photostampremover-setup.exe

Photo Stamp Remover

SoftOrbits

The program is a setup application that uses the Inno Setup installer. The file has been seen being downloaded from dw.uptodown.com and multiple other hosts.
Publisher:
SoftOrbits   (signed by SoftOrbits)

Product:
Photo Stamp Remover

Description:
Photo Stamp Remover Setup

MD5:
94fb8b7571e2fb2d737120ed2a708408

SHA-1:
509f5d7c17c5cb6cacad4d4c6937c06f834f85de

SHA-256:
c4f386a92b62683fab9c1a4a6a52ae730bb51c59958a697b3a89e5603e056cd2

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/24/2024 2:49:53 PM UTC  (today)

File size:
3.4 MB (3,578,096 bytes)

File type:
Executable application (Win32 EXE)

Installer:
Inno Setup

Common path:
C:\users\{user}\downloads\photostampremover-setup.exe

Digital Signature
Signed by:

Authority:
VeriSign, Inc.

Valid from:
2/22/2013 4:00:00 AM

Valid to:
3/25/2014 3:59:59 AM

Subject:
CN=SoftOrbits, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=SoftOrbits, L=Smolensk, S=Smolenskaya, C=RU

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
18513B11B6E0FCFB178366D4B36AA60B

File PE Metadata
Compilation timestamp:
4/10/2010 8:57:59 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
98304:gdT4SlamnQPTZlETRLfYTTeyC0FhHV9DpdCzqn+:gdUUQPTQS37Cyd2q+

Entry address:
0x163C4

Entry point:
55, 8B, EC, 83, C4, A4, 53, 56, 57, 33, C0, 89, 45, C4, 89, 45, C0, 89, 45, A4, 89, 45, D0, 89, 45, C8, 89, 45, CC, 89, 45, D4, 89, 45, D8, 89, 45, EC, B8, 54, 55, 41, 00, E8, 70, 04, FF, FF, 33, C0, 55, 68, 91, 6A, 41, 00, 64, FF, 30, 64, 89, 20, 33, D2, 55, 68, 4D, 6A, 41, 00, 64, FF, 32, 64, 89, 22, A1, 48, AB, 41, 00, E8, A6, EF, FF, FF, E8, B1, EA, FF, FF, 8D, 55, EC, 33, C0, E8, FB, 87, FF, FF, 8B, 55, EC, B8, B0, D6, 41, 00, E8, A6, EA, FE, FF, 6A, 02, 6A, 00, 6A, 01, 8B, 0D, B0, D6, 41, 00, B2, 01...
 
[+]

Developed / compiled with:
Microsoft Visual C++

Code size:
85 KB (87,040 bytes)

The file photostampremover-setup.exe has been seen being distributed by the following 18 URLs.

https://dw.uptodown.com/dwn/uj30IcNwEufun0aYHfunwdvDX1qSR3VPWxbvd_3EilXePdj4LvZ7vA8BM-1g1U8a23Vll6nrfDbd6__15JX-rwS4DpJUKxkeOqyMxoClQibnYjR0VN7CESHMJ8Lp8Itd/bfjzcEt0kK0RJ6PtYjaoChBLU4n-UcLHSnMP-WyrJjfGcywO_J3mazYFONoqfwcziVLay-HZuZsui55-xMnKxZM4ZV0TpoTIk5o380UBYpdeTtnk7mSEKhhJSQoUMh4M/6l-m6KByLwxA3_mA3qMWtosb30zog3TWCjcoYoIf964ulxMWM0r0piUw-swCuK2kDbf8cXa0GFcvcj88DrNBlfG6A7NzK4sXt-GVoT4ab0fkbyGdTfEVUhu0rJUAWN_H/.../

http://www.tamindir.com/indir/MjAxNi0wNC0xMCAwMDozMzozMg==/photo-stamp-remover/windows/.../

temp:photo-stamp-remover-6-1-es-en-br-fr-de-it-jp-ar-ru-nl-pl-cz-dk-tr-hu-win.exe

