bazarloader | qbittorrent_4[.]5[.]4_x64_setup[.]exe

resource	yara_rule
static1/unpack001/qbittorrent.exe	BazarLoaderVar5

resource
qbittorrent_4.5.4_x64_setup.exe
unpack001/$PLUGINSDIR/FindProcDLL.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsisFirewallW.dll
unpack001/qbittorrent.exe
unpack001/uninst.exe
unpack002/$PLUGINSDIR/FindProcDLL.dll
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UAC.dll
unpack002/$PLUGINSDIR/nsisFirewallW.dll

qbittorrent_4.5.4_x64_setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 3ba266ddbe5624aeedec1a23c6bf86d6cfd5b547e8c1a31169f6a08434c9e615
MD5 6e35e4512488a44ebf34bff82dc4724f
SHA1 38903134b1a0a774cdcf728d3484493e7d83592a
SHA512 a6faa23d08c34da39111b9da1d9be62eb9486d010b6217b0aaacaa0cc240bca4e305bdbdaf1f4175f4a4ddb12530ddecc3c488d1620e2ead20b9e90f3cbe6a1e
SSDEEP 786432:rVrG7dnL27saKvlVIbS7ykgixD9ZLstXfL:rVrsdn0sa8IbShgiVXLstXT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/FindProcDLL.dll

IMPHASH 0cd94af3a016a5de4ab9a5a9a02d4173
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsisFirewallW.dll

IMPHASH 18ecfc7436b69f8c13ec22664f9f1857
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

qbittorrent.exe

IMPHASH a40bfbcdcf64f0eb989ef6c078effc57
SHA256 aacf4cc8c1591d4a5aeb1d1c32be0c0211fa593a3a4c5107f906a3910fdb6c34
MD5 299af9fcfb3067e8f5f64f0866c8fe33
SHA1 5244f3c95dbee3c29c4171899a1a158087419f59
SHA512 35598c4d22d29acec1f98fc61cb5e7ca8d3f281bb0ef586c0f1735497fcba4b714f8f5ab2c539cef8b843b35151e0516acd18724c04160c5cddd642cd754ebd2
SSDEEP 393216:RkIcS07+VMtn8jqbXRWspXwqBuoCef5RH/Z8TKJsv6tWKFdu9CeCbF:RkIkSW9XwquopH/ZuIF
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Bazar/Team9 Loader payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

15715776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

qbittorrent.pdb

powrprof

SetSuspendState

wsock32

WSAGetLastError htons htonl WSACleanup bind accept __WSAFDIsSet getpeername ord1141 ord1142 WSAStartup socket WSASetLastError ntohs setsockopt inet_ntoa getsockopt connect getsockname listen select WSAAsyncSelect gethostname ntohl closesocket

ws2_32

WSASend WSASocketW getaddrinfo WSAAccept freeaddrinfo WSAStringToAddressW WSAAddressToStringW WSARecvFrom WSAConnect WSANtohl WSANtohs WSAHtonl getnameinfo WSAIoctl WSARecv WSASendTo

iphlpapi

NotifyUnicastIpAddressChange ConvertInterfaceLuidToGuid ConvertInterfaceIndexToLuid ConvertInterfaceNameToLuidW CancelMibChangeNotify2 GetAdaptersAddresses ConvertInterfaceLuidToNameW ConvertInterfaceLuidToIndex

crypt32

CertGetCertificateContextProperty CertFindCertificateInStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenSystemStoreA CertCloseStore CertOpenStore CertAddCertificateContextToStore CertFreeCertificateChain CertGetCertificateChain CertOpenSystemStoreW CertCreateCertificateContext CertDuplicateCertificateContext

