home

freedvdripperplatinum.exe

Nopumalifo

Huaxinwantong Beijing Technology Ltd

The application freedvdripperplatinum.exe, “Nopumalifo Setup ” by Huaxinwantong Beijing Technology has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the Inno Setup installer. The setup program uses the InstallCore engine which may bundle additional software offers including toolbars and browser extensions. The file has been seen being downloaded from www.funtourbundle.com and multiple other hosts.
Publisher:
Purek   (signed by Huaxinwantong Beijing Technology Ltd)

Product:
Nopumalifo

Description:
Nopumalifo Setup

Version:
1.4.2.6

MD5:
67dd287aad49ba4376a20afb58691bb7

SHA-1:
5dddca839f05add9cc59eeab2295b0f65f2f874f

SHA-256:
3fbe19788d8f4a9b53c42673fca681e11495210966cd9c5a19e542c276466cd8

Scanner detections:
1 / 68

Status:
Potentially unwanted

Explanation:
Uses the InstallCore download manager to install additional potentially unwanted software which may include extensions such as DealPly and various toolbars.

Analysis date:
1/13/2025 4:11:28 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP.InstallCore.Huaxinwa.Installer.Meta (M)
16.6.30.14

File size:
906.5 KB (928,248 bytes)

Product version:
2.0.9

Copyright:
Fast Software

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Language:
Language Neutral

Common path:
C:\users\{user}\downloads\freedvdripperplatinum.exe

Digital Signature
Signed by:
Huaxinwantong Beijing Technology Ltd

Authority:
COMODO CA Limited

Valid from:
3/23/2016 9:00:00 PM

Valid to:
3/24/2017 8:59:59 PM

Subject:
CN=Huaxinwantong Beijing Technology Ltd, O=Huaxinwantong Beijing Technology Ltd, STREET="Dong Balizhuang 54, Building 2", L=BeiJing, S=BeiJing, PostalCode=100025, C=CN

Issuer:
CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:
00C31292C6449E082B3FBF99E310243E2E

File PE Metadata
Compilation timestamp:
6/19/1992 7:22:17 PM

OS version:
1.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
24576:Ati0NiGXIAR5v3nWi+dZKEUQq3p9UdRC+8Y4:AEcbXV/t+dZKEVq5b+81

Entry address:
0xA5F8

Entry point:
55, 8B, EC, 83, C4, C4, 53, 56, 57, 33, C0, 89, 45, F0, 89, 45, DC, E8, CE, 8A, FF, FF, E8, D5, 9C, FF, FF, E8, 64, 9F, FF, FF, E8, 07, A0, FF, FF, E8, A6, BF, FF, FF, E8, 11, E9, FF, FF, E8, 78, EA, FF, FF, 33, C0, 55, 68, C9, AC, 40, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 92, AC, 40, 00, 64, FF, 32, 64, 89, 22, A1, 14, C0, 40, 00, E8, 26, F5, FF, FF, E8, 11, F1, FF, FF, 80, 3D, 34, B2, 40, 00, 00, 74, 0C, E8, 23, F6, FF, FF, 33, C0, E8, C4, 97, FF, FF, 8D, 55, F0, 33, C0, E8, B6, C5, FF, FF, 8B, 55...
 
[+]

Packer / compiler:
Inno Setup v5.x - Installer Maker

Code size:
39.5 KB (40,448 bytes)

The file freedvdripperplatinum.exe has been seen being distributed by the following 22 URLs.