http://shareit1.element5.com/download.html?productid=300299854&affiliateid=200012751&ftp=http://download.softorbits.com/.../StampRemover.exe

https://dw.uptodown.com/dwn/Z4HiGIMF3s1J-H_gwDVMXVWAlKOLsktI4vFw2Pvk-AsphxZQ1HwtoNqQ_QCM-TfJMo51jd2vkMt3pTUAWJ7BFVGMJxwxked2vCcViJL3PdKErfREZ-M2J651_AuOf3Ib/DG95AeX0APR8vZf3BzukR0qmhBod0NVfOF2lDpk_bpOBkaFeW3Xo5IepeRQ8FJZyGxp3we2pON7ymclx0yNhRmvrBgTROTFF8uyQ4GvtJvuhiyKHQAtno6nK8_nT977Y/psTuLIEfU33I5SuM1cVGTisOkalpHIL72whVbp2esEcfbcog9a5XlWc0rN2WluTdThsbiB_AL9IyEpnWaKgZvMELRJgVQ6ICrPiqf0y-cVMkNbF-pBcAZNfKZ3JMveSs/.../

http://dw.uptodown.com/dwn/T-N0t92gjA-56BJzYfpcc0bfRUgZoga_oNPXBx6evPF9urSdWvoGTw1ECOF9NSVMExdjGh9yQtAI35NlTNEL7CGZT62s_Fs6w68kEBVUU1aON1bl9NiT2iUah_WEf3vD/RW3B0FF2wRcP148SSsEJ1KqPtoJMrYhgYsH3ETW5sntGcIjq4CeQYut4JN9hUxa-9jM64f-3cEE2C1olJhenjt7KQAXbGlvxGRVcRvY8gVjxkLQ1LAsOKm3nD7VDowBs/4B-qLBwZubeio3tSujSEoc8sXYQgLqshSFBfD-lm6_RbT6jcxKcDW2kibA465B3EbZZugQS5gEpn38lA-KO36nzwY6azDk5kgY3e4yK8M9BpbkotyrKEhvHQg_VAhQuu/.../

http://dw.uptodown.com/dwn/gsMdkgTmngBdD6xdzsCSz05Z9ooCbbo14PazFcXrc6f0j-W44-tjD34waXPgbOZm2KviTq1VdYUiyx-F2lnURdGlbBdvhoWmzZZ3wsGIJsFQPl1eeGRQ__BvHjRwBl_q/GfhXgEeYX0axkc7uN2Hlkjib0L0wWbzalk2ofU_wcDaKAzaS2UxDDVlffu_dFGXdrI94gNa5qFILL8vniEg5Tzyi8VM-FEY89uiuheOMxM9MVi_9PrXlhtiqZ7H7cYf-/iQ8ynR8GO5j4AWPM5sSbi4xvlA_5nK2XFm9fZ6iQrkwc1PUrAEqiU49KTKEzFESFR4ulXkY3IjYsl-xwTT2pQNt66p7RXZky05FMTIVifAjk7w4Yzcxd0SUyfhIEEdSy/.../

https://dw.uptodown.com/dwn/pwL6GKHCdk_VlenD8hvp_fV8aBJ66Mtg9hKcaHrzBexgkPdTf9-Ub_MGEbaF5eeJylNFdko34plXTAzBw1PE1wSP0di_Ep6XdpLDIlzeMN1DE2ZBihr3v2cBZMy0vWc3/-Vu7m6-nY5reQyJl4Mi2XFIcRmppbluKcSkWi_kzzTwLyL_yP6r0m3U45il4Mhd0JsfcJ8JoV60e6lTMlqiLBY6U4dIybRndDBBhmYOwPl-E9pw_WW4VEEzj7FjtThIJ/IUnVgCac_wUNLiB-vF8DArNQobXtQ7IXcL0g1d-H9IsliO10Lx809Uqh8DTznZRGXLohRKuUBCjyVckU3J1X-FVb6YFfFCgeBBwyB8wQj0i2I8SkEeg6vwl_NfyrMa_1/.../