kernel32

WriteFile DeviceIoControl SetEndOfFile FindClose LoadLibraryA GetOverlappedResult SetFilePointerEx CreateEventA CreateWaitableTimerA GetACP CancelIoEx CancelIo GetModuleHandleA GetSystemTimeAsFileTime GlobalMemoryStatusEx SystemTimeToFileTime GetSystemTime GetModuleHandleExW DeleteFiber SwitchToFiber CreateFiber GetStdHandle GetEnvironmentVariableW GetFileType RtlVirtualUnwind QueryPerformanceCounter ConvertFiberToThread ConvertThreadToFiber FreeLibrary SetConsoleMode ReadConsoleA GetConsoleMode ReadConsoleW DisconnectNamedPipe WaitNamedPipeW CreateNamedPipeW ConnectNamedPipe ResetEvent GlobalFree SetHandleInformation AreFileApisANSI TryEnterCriticalSection HeapCreate HeapFree GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA UnlockFileEx GetTempPathW GetFileAttributesW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA OutputDebugStringW FlushViewOfFile CreateFileA WaitForSingleObjectEx DeleteFileA HeapReAlloc GetSystemInfo HeapAlloc HeapCompact HeapDestroy UnlockFile LockFileEx GetFileSize GetProcessHeap CreateFileMappingW MapViewOfFile GetTickCount FlushFileBuffers CompareStringEx GetNativeSystemInfo GetCommandLineW IsProcessorFeaturePresent GetFileSizeEx GetEnvironmentStringsW FreeEnvironmentStringsW DuplicateHandle GetExitCodeProcess GetProcessId GetLocalTime CreateThread SwitchToThread GetThreadPriority ResumeThread QueryPerformanceFrequency GetTickCount64 GetUserDefaultLCID GetCurrencyFormatW GetDateFormatW GetTimeFormatW GetUserPreferredUILanguages RegisterWaitForSingleObject UnregisterWaitEx ReadFileEx PeekNamedPipe WriteFileEx GetModuleFileNameW GetStartupInfoW OpenFileMappingW VirtualQuery TzSpecificLocalTimeToSystemTime GetVolumePathNamesForVolumeNameW GetFileInformationByHandleEx SetFileTime SetErrorMode GetLogicalDrives GetCurrentDirectoryW MoveFileW MoveFileExW FileTimeToSystemTime FindFirstFileExW FindFirstChangeNotificationW FindCloseChangeNotification FindNextChangeNotification GetVolumeNameForVolumeMountPointW GetDiskFreeSpaceExW CompareStringW LCMapStringW CreateSemaphoreW ReleaseSemaphore GetTimeZoneInformation GetUserGeoID GetGeoInfoW VirtualFree VirtualAlloc WriteConsoleW FindFirstFileW ReadFile CopyFileW DeleteFileW GetFileInformationByHandle CreateFileW CreateHardLinkW RemoveDirectoryW GetLocaleInfoEx CreateDirectoryW GetFileAttributesExW CreateIoCompletionPort SleepEx QueueUserAPC TerminateThread SetEvent CreateEventW GetQueuedCompletionStatus InitializeCriticalSectionAndSpinCount SetLastError TlsSetValue SetFileAttributesW SetEnvironmentVariableW GetOEMCP RtlPcToFileHeader RaiseException InitializeSRWLock IsValidCodePage ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnumSystemLocalesW IsValidLocale SetWaitableTimer TlsGetValue PostQueuedCompletionStatus DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection ExitProcess GetUserDefaultLangID lstrcmpW GlobalSize CreateProcessW ExpandEnvironmentStringsW GlobalUnlock GlobalLock GlobalAlloc GetLocaleInfoW CheckRemoteDebuggerPresent OpenProcess WTSGetActiveConsoleSessionId GetModuleHandleW GetCurrentThreadId GetLongPathNameW GetVolumeInformationW GetConsoleWindow LocalAlloc SetThreadExecutionState VerifyVersionInfoW VerSetConditionMask GetSystemDirectoryW GetVolumePathNameW GetDriveTypeW MultiByteToWideChar RtlCaptureStackBackTrace WaitForMultipleObjects Sleep OpenMutexW CreateMutexW WaitForSingleObject ReleaseMutex GetCurrentProcessId WideCharToMultiByte FormatMessageW FormatMessageA LocalFree LoadLibraryW GetProcAddress TlsFree TlsAlloc SetThreadPriority GetCurrentThread GetCurrentProcess GetLastError CloseHandle SetStdHandle GetCommandLineA SystemTimeToTzSpecificLocalTime FreeLibraryAndExitThread InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetExitCodeThread FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx FindNextFileW EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent InitializeSListHead RtlUnwindEx RtlUnwind LoadLibraryExW SetConsoleCtrlHandler GetConsoleOutputCP ExitThread TerminateProcess

