2b095b142db25a05d5f11ee69395f2da94ae5269029f25b18a82957
MD5 7e730e8ba1aa269d3bfac2654a9829eb
SHA1 e2e4841383734c248797f3320884b11435f60257
SHA512 35982056ab63b3a555e52501edd648ff0766eb089f35bcf2e85e4f72d44383bab1247dcbad73e6847cecc0acf38afaf704573c1d0e34f9c807adda52213942ac
SSDEEP 192:iNqXKuo6eZA50GqQaKn+IKJ1NpF0goZGzieG4v5avqhSecg:iYaioA5WFKrKJtF0gYf4UvqhS1
TLSH
T18B4295CDBB594B06F9BDC5FA0761B5680766FC2CABD20F62371180179443A2F8361E6C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1043.dll

SHA256 0f4de61ecf0fc47a5df67574ae162a05dff479c1bddb78b0241b3927f5d97a8e
MD5 d8201f1fcfeb5f186bbe7b732dddcd56
SHA1 b76143872fdf42d5d47342481138b4f700940817
SHA512 bcc6e02e754dfaad4b8bf73b83d1f91c2caf730d4b3e434688d72b2b7649885109fe46a1e50b2a20a305ae0dd148dcf521c4d4a255e52a8459515e8757a82285
SSDEEP 384:wYKN5veB+vKDYDsDEDQl0zL0z7H6n0VlFNDTDlD:wmB0cCG+DR8J/5
TLSH
T170A29902A7F9922CF4F73B3469B906504FB6FEE6AE76C21D1660219D4C72B44D960B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1044.dll

SHA256 8cfd8944c25130e1847da6e00a8ea166688003796728c46459c139a7ab6c104f
MD5 748b5864e333c1f4013a97f699859c2e
SHA1 6cc715054ef5248e706dc567b252f501b0082ca1
SHA512 2a87c27d8033640ead74153a0464ca4da79d3f055d80f27516399469fc4598f969f836ab8e81405571333b95fe05987562d96331f84cde08cbd9413f61aff755
SSDEEP 192:LNqXzkuxRju7GhUgmbpkzYxyLPRI6cxpJNHJpkN4npu:LY735OgjDL6pQK
TLSH
T13142D250D3E9652EF1FB2B756DB903009768FDB4BE3AC21C2220609D8972B95D5B0B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1045.dll

SHA256 e2ec692d854fed25161eba06a6a1f4cd1669063be588e031326e859d61e0a7b8
MD5 a0e8ae4877aebb653a5d5b130bf0ef98
SHA1 f30d51ea2a5d71423c1a69ea154f40733151bc0d
SHA512 867bea8bb89cd5923dd7904aab8c57b0e6d5e6559597b377a8e7d81bbcebd2bc8c4cd457d4ba5b0f03ae9761b4e1b91dd7677b3e1dd51a0ae500ebdb88bd93bd
SSDEEP 192:sNqXCiAI3OvsqTwy4GtQXPYe5CV89yrvY6i1RMv3yZX8fF0Y15Eb43kk8gH2ermJ:sYyWmd45XfIrA6+M/6AubQzmeXscu
TLSH
T1C392E90097FC2668F6F76F7956F623448FBAFD31AA35C29E2510500A1972ED4CA60B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1046.dll

SHA256 628a6c5e8fdf6858ab6e32fd1db83f1ea29f5bfcf4619b61c74a2eabe5b02296
MD5 3a74f04d98fd8f40d9ac9c6704b6b8f6
SHA1 c9fb002d28c127c907b06410e996af8f711960b8
SHA512 dcee4cc0fbe8cc33ae8500a212bb8008adf99edc94380179151ab6eccf22ffb6329cb412cfb5b47d08e6a0177562d5eed862c114350ace1fa812a9a2f21591e7
SSDEEP 384:3YWmYkUTKMyVo2Y6tcvvju227pLDW6LYzvfXJZmCX0s/nhqXUZs:bjkUTKInS2UfLYzvfXHmCX0s/nyUZs
TLSH
T1B1A2C15197FC6218FAF76F3AAA7826168E3BBD92AE79C10D1120515E0CB1F44C9B4733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1048.dll