http://www.funtourbundle.com/7DTZR690W7icWHLM_RHmnVGxylfqm0hZHUAgf4CJgz_8t5875hewlcg0Liiu1pm2LqTIcUVtMTYK8ICkNOb1i0xCNRIAOMLPhyzZz4xzqbFSfBCCuQCj7chZ6WUFLSMBtMaCHt003qwnO1JKv0H3VF9FhrI X7vNQtAUfAIkIFZRGe67ULJpp0lY2yg3oczuYeGKxQNWEcj2ZJK96 1jwZQ 2eUt3w==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/sPJ63i7JcXOjLigfUgkwgJoBnECJAhAIXrbp9bYT2QQ6R7bjwvca6s4_inDreM78x71aENpq3HkOD2Kc1NLJtSxL7cC8zfB6gIL8c0zSIsOb Au571MnMmagn5UqbD4PT7q_J8495tz NgbadIvVZPkZYP3znH35qlol8oCaNw7PHG7HLbUPDCDgDNffNNlV2SnyMpLLLqq3pBt0KYa8n6ZepYdfZw==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/AyNNeHrio2HeIXGqcWQHaDVbPV20NeO6KahvM9iqwrPGmdF2BAVdRv gJhPv59qvV_nXPtFLxtCN3BgWmNKy9XP_Edhb9udnh6PmHEAMrMxfv8N0axPjNzTsDNfqVx9_NNGq3tzSSaG6GoGCwJ8NeSEhwBq6liDf3mejd4kvAw h25tjgCtdloFjAKIUK_7tNdTnDBhIorDoGGpS0ZyoD7PQX2DdRw==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.giftbundlesfactory.com/BPWDyI6S EfiW1IK3jsP5iNZgofJ_kAr6HQfo_Xi5IZL3StOATjDoXTBxGZtS047rT6ffSS7bdoBbgW9gW5xxBilG6Q0862CCXZ4sgMnVq8mtwW1UwDvdnapKqJ6fzoWdrmANaGmzDkdiEyE44N84ns1Q1CSU2 vSlrDHCAkBbY7IZhSyz lTzRGSm1IvfJwo0 qyey C6e33s2UYoMuShSO9SqDbg==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/fLCw0oaMMQscly_UJ24V9NjpL JpOrNitqZciRzbxAOdxzJDDV3MiDvZfUkAA7GVi4cqMljautze7Koc9YZk1RwfcX88Dct7H1pmidV8Nx USKInbdPIJf8gh6ELFIGTzlruPk_vxFhf0GaU9MBNyjVCXTIgeXQNVwxrLwtRngXExqcs0KTGeI_XI30UBurc4hVp4cNwJa9 AkvsRmAcBRWJFq9ubw==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.factorycapitalstock.com/C7_YqE43jfPlsoqRAL8GbuE00PU U48iNIElizY7h97WeVgXd3w6JFnUBVT6vjA6WwTg9WlDGsjwqsCsH5GmsTfaRt ACfjpabe7SfOqQA3zpJ7sAjzU_hERqsQGDnx8FcJ76Tfq7c1KvvvDd4ga1qxcTvFPl2UD 2AlNmEV4WB6wdG iJxk o2f1qTXrEyJIP5D2KTUz8eTrOPpQUFplSQ_S ID3g==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/aDB_sI4gvkybo4Anw4Vm8utby4lrBYeTpDEwTN8c0Rbq 7Bp7_GbfmFAnD7VqO5YraaMCqKUXL8b03EI2jAMs9eRX2kfEnhn6BYRzXFPLPHo0Smo1bjazIPljQzuwqnZ5TT0Cd6FvjcIEUTBsMyMXVway1RI3zydMn YIR8QupGlxG3c_l8jBbs9qquk32mR6eYiREvUubW5kjv15CgI51hBkx IuA==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/gzdfxC7z7ph47Q_XDRbS2BnSeiWKmA5qwUXIDZ1caA5ciDieENWIyTgcOM8Y_1Hujs7Owx9S4fv3ZgmHr7fC 1P_ZTd9oAl7wflVip_DzW6z1lAODzjXD0qhmE_GsLMoWMy4SPf2rL81yaIaoq1zeAKp5AscYN1wrDh wsLvshuHfxIvnmHw_ULV26CZuZiiNjBMFD7iMY8EbnxNJQTQwntjXqtPuQ==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/z5S4CjPvQNg8YzSRP6Zsl4DeWO77TUPyVPH6h3Z3IZ9_xxaFtpo2XpOLL1NMGVBZD_VGmCfA8X_8zZPRtajIGEABymdLjwv8Dbmv7xicNbzUgbbvePEOO3rsDwn0VqsoR SXFdsMRpRzuWBwEQl7qY3kUwlU_dSHixFL03s wNZ6jnWSAM1Jqk0uQmYA0xnKwPR Sszf5dVyW9w_op5PB97 EHDQoZpyTOyBzLeYNIg5MoXYJZ3EVc2w330nKLUJ eeHa60wu5VxZu8aOuvgGkok0AtMB6xLoizu2TKGEsQDVwYaMcEKDYYFDstRjcV0jHbNd9AkdMmK02R8MSExG_QPxFTNfzn93dw70w33dVkVpB8IWWx5Agf7mBXvMPTmZlNbUbzhn9frZS0kUU23pAbFko0W0gCRtTrpm7BI dMcd5MJVhDMcHV9F30vM6JcMpY7dEJCyCzCVNkphGVpvePP6d9IoA==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf-e