user32

GetCursor GetCursorInfo CreateCursor LoadCursorW TrackMouseEvent GetClipboardFormatNameW EnumDisplayDevicesW RegisterClipboardFormatW GetMenuItemInfoW ModifyMenuW GetAsyncKeyState GetMessageExtraInfo GetTouchInputInfo CloseTouchInputHandle GetWindowTextW EnumWindows RealGetWindowClassW ChangeWindowMessageFilterEx GetProcessWindowStation GetUserObjectInformationW PostThreadMessageW KillTimer GetQueueStatus SetTimer RegisterClassW MsgWaitForMultipleObjectsEx TranslateMessage DispatchMessageW UnregisterDeviceNotification RegisterDeviceNotificationW SetCursorPos CreatePopupMenu TrackPopupMenu SetMenu DestroyMenu DrawMenuBar InsertMenuW RemoveMenu AppendMenuW CreateMenu LoadIconW GetKeyState MapVirtualKeyW GetKeyboardState SetMenuItemInfoW PeekMessageW ToUnicode TrackPopupMenuEx IsZoomed ToAscii MonitorFromWindow EnumDisplayMonitors GetMonitorInfoW HideCaret SetCaretPos CreateCaret GetKeyboardLayout IsWindowEnabled DestroyCaret ShowCaret FindWindowA SetClipboardViewer IsHungAppWindow ChangeClipboardChain GetFocus UnregisterClassW ChildWindowFromPointEx RegisterClassExW WindowFromPoint GetClassInfoW GetKeyboardLayoutList UnregisterPowerSettingNotification RegisterPowerSettingNotification GetSysColorBrush LoadImageW GetCursorPos GetWindowLongW GetWindowThreadProcessId DefWindowProcW AdjustWindowRectEx IsTouchWindow PostMessageW MonitorFromPoint GetWindow GetWindowRect GetMenu DestroyWindow IsWindowVisible SetWindowPos SetWindowLongPtrW SetWindowRgn CreateWindowExW ScreenToClient SendMessageW SetWindowTextW GetWindowLongPtrW GetWindowPlacement DestroyCursor ShowWindow GetCapture RegisterTouchWindow ClientToScreen IsChild SetWindowPlacement AttachThreadInput GetForegroundWindow MoveWindow UnregisterTouchWindow SetLayeredWindowAttributes SetFocus GetUpdateRect SetParent SetCapture SetCursor FlashWindowEx GetClientRect UpdateLayeredWindow GetParent ReleaseCapture SetForegroundWindow InvalidateRect GetAncestor IsIconic BeginPaint EndPaint MessageBeep IsWindow GetDoubleClickTime GetCaretBlinkTime GetDesktopWindow UpdateLayeredWindowIndirect GetSystemMetrics GetSysColor EnableMenuItem GetSystemMenu SystemParametersInfoW DrawIconEx GetIconInfo CreateIconIndirect ReleaseDC GetDC MessageBoxW RegisterWindowMessageW DestroyIcon AllowSetForegroundWindow ShutdownBlockReasonDestroy ShutdownBlockReasonCreate CharNextExA SetWindowLongW