SHA256 e8836d5554a265c8aa0eb2d953686f7576f7ed4722833817e51e8fba8d69ca1f
MD5 a27989257e3bcc5f38b5e6fb22b05dfa
SHA1 9ea52026b416e9523e1728a455209e5d4af67b86
SHA512 a25ff222e5970f1d564cf0da094b00f7fa3e806c17764c1c5125ec84919543756ebe2da0a1e75cf18e92e5db7a29fb5e89667f5409bbfff568e1e5fbf78ac31d
SSDEEP 384:pYUz4Qg+FM1hrXib+BMDx90yHpAfMh2ECfs5G:tw+FUhrigMDXMf62ECfX
TLSH
T11B92AD51A7ED2229F3F77B34A97816180E7BBF63EA79C11F2611505D6C73F849820B22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1049.dll

SHA256 70d52c7e5072e880e557da09c3de91345165ff3f0c7527d801e5810481cd2e8d
MD5 9d286dd8fea3285de78df8051ef50906
SHA1 621e6207c2f05fc50447681c0cf8cd58b9506237
SHA512 9a498084eaba48c8d68f85b23bde87f95bf13b5510b7b2bba94671e9fa9c7b39383e93fc3fbabb81f7506d644b2642f66699e6b1ee39351d93970685bfa816b7
SSDEEP 192:UNqXeKJR9CdgbQFVY5OV1L8GLothMDoVUYn7sbsegMk80FI3FrVkkh3:UYuKD5OdLQhMDoVr4bsrMk80FOF5kk
TLSH
T15392F40FFBBC9256F494E6714F128DE7216AF714772995CACA8F3D2A605C23933106CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1050.dll

SHA256 94c2a8dad5baafc2df518574f1551c9ab54dc8b27bc16d6c856efee8362357b4
MD5 4397817d71dcbf7c74921b7949d555f2
SHA1 bc1049e6d185362580a46b9df2b3cd1917824571
SHA512 5a4d649c97f20e5e30e4b9b9d02dc6f58ec58b062b6553735098dc023da675be8514994f11a6f88808f2aec0843b49da8901d3f080c22d4fdf454c2983a34f0f
SSDEEP 384:tXYbvNSAhpeC8vTrmsiIaeARZtfH37UN0lgA+1yXIjJXR55z/Br:G1SQehTrmzrVR3w6Gr
TLSH
T1A392F502A7FC361AF5F76B3996B917544A3BBDB1BB39C12E1160128E4D32F8095A0773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1051.dll

SHA256 51308f44ae640de1878536415a9f756fdc4d42c07eb73cc03d93639305a48103
MD5 a96d4b5e325c3be01d34b4f63ca74e9a
SHA1 a7cb88f1c4bc171a360e55bf8b6dd61bc6b8d9e8
SHA512 f8a96edfa3d2245eff132e85f3f15c5b97af8f7e04e9c2896e405e53ce1bf15a4c4b5372de49a73eaf7fdd71164eed2ebd322567ed8c914c2553faf2f203f7f5
SSDEEP 384:DYKBqsNHA+1m1nWqPTQbuuwmLYYZZE+Pibl5gqsxgLg7:PF+b3YA+PiSg
TLSH
T16A92311193FD1696F4FBBF38A5B402604A3B7DA5BB35C10FA65091895C32F84D9A0BB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1052.dll

SHA256 37318659f99e2e2a5af15bdb7afc86179a1f8dc4a7954f4de329c1eb01552834
MD5 8172f31d421ab9916f4c3a95e9ad90bd
SHA1 6df60c63b7902dc60ec52c6dc8ff81f7a70f6869
SHA512 0d859e0ae248ac8b0114cc06167546d0b3a5c66520f320de81a9b1d3a76bfbe7a2b5b1686648b6721a1e789ce0ebc5364f43104f6f40a9958a9328b44f01688a
SSDEEP 384:3Y76Sh7h+jZhoKZjAsJJC96UVt6Y/VvH9vc1Y/bMcXX8+jTK+Jy0JXlB6iuK67rO:ahtKLZ0sJJ06M6jCDm+flB6iuK67rHMf
TLSH
T18D927B1293ED6259F2F77B355AB847407A3ABEA2BE75C21C1604610E4E31F96CD70B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1053.dll