http://dw.uptodown.com/dwn/RCB2xVUANxU7Ta_SaLDoSs93pHPKF7ETHcpluO43Ej8yQenUTD_cryJ9MI78I6b4tmHW1WbjpcbNmhvqUS0Qy4EMSF7ytZv2XTKZotHC988E3AvucIOWJhGn43xA6_g6/Siau1Ry1rSVWUMB8uoJcQV2Q_zOdF_aPHQXHCywgZxj9e9RDp96iqpwJ0jvwBBPpoC4BlnSXJoStHNGB5_oy43b7REsf2KMupMEeatAoFy8TdwGHVJOP6Ui7Q2PNpJ1k/pbl-xfAgnu29JN_ZlJ3FyHBHUUY78DTkMXtCWD3FhdySMeKzov0SENV_cTFpGU02JGeDG4qV_c21ZMxWNG9_pSamIsWX_vnY8HCCucx-1zkBJ6iKoHGHf_RHAPEWGndv/.../

http://dw.uptodown.com/dwn/Pr0D_WMI-kaCKiMM0FhfLcQkhvuDFFiXQEcrtP9Ap8rTm-FgrQeztfQwlowDmKvWquvL0dK6YgerMVuQz5rlYWlDY3ho5Vh2m8Ey6jLdc1X7JULVO6bqIt7x2yGph_je/7t0xhmETJwXdj8TeVYTx2-jxPwRgssAzW93sgqVRfMgntOTCNw1ZbaTP40xeD1QbLqrF5-NoBP9HJkC7qfFiGYRS-5pPDxo_hqGUib0X242r6_rOnRV-BfyCOswOySzN/UpJNoDj3WS925v305iSGV5x7rS5IJMWQlyecMcS9ZZeM0kFaWrGHDXBVc_ludB_iLc9G5lHIxfIiqvWFmPiVCo3ZvTCKvZECTq66eSgC_0YjlutLXyWsc_ccD-3JZ8QV/.../

https://dw.uptodown.com/dwn/2Dv4gJfU5MqK3LDqfhvO5ACCf3xCI2gOGsJMwBzOxujksdxdgDACGV3kQxPepJklnyY3UMhYhKwnysbFl6q4hC2kwSrutMGss3zn4QC9Byw5Qc4P-2sfXxTrpekzfrBH/wh0lpMiCCYou1duH80xjV_mHUtP0sXbSw6cvGCo3aD5tkQXibt53_HzlLReW39Ajctk0Rh_v-6dh_0ObmuHJNb157ISY77wtMdJYITRz5xFmRpGfHUC1pU2Hdze5wLUB/zNrraDGU5iiRBlb9DXpoYr22Ys9Ms9RfIZJZMth13iAtFvLtHZo7EOOou3MJXQLXg_RS4ShklHDVZzln8xSfoml981IHzQXvLq0U5970BK9PnH_ebOyDbBeDWENW18Pu/.../

https://dw.uptodown.com/dwn/zaWZ_xyArlT-hqKI_b_xuaXVzzd8w6NPA5cra6U6tMAtY_AloylQF-PoRJ_Z9lBbmYC3c6ZgzJ2gwuq-RF-lSuLysfk8z9TWjEoWtzD_s-yaxVCIMZ6FJVupC_phwaOX/y7AIhRTglpnVO0DGgtte3xKsfWaHWdHdriHTgzZFV2gsHUEHmD3nlwHFKj9LQKFWiqxrhZ15w58bceQ3RRiuLcmj8vQNDVsmWIAIgOJbeUhXdfm0Uyln5GOkw9Us1w0V/mhwCkV77Uv_F7HfcxXXrvvfxvjuvarx8CI4lJS-M7NCrObyXv9eFOhAeLAAvel4ttER6g7Ol70Gvli3wpg9yKUP05abYfkS5PJBoGE73O189AsO11dRTBwrypjWOOE_A/.../

Scan photostampremover-setup.exe - Powered by Reason Core Security