gdi32

DeleteDC CreateCompatibleDC GetObjectW CreateDIBSection CreateBitmap ExtTextOutW SetTextAlign SetBkMode SetTextColor GetCharABCWidthsW GetCharABCWidthsI GetCharABCWidthsFloatW GetGlyphOutlineW SetWorldTransform SetGraphicsMode GetTextExtentPoint32W GetOutlineTextMetricsW GetTextFaceW GetStockObject RemoveFontResourceExW AddFontResourceExW GetTextMetricsW RemoveFontMemResourceEx AddFontMemResourceEx EnumFontFamiliesExW GetFontData CreateFontIndirectW GdiFlush GetBitmapBits CreateCompatibleBitmap CreateDCW GetDeviceCaps SetLayout OffsetRgn SelectClipRgn BitBlt CreateRectRgn CombineRgn DeleteObject GetRegionData GetDIBits SelectObject

shell32

SHGetKnownFolderPath Shell_NotifyIconGetRect Shell_NotifyIconW SHCreateItemFromIDList SHGetPathFromIDListW SHGetKnownFolderIDList SHBrowseForFolderW SHGetMalloc SHGetStockIconInfo ord727 SHCreateItemFromParsingName SHGetFileInfoW ShellExecuteW SHOpenFolderAndSelectItems ord190 ord155 SHChangeNotify CommandLineToArgvW

ole32

DoDragDrop OleFlushClipboard CoGetMalloc CoGetApartmentType OleIsCurrentClipboard OleSetClipboard OleInitialize OleUninitialize RevokeDragDrop CoLockObjectExternal RegisterDragDrop CoInitialize CoTaskMemFree StringFromGUID2 CoCreateGuid CoCreateInstance CoInitializeEx ReleaseStgMedium CoUninitialize OleGetClipboard CoGetObjectContext

oleaut32

SafeArrayCreateVector SafeArrayPutElement SysFreeString SysAllocString

advapi32

RegOpenKeyExW RegQueryInfoKeyW RegEnumKeyExW RegCloseKey InitiateSystemShutdownW RegFlushKey RegSetValueExW RegDeleteValueW RegDeleteKeyW RegEnumValueW RegCreateKeyExW GetEffectiveRightsFromAclW AccessCheck MapGenericMask LookupAccountSidW GetNamedSecurityInfoW DuplicateToken BuildTrusteeWithSidW CopySid SystemFunction036 GetSidSubAuthorityCount GetSidSubAuthority RegNotifyChangeKeyValue SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner FreeSid AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid GetTokenInformation InitializeSecurityDescriptor CryptDestroyKey CryptGetUserKey CryptAcquireContextW CryptEnumProvidersW CryptDecrypt CryptExportKey CryptCreateHash CryptSetHashParam CryptDestroyHash CryptSignHashW CryptGetProvParam CryptReleaseContext DeregisterEventSource RegisterEventSourceW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken ReportEventW RegQueryValueExW

mpr

WNetGetUniversalNameW

userenv

GetUserProfileDirectoryW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

netapi32

NetApiBufferFree NetShareEnum

winmm

PlaySoundW timeKillEvent timeSetEvent

imm32

ImmNotifyIME ImmAssociateContextEx ImmSetCandidateWindow ImmGetOpenStatus ImmAssociateContext ImmGetCompositionStringW ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmGetDefaultIMEWnd ImmGetVirtualKey

uxtheme

IsThemeActive GetCurrentThemeName GetThemeBackgroundRegion SetWindowTheme IsAppThemed GetThemeMargins GetThemeInt OpenThemeData GetThemeColor GetThemePartSize GetThemeEnumValue GetThemeTransitionDuration GetThemePropertyOrigin GetThemeBool ord47 CloseThemeData IsThemeBackgroundPartiallyTransparent