SHA256 a7eb3871301141298ac240236d026b866ac384e6026619385f830683763ccc63
MD5 12a17dda6126c3ce258852b5756e2f85
SHA1 033c7b38b772538545e47ce5c7a5512d7046e7de
SHA512 53a377919ab559f2e0ea2eb269ed212b231ebb342a2bc378e3b4b19ab4da18bfa3a8278e74749db9594345cb1bab4bfcc809a2d85d1e0992124042f62e66ebd8
SSDEEP 384:qYQ9BGjQCKstCcQ1bTv1MKlD03BTTTNXMhXOq+ZX0rUte7sPeYe5:cz1Ml1PVMh+qe
TLSH
T1D7920E5193EC262CF5F39F78BEB407404A65FDE16EBAD21D1620509C4832F99DAB0B72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1055.dll

SHA256 8c48769dce2904aa757f7d2ffe8b3075e588cb3b314b1d41a2eaa4b24031ec6c
MD5 dbc7cb50448786ccd95fd99ee9b303c4
SHA1 d5f1815c33bd62879cd0ece510fe873094f33c59
SHA512 a75620e81e426f2cb58066d898a0e1582b51c6de77784b894435f4bee0da4d220d7ea58fe0607e2537dee3d574ebf6c8adc586513e1c41ccdd1f833349d40d0a
SSDEEP 384:UYt49S+O/6j254bbk4auaFwnbuDycRa40UfSjhNAX97hv:b49FO/6i54bbsuaFwnb08UfSjhNAX97d
TLSH
T1B882D25083ED1116FAF31F7A7EF561520AF67DB2BE39C22F2710206849716D4DA24BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1058.dll

SHA256 0d2c829cae1c8d55cb7b53a1de260aca5e3f9c63821a043eb8ab3c0cef182b81
MD5 46a0923e813bcd83571dd6c41fa17101
SHA1 4fbb63c39be48e666ae9fa14f8f7a43be86f55df
SHA512 fbf531e0637e92058336cf067b185cba18bc441f00b12deaad993bd96ca79812356a94410d50506f9ae40e67498ac6495a1c8f36ee66592f93f80c988a422b92
SSDEEP 192:XNqXklr8vagyCkLMmDj4vxql5NGv27YWBmH3DGz0FRUcmwKNcNch9dyZznXJTez:XY06gLplGvtEU3DvRDKNcNch9dyZj5T
TLSH
T16082244FAABC8665E949E5B24F4245DB10ADF70827E986C9F78F3D21702D2393350AC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1061.dll

SHA256 92bbbc9d4e4e0bca179c8c8150437c75faab2b03bba69c2df09d2940661ea762
MD5 99c7c2f18ce16668ff1c394d1531ef63
SHA1 c9d4b600af13a4130a06caa8b289d8fcffc0d001
SHA512 eb47817e8d8a7a80be1af277235f3c28b064548186b9a57784b501b61ff7c807822da06cf1f0e5c05372e8b1ad999f4a38cd0cd7dfa0df285acc5e592b27245d
SSDEEP 192:QNqXu/1Lvm1GodasDyNh0RsPH3pcxKKuIDUGpvz4cZkymbVjuWt:QYKzzodasDyNHv3CxKKueUFcZkymb
TLSH
T1B282F49697EC6128F3F76E317DB812454A67FE87BEB5C22C2600111D6D36B90D970B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1063.dll

SHA256 800f1207ec52e07977b2edb390645883934f1c2954263c6d704b0285afd41c42
MD5 18854fac74c477a6bbb8a76032d71a34
SHA1 cc0eb0de8bd5a3e74c1576d5ffb88dbec3819552
SHA512 0154e16097ad12d18578e1b5ced6d541a409f9d564ae2866e28fa30ff44f4392319e27c5582418f4b6fec418d292bf3d258b4a7f490b77bdc66887458267a803
SSDEEP 384:DHYqVzPBdgquYZEtOnkosbfXx+mKHvOG:bVzPByFYUOnDsbfXsLvJ
TLSH
T12F524251DBFD6129F2F34F35A6F512050B7ABE967E3AD22F2920410D9931E84D6B0B23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1065.dll

SHA256 a5765e2e1b5c4d09f9fcf5f14f1093b68bcd63a64b3753985d3adbbee1f0f387
MD5 77588c428f4bd02b703772f60c127f01
SHA1 7b80450eb83dc4eac9bbee72acb4bcbd634092e9
SHA512 b2970aa72c0f51de4e80be8e2a90fe0ebe80826bb60da821bf2ba4ff748d5a79d1eff2fedeba4758a9c8b2cd5364d928ad0095a3b5eb2ce9a8b3bad51696c0e7
SSDEEP 192:9NqXELP60QPmPB9oGg6QVc+K1zdIiCxJ3fQlfoHi5YvI4EnIFtf6A+hTaT9:9YwP9WyBg6BqiplfoHv7EnI3T
TLSH
T147826B054CF4C9B6FA576338C983CD73222290DC65DADB328FE5583E0A650BC9B4FA65
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1066.dll