http://www.factorycapitalstock.com/i KL4J LTn0lLPvmSN7qUX7MXJgiSiabRoG2lwvJYO1gAW0cYPjvPkgBF7_j31Iw7eD6Oig9U98VUzdbN__vuVYAYLHgx qPf6CUKbG48ax0pv7A_fCRIMlmRp XxrJ797dpWeNTtwKXMRixGtJvF1eTjn4u5ZjqTBeatB7G3R6AQ7uTyPN_6UtVj34T3Ay5BxzV0IfETTxQMZzP8ha7UKB0tOkB g==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/EiRC7EbqK96UTPhIlymyRBWI8kOxAIATizn2fwMj_GJkAEGUfqV2gZN09QoNjHE7_aALshfWarxrhsLMc8uPXaRLcjn5FF2 3lKG1u_47XDmq_biG4ntBOqU7 oMR4vr0QWolcPX9V8SI84A_xtfjhuWkxhmwkqHKsocqsKPhATOWN_d7hubKKFiaVd1MwvohhSQ9sdRZ6Ar_h1tTxwzU7 CYVXikA==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.factorycapitalstock.com/XX8UPRXgzqd5UhawHirlNoXuk0_uM5QJwRuHlvdm_g0Jp2b_EkE2QPyFA2wSHeY_1KitpMtN Ty_fj9iHftg8I1ODXORn_uYSzl6IgdYS4KvrLMfyOenTZw6UgB6L 5u Yfv72gMaNZDY8MB9womwST VVMN5IEqn278ETeRrDlbvW1XT2y37CLGzaKPogF4sqJA8IkNRqHN0xreTVEEDMUtUH9axg==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/SeGX1dMESwhOZW Q9XIldFv4gnTZwbq6sKaAOYT64XZCeayLQZT_bnRIHPrxjTMs7AY6z4oRkIWPPjYJyY8lmbgDXpZPcY7sWs MJle2xSudce9Y5Cw5PDr wOb0cfFUd2HzDyhPXIGOLhMeiVR9Ph6F92wAutt38efaIcoLlKCNi78h2WpHWTVZ0iS2PKqvgkHJ skPP7LHDrCxGwGVgnKSiBj6sQ==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/23kkOu uxWrSwf7CW6bozbGWgwFuEeC9wvsFKgoiC2RNJNdIxiQ7mVC2_QwFNdcKCnEpKFWHNWZnejRFJp76xr9ESFoB3pog5UPHPdMnZT9hK9Wr6Pt8JhzwPGLEdKFaCtaARnUJNsw51LUajMJPFtxsyWNYQW EDu2tjGZuTnwIaKbZJUNWuFFvSSTEEUxJKC7_jCSNYu20g2IkCx pYy 1_ycwOQ==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.factorycapitalstock.com/MADJUVypcfzUxzujfRYCiaA1hRdT7Gil7pzklQ2PsGpL6kFGU3vdG_LspRGoKDgoUmdbil4_I9UQZb8c9GBA5k8T6x6fHNUTiKuQ2gb3YjRt0TOfL48ILa7M3uU07kvulj2SlHIvocvKBvpiKTZY9J9I_kmscYdsMf fHVr6OTzuUBl0JkIPivybAqZtP8Gqig_AugRIMOMNV6ZYnWJVH5pXGaACMA==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/5bx5rg_orIZ2wUSX beyBC8tIMWEOFie4P1ACT3FxYk6shSyFUVVeuNsP2sbTYFkuY6neRf9prK5HL2iB 9dkbjTpXH6gB6XvFE3u9KzOef4HQtPDIgAGcaq2Jm7sML4DPsJz5nu07SRSIz4kBDPeygd3xB8JMe42pCMe5JHZfYF9viJYtdSW9mzyX5In6Y2SE2nfIJZjRVdzoEPNt9NYvN2BYyewQ==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/ Auu6_GWC_UIWSWFROGGW5JjKi7jNXJlZaBJBZTWR3EIu6ePWfqpAK6r4RGarpxXPlBc_YVN8MAhjIs9_SfTVvGdFlmm4aWJz4KyBoVVCEcrHW1Un55ymh 4CaP5FeQfgEA gopnv7FPr4fqOQfFRJ804rnmjaJX9Coit7zIyy1o475NVHLpIAzAa22VLYTJPyjrSlTTRf6MI_QbzeuXBX2HIJgSpQ==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/Yv4z0QmUWEqkbc2x8dmRSioeJkjlFaROgBC52 HSGfxF9goIEB3TrwA8ni LUk9eMqTEFmEpjE5J7vB5V_WuokS2IaINARP3 5dBDiV8P1C_tZ77_tfFbL5zSxL1x9TaIJ8ubmXBkUCUARcPVnNgAVotBiBnTD9_FsB12d7TclcuYASCKbn54AnitkKwloB_A0CV06QMvHjTMxSbhJuy0_HkJGiq9g==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.taggiftflash.com/tQF_aQcKiI0w_22byHyYvPTco68oqXnV0P9ChwAkvdyiP71ajqNpv2g7kz9AnHrbF1C_qOyopWoJoY7IWdddkFNAYayHzZ3VdA6uM8vLpI49eFvTCWP5nUm1a6Q8Paa0u Ydvw_pvmzk8o5L WWV2qbKTLha7psmIHy4x4I4zQF0jOVprgI TRW19 xPurf5zin5PGf GMe0L_GcFSKKUT2AqQpXgg==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.factorycapitalstock.com/tyRv17F5SlRd_BK353XvDux3IhCAuZtzj0piI78ftUei2sNsNlcSWLlj2GwJeYgf0rAIOa5fup9d0x9ahUMJLRy6R9edl5OgWchS847eb_vHACF aU3L7C6CnfwDT5PfdQEhaWNrxwX69Dab0clv3Apd2EyRCkjTtK9N047Aank0Ohlzzzx50HKsM QexRV_q7puWxkMvBjLyGmgquiegDeNaOTVmg==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/XpCxvOUrVejz0RAnT9e4Gbu4XeEu6gQ7g Rw1tuDNbEDYQOJmy7CZfhvbhp7WnLdxM9wlhXWNrjl CexDpzISiWG0zOkvDOjhhXE5t_5l1MrPtUyM2mgfY7ofE1jdNbqwQ5cjxgx3IPHW6rwxRdxiR_cC6RKSLd2gf2wp2hjbTo2CR2Xlz9WGIOBJvlXcrVnRwGfix0_P9w39602cVkTmXwjgdzp6g==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

http://www.funtourbundle.com/fnvqcaqny8VIinTre8LUz4wWXio4TBXEB913zxTZAweTExckaVHs_tJ9HMjZkpc3J8wsqcont8bJEONHkEVbOre0SY9LHBLqTtOhChBaS8F 43beAvYN1s8IMrFVu_Oz7YqE4U9819oPOP_KwfS0UJLxKY0ns1A On7uORmcQnRhQyvpN9aFL0zx4RnpTv9QFgrvPoC_kIOYUn_bgiZiTmmck8ie8A==-G1wAAMTaOW5vWT5lE2U16IYr F4KNOOA_atIdjeBAeg8h88FhbV8Y8qv2ZzNkQm6konKjRlaTlzBF6ID2rTQDJ5XvG_1VAUf

Remove freedvdripperplatinum.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.