dwmapi

DwmIsCompositionEnabled DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW

dbgeng

DebugCreate

bcrypt

BCryptGenRandom

Name

.text

Size

15.6MB

Virtual Size

15.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.2MB

Virtual Size

11.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

594KB

Virtual Size

700KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

590KB

Virtual Size

589KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmetad

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.qtmimed

Size

315KB

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

qbittorrent.pdb

SHA256 ca0ce177fd605715ad13afc59bc2620982b76c92914198208294554e3272014e
MD5 4bbd7819be43dfd0cdc8f32e25235373
SHA1 7ff0a08af8f3849190ad39c75567c9021548468e
SHA512 d3fdbc9a419d2f21b3ca9188e9734ebba5e7a48478dc997d3531fd3de4f8943bc0b5c78f78cedc0c82ee0bdb1deb6ad95fc82aae1730027e46e00638a7b270fa
SSDEEP 393216:NoEAR6NS6wxm7HP+IpxW4/Rtkx4PqqGHEjtXgBzrpNSKeS:NoEARowC5WuPqXkKz
MD5 SHA1 SHA512 SSDEEP

qt.conf

SHA256 fdb8fa58a6ffc14771ca2b1ef6438061a6cba638594d76d9021b91e755d030d3
MD5 af7f56a63958401da8bea1f5e419b2af
SHA1 f66ee8779ca6d570dea22fe34ef8600e5d3c5f38
SHA512 02f70ca7f1291b25402989be74408eb82343ab500e15e4ac22fbc7162eb9230cd7061eaa7e34acf69962b57ed0827f51ceaf0fa63da3154b53469c7b7511d23d
MD5 SHA1 SHA512

translations/qt_gl.qm

SHA256 204a01ac7deb6b5bae193afecbd1e50d18c73bf7d94badeb2bbfdf6123c4ed93
MD5 0661ffabfbc50187f3ba38876b721946
SHA1 eb5e7205355cfc6bcb4df27e224079842c97b296
SHA512 65ab66cc54d65e7678fa731a5c5f2cc9d6fc217b91ad47d538440811e09a23e49cd95ce62a79e3e8c275e250ac1a0b54bd289f6dd067573876da7aff54381d02
SSDEEP 3072:OYSG8zxWSDjq73Pf6FT1f4uh50QGrRfFD54YyUY0Ou4/tnra3Z0uYhB5YHfHRRn2:O39WSD3TMQGrxFD5EUVQ
MD5 SHA1 SHA512 SSDEEP

translations/qt_lt.qm

SHA256 47eb5f97467df769261421d54a5bea1131c9fb9b6388791d38bb6574335b64bf
MD5 8992b652d1499f5d2f12674f3f875a35
SHA1 e22766a49612f79156c550d83c6c230345dda433
SHA512 9b8b6dbff432f2a46c14bc183a6baf84acbf02bf2c5bb8c306c6538fbd9be1c0a9015bd46728f2f652f9163afc56b1e16d16eb95d8f7728f3c562ae9f4f1ae1e
SSDEEP 1536:i5v3+zmayloj6yJjhnBAbnrKnGrhA7WgdXclIsooY9i:SvOzAloj6yJ9BA7riGr+7WKXc+s5ui
MD5 SHA1 SHA512 SSDEEP

translations/qt_pt_PT.qm

SHA256 2c1e7bbf5168a64b43752dd4c547601c0bde6d610f8671fa3e3af38597e84783
MD5 6656500f7a28ef820ae9f97fd47fb5bb
SHA1 cc112b9c9513bcf7497f3417168b4c8a9f7640a9
SHA512 5c3cbfcf86af6b4d949c1d914cd379e512e73ba350af661033a386ee7fb981fbfcb43d9a35fde7656e17bb09f64f1469f84867a780573c3359d645269461d5a6
SSDEEP 768:OKGUuWW+WHjS0gMBd483+Y7bDPs4RHBloLUIltlzAJnx4nnliM1OPlOibLG:JGUuWPuSgm0Jn+n4Mhj
MD5 SHA1 SHA512 SSDEEP