SHA256 2d2f4f392c82d93977bd3a3bb3fec013bb8abaaa0d62669c6223b1d5d63d20a7
MD5 a7a626fc9a36370943e2acc8f5408f47
SHA1 95487c3a8b4830163a95f4f4873026fae2a18bf6
SHA512 d12ac2a79c50b0cba93e82b2f65008222ad8914c67e8b7d491a7152edd90a776889e6dc5500c439550cfe5a0985d54c447758405a8efcf6e609908d6d3862f9e
SSDEEP 192:2NqXaSw8FYLbJRsYbsYie5VcgVwCroLqI1LBBLPhajUHN+saPbZgAJALr:2YRnFEb/rVVroLP11BLPhaYHN+z/S
TLSH
T193829A70D26FE029F1FA7771442A95640EA9FEE6F53BF702C3165E4C1528901EEA1B32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-1067.dll

SHA256 cbfdf1d0be5deecd94e310e186d1f756d7eaa79230ee50b91f96e6fdd4e560fc
MD5 24ff2a278bf8513c0a951d769ac6fce4
SHA1 dd6664bc54eb36bae57f149596a25b7210d9ff75
SHA512 1a3cf3ce571d211fa8f62e7d615ab95ea03b33fbb6900cf3fd0cb96f4ce6135b08cf96eea0380619ea8833bf43fed09cd17a956f7bf3d38588042f631933003d
SSDEEP 192:SNqXkUZS6JN3y83ACYrNN5ptsRbuI18eA9+iwdmQ82OOCpNRhRXVi0NFlrKStOg:SYfv3iRs1NTmQ8ICHRlimZKStO
TLSH
T1BC82DE7704E5C16AD907833412872B2D3E6BE3E1E154BB1682EC912CBBF4507E95EDE8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-2052.dll

SHA256 3a08bf29f07d6cb158700a6c707356639e965843bf81f74b077005c363cb5825
MD5 f2c446db8557d57231169c4351daae7a
SHA1 91264400c67547aaa49f7d662d14a2f2e0c75c47
SHA512 972e428825930a938b86f2b6847390fbba0f597e95b55480ee9ad956ec35ab72d08309ce647a0cee17819452b59490101935ef6ccaa63eb8271253ce18960ba0
SSDEEP 96:c7xVs8Mj88GixJOGLDo4n5ZUdXvroj80Zqnm/948iA9L7SxbTHbFSCAkd:cNqXwjmLDo4LU9v8ZVq8iA8vAk
TLSH
T1B6F1B711C3CBE5EAD79D81724EE2885A47F8F1D8A279DB2B2B08446EC8107596D42B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-2070.dll

SHA256 07107ddf76ad1ea320fae9242488f435f866be47b7a667f369826bb20edcbe5f
MD5 83229e855a94b3ca4e0de77878a5acfc
SHA1 180018bce5e86f02e6fd7f8d468ad320ce0df608
SHA512 93a4565cb89abb37690b59a8fa61d925f297516cd3ff2e540085f65de3d61a7e40823c550adacdfe5af275dc970dcb1d9bfe86445366aa7a0167926f1796263f
SSDEEP 384:WYsvWttryBb8s7YszutMQjbs7wRj1LP4GzEJg6ZaGs6cO6:8vWttBGYqutpjJRj1LP4GzEJg6aG2O6
TLSH
T16DA28C1197FC2718F9F76F3A99B85A254E3BBD92AD39C20E1120206A4DB1F44C974B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Lang/lang-5146.dll

SHA256 fa8b04d56f3a7c631c1fc79b055860a870d455902aa5603b18976155c2d8d5b3
MD5 d9652d56169adbb5424dc9ffe0d3af58
SHA1 c56c7d998808b5b3c11bc09dec6dcd104ff07c0a
SHA512 d1df17df7aa84bc46f86a31cfa94a7d3702c0303d0dd7d1650473f85841258bfdc9717fe865a2541c3358f2f2757f8416b74e4444b30818cd987115a9e0f5025
SSDEEP 192:aNqXJJR0T/wSr4Tdj/f1xfgA/ukq32zEB2zne0P32k9E+oXZSisB0kOjHQbfv/v+:aYfRdrFomZoYbffmj0X
TLSH
T13C923602A7FD261AF5F7AB38AAB813544E7BBDB17A39C12D2150124E4D32F80D5A0773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

df.exe

IMPHASH f8861209dc86054cf7ce940c35431c73
SHA256 2451785b87c1b015e32b0744efc552f7bc2cf5317137e0944a8656c3d3beedfc
MD5 6d11a416a8f170bf55e55d3ab2793aba
SHA1 30d10ad49815b4c4aedbbbf9080e2ccbc63dc328
SHA512 6095dc9cabe3007b91973f75ca1c0b461b0864295beba87e4366cb7683004856cd446775a739c469a86e27a07a77d13778d22402a23c571d506f0d6562458fe4
SSDEEP 12288:4qquduxd1DaYPxNhY/QgAufTpf+mZXAw4LG7g8hkerB:6xNhY/QQTV+SXAw4i7g4rB
TLSH
T198E46C40FBEAC172FAA3157308B5C71E5632BA565B358ADFE348074FAC606C16D36722
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

20:d2:c0:70:ea:bf:f7:c7:d0:88:f0:ad:d7:ab:54:6b:57:2d:60:4f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

201002

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

d:\projekty\defraggler\build_temp_df\tagged_build_src\bin\defragglercmd\release\df.pdb

kernel32

LoadResource CreateEventW FindResourceExW GetSystemInfo GetTempPathW GetLastError WideCharToMultiByte WaitForMultipleObjects MultiByteToWideChar GetComputerNameExW FormatMessageW FreeLibrary FlushFileBuffers EnterCriticalSection CreateFileW WriteFile LeaveCriticalSection GetFullPathNameW GetLocalTime GetModuleFileNameW WaitForSingleObject SetLastError InitializeCriticalSection FindFirstFileW GetCurrentProcessId GetCommandLineW GetStdHandle GlobalMemoryStatusEx lstrcmpiW WriteConsoleW DeleteCriticalSection SetConsoleTextAttribute lstrlenW GetVersionExW GetHandleInformation GetProcAddress SetEvent LocalFree ResetEvent LoadLibraryW FindResourceW SetUnhandledExceptionFilter GetCurrentThread LockResource SizeofResource FindNextFileW GetCurrentThreadId GetCurrentDirectoryW GetCurrentProcess TerminateProcess FindClose CloseHandle CreateEventA CreateProcessA SetEnvironmentVariableA CompareStringW CompareStringA SetStdHandle GetConsoleOutputCP WriteConsoleA SetFilePointer GetConsoleMode GetConsoleCP LoadLibraryA VirtualAlloc GetSystemTimeAsFileTime VirtualFree HeapCreate OpenEventW SetErrorMode GetLogicalDrives DeviceIoControl GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetDriveTypeW GetModuleFileNameA GetCurrentDirectoryA OutputDebugStringA GetVersionExA ReadProcessMemory SuspendThread ResumeThread GetFileAttributesW GetEnvironmentVariableA GetEnvironmentVariableW GetThreadContext GetFileAttributesExW InterlockedIncrement GetTickCount CreateMutexW OpenMutexW Sleep ReleaseMutex GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency GetDiskFreeSpaceW GetFileInformationByHandle GetLocaleInfoW SetFilePointerEx ReadFile RaiseException InterlockedExchange GetACP GetLocaleInfoA GetThreadLocale HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap InterlockedDecrement CreateFileA FormatMessageA UnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread RtlUnwind LCMapStringA LCMapStringW GetCPInfo GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree GetOEMCP IsValidCodePage ExitProcess SetHandleCount GetFileType GetStartupInfoA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA

user32

UnregisterClassA GetSystemMetrics

advapi32

InitializeSecurityDescriptor GetUserNameW OpenProcessToken InitiateSystemShutdownW AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityDescriptorDacl GetUserNameA

shell32

CommandLineToArgvW ord680

ole32

CoInitializeEx CoCreateInstance CoUninitialize

shlwapi

PathCombineW PathRemoveExtensionW PathIsRootW PathStripPathW PathIsDirectoryW

version

GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeW

df64.exe

IMPHASH 3395dbc71442fad8b5618debf3dc9ce6
SHA256 6b6b67156fea12ed6e8ce5fa86cd95e8fb38424d481b6553288595a6c9a392ee
MD5 f5a97f8ca729eec6bb978449d9c20b33
SHA1 5787f0ca94a66a0a2f9aa3d86dcd5380d123f245
SHA512 0c44892e295d5965e77947fd002d22eabfbe29fa9e35e969e2c7b125e4297760cda114c548871dbf4678cd3f645dcd5d8e1c80f74ec52a73028a76d25985bf6d
SSDEEP 24576:RI4eEA2hfYaLODT4Kt5WpZOzDvuwOdU3OrmbVH63vrU/s8Hg:24eEA2hfz2EpZOzLuwOdXibVH63vYNHg
TLSH
T11A355A15B6B840A1D073D0BFD9A2D686E67178851B308BCB0251CB6B2F37ED6993D732
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

4d:3f:e8:77:cf:dd:80:2d:e9:c7:19:04:24:58:5e:d7:a0:13:aa:6f

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

307888

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d:\Projekty\Defraggler\BUILD_TEMP_DF\tagged_build_src\bin\defragglercmd\release\df64.pdb

kernel32

FindClose SizeofResource GetTempPathW LockResource LoadLibraryW LoadResource LocalFree FindFirstFileW SetUnhandledExceptionFilter GetCurrentDirectoryW FindResourceExW FlushFileBuffers GlobalMemoryStatusEx WriteFile InitializeCriticalSection lstrlenW EnterCriticalSection GetVersionExW MultiByteToWideChar DeleteCriticalSection GetCurrentThread GetProcAddress CreateFileW GetHandleInformation ResetEvent GetCurrentThreadId GetLocalTime FormatMessageW SetLastError WaitForMultipleObjects SetEvent GetCurrentProcessId GetFullPathNameW CreateEventW GetSystemInfo GetLastError GetModuleFileNameW FindNextFileW GetStdHandle WriteConsoleW WaitForSingleObject SetConsoleTextAttribute FindResourceW WideCharToMultiByte FreeLibrary lstrcmpiW GetCommandLineW GetComputerNameExW GetCurrentProcess TerminateProcess LeaveCriticalSection CloseHandle CreateEventA CreateProcessA SetEnvironmentVariableA CompareStringW CompareStringA GetConsoleOutputCP WriteConsoleA SetStdHandle GetConsoleMode GetConsoleCP SetFilePointer LoadLibraryA GetSystemTimeAsFileTime HeapCreate HeapSetInformation GetCommandLineA OpenEventW GetTickCount GetFileAttributesExW DeviceIoControl GetFileAttributesW GetModuleFileNameA GetCurrentDirectoryA OutputDebugStringA GetVersionExA ReadProcessMemory SuspendThread ResumeThread GetEnvironmentVariableA GetEnvironmentVariableW GetThreadContext RtlCaptureContext SetErrorMode GetLogicalDrives GetDiskFreeSpaceExW GetVolumeInformationW QueryDosDeviceW GetDriveTypeW CreateMutexW OpenMutexW Sleep GetModuleHandleW QueryPerformanceCounter QueryPerformanceFrequency ReleaseMutex GetFileInformationByHandle GetDiskFreeSpaceW GetLocaleInfoW SetFilePointerEx ReadFile RaiseException GetACP GetLocaleInfoA GetThreadLocale HeapDestroy HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateFileA FormatMessageA UnhandledExceptionFilter IsDebuggerPresent ExitThread CreateThread RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry LCMapStringA LCMapStringW GetCPInfo GetModuleHandleA FlsGetValue FlsSetValue TlsFree FlsFree TlsSetValue FlsAlloc RtlVirtualUnwind GetOEMCP IsValidCodePage ExitProcess GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW

user32

UnregisterClassA GetSystemMetrics

advapi32

InitializeSecurityDescriptor GetUserNameW InitiateSystemShutdownW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW SetSecurityDescriptorDacl GetUserNameA

shell32

CommandLineToArgvW ord680

ole32

CoInitializeEx CoCreateInstance CoUninitialize

shlwapi

PathCombineW PathStripPathW PathRemoveExtensionW PathIsDirectoryW PathIsRootW

version

GetFileVersionInfoW GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueW GetFileVersionInfoSizeW

uninst.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 29e443695f1445c2fcee365df574dbb90f1b7b126556164c1aeb2dcc9699208e
MD5 255766b1e21cbdf2bf853356adb14548
SHA1 54914b1010d5679b27fa436da7ddb068a01e4b18
SHA512 8ef131f7a65611fdd36c42d8c5ae29d6eb4e3b62dadb9230fc8f32ffea140a0d679e91e2ce7dcee88825ae04f8a2944cc0b0dfa688b0152039aeded516a4f333
SSDEEP 1536:AQpQ5EP0ijnRTXJGyqkSZZZ3gN4Fib4fhqq+rWgmNsn+4oFIpekyXQXCCM3CLAPP:AQIURTXJLUvobmg+DqeD1UAPfZ71+Lxe
TLSH
T1D7C3AE0267D0C8E6F8990A3195FBCBB3A733FD0265906A4777943B5F1C33646EE19289
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.
NSIS installer

installer

PE Signature issue

Digest

c2:a8:6a:db:50:8b:96:97:17:23:89:28:bd:86:3f:b5:7d:87:cf:7c

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Chains

May 17, 2010

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=Piriform Ltd,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Piriform Ltd,L=London,ST=London,C=GB

Serial Number

2f:5a:8c:1e:93:2e:db:fd:48:93:91:6f:c8:80:df:e7

Issuer

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2009 - Aug 23, 2011

Subject

CN=VeriSign Class 3 Code Signing 2009-2 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)09,O=VeriSign\, Inc.,C=US

Serial Number

65:52:26:e1:b2:2e:18:e1:59:0f:29:85:ac:22:e7:5c

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

May 21, 2009 - May 20, 2019

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 2017f2acbdaa42ab3e4adeb8b4c37e7b
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
TLSH
T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10544

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 f2d07a76ad7d89e64ee261c81039205e44cd0f496193a25de08eac488874e1e0
MD5 6412e0b095da5095b321d376eb912ca5
SHA1 e93a95c724ba969c656f1cca47595a178176b238
SHA512 f1a32da61b3d219d72256c2fcc5e01923052832b88c86a8ed3efb369e7575c7e54af77fdaa690c03317a64be04c3bfd6b2e16095dfed2e9c6b6ed9af59e57b2e
TLSH
T1C551B53494384868F3D54BE03A01E85CB6F9D4041A755E0363515B7E9C821ACC4BD4F3
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 1ea1d0a8b0302840b2ba4743fdef788c93517ac083b7a9da7dd25640251ce061
MD5 bf670074262a7e29da8c0ff2d94c1438
SHA1 5d608a1cb519e5751a4736a6b8e9f3e80477f3e3
SHA512 6c974589ba1e2939e86216078b5ec8bf750346fa77ee81e85a7842aee42cd33f858de9fd2d6837e264f73ab18c1b1d26c4a29336da4e4b41e83c465371c94ca8
SSDEEP 192:7XEVeCHsVXE8EflKJVdzVqWx0AtYDv0SbS5v5VVpvyy99m:rEUCHsVXVHlVqW+tDv0SiRhvf99m
TLSH
T171121997651A601FB04404E46CD20A4E89D485F6DABDFE1AF8E4CCFB74578282AF026E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Sharing

General

Malware Config

Signatures

File Explorer

dfsetup119.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/ioFileY.ini

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$TEMP/ytb.exe

PE Signature issue

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/LICENSE.txt

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/manifest.mf

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.rsa

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/META-INF/zigbert.sf

$3/extensions/{635abd67-4fe9-1b23-4f01-e679fa7484c1}/chrome/ytoolbar.jar

content/ytoolbar/cache/about.xul

content/ytoolbar/cache/option.xul

content/ytoolbar/cache/sethp.xul

content/ytoolbar/cache/uninstall.xul

content/ytoolbar/contents.rdf

content/ytoolbar/dialog.js

content/ytoolbar/dialog.xul

content/ytoolbar/feedFunctions.js

content/ytoolbar/fileio.js

content/ytoolbar/globals.js

content/ytoolbar/history.js

content/ytoolbar/i18n.js

content/ytoolbar/installerVariables.js

content/ytoolbar/network.js

content/ytoolbar/options.js

content/ytoolbar/setHomepage.js

content/ytoolbar/toolbarBuilder.js

content/ytoolbar/trackinginterfaces.js

content/ytoolbar/uninstall.js