translations/qt_sl.qm

SHA256 c44e0313a9414cc0e490b65b0c036fa11bca959353b228886547bc2c8492034f
MD5 d35a0fe35476be8bd149cee46e42b5e9
SHA1 9f3c85c115a283e5230d1eead84c8cb73a71fa03
SHA512 beeb1751882af081e80be93f7464d4c6322b724efa2cbd3e1cbe709181d380c1c57e770fa962bb706d6fcf4a8cb393e3f6e187c1f604f8ceefb201ca3200bd1c
SSDEEP 3072:9zQH0hOtgmiAZu0eeAEv+v49JnnSmICgr3n7jhCQUeinqyU5UggtRLGrQ2LZO+Y1:RpUsSpGr36wsR
MD5 SHA1 SHA512 SSDEEP

translations/qt_sv.qm

SHA256 4b4b6ff7fd237c9da0301b4946132e68653d15eb5faf38e4c5fbfebb12dd97f7
MD5 0e85e0e0e7ddfe3d4bde302f27047f9c
SHA1 ae59348e0c2e4f86f99da6cf5dab3b7e92504b7c
SHA512 8caab6c61e9fa26a3a289a9e4dc515d157b3092d6d4ed43861220261bd2b7cc79b35b52f9ade4ef558b5385b37eac14575420dd55c475f435bb95b6c1e2561b6
SSDEEP 1536:4u6DkpgyKmRmG15mGM6iFPi6Q/qTlOQZY2dKN8gKw:4u6DotUG1sGMZPi6Q/qTlO2Y2YKw
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_ar.qm

SHA256 e03fe68d83201543698fd7fe267dd5dfc5bfd195147e74ff2f19ac3491401263
MD5 a7e4d0ba0fc5df07f62cc66ec9878979
SHA1 21fd131b23bdd1bba7bbb86f3ed5c83876f45638
SHA512 d9e6b10506fcf20b5b783f011908083d9df6c5df88e21b10d07f53a01ad6506a4b921c85335a25bae54e27bad7d01b6e240d58fdeeaabc7ff32014ec120c2ecf
SSDEEP 1536:XGlAMfkX1M0RdaCkR8lfv8vtc8EFrVYA2I4AJZWEWgHg1C8COvzHKHC6Jp9NV0V7:XUr0RACkIwDEpV1Lgf1ubtw3Bb
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_bg.qm

SHA256 e448ac9e3f16c29eb27af3012efe21052daa78fabfb34cd6dff2f69ee3bd3cdb
MD5 660413ad666a6b31a1acf8f216781d6e
SHA1 654409cdf3f551555957d3dbcf8d6a0d8f03a6c5
SHA512 c6ae4b784c3d302d7ec6b9ce7b27ddaf00713adf233f1246cd0475697a59c84d6a86baa1005283b1f89fcc0835fd131e5cf07b3534b66a0a0aa6ac6356006b8f
SSDEEP 1536:9ULiyUxPoT6qx+J7FJlaaMJnxjqxq+0Uiff0mbVeb7wiEwYuYqDKBkKHMXHCIMll:9ULpIVFnpwUiEujw27ncUQUz
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_ca.qm

SHA256 e4e2a6784354f16f840b490a01256129ed567895fe4b302768ed4534d244bfdb
MD5 4f2946dc0c73a6012c3d9e0a4484bb38
SHA1 8a4d508f1fad38f7d8288476f17abc7c11f075e7
SHA512 a343d44c209d6c3728aa9580d6298351f489c7b84ca72d8dd776dd3179992263636adff54fffcc36cdfe319a5a2125607a4f7e23f15f45b3dee3b4153d4759d9
SSDEEP 3072:zFmRU0rldbafzvZfeW+61XEV/SLPzC3cehdP2:8xKf7UW+VjjP2
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_cs.qm

SHA256 03028b42df5479270371e4c3bdc7df2f56cbbe6dda956a2864ac6f6415861fe8
MD5 c57d0de9d8458a5beb2114e47b0fde47
SHA1 3a0e777539c51bb65ee76b8e1d8dce4386cbc886
SHA512 f7970c132064407752c3d42705376fe04facafd2cfe1021e615182555f7ba82e7970edf5d14359f9d5ca69d4d570aa9ddc46d48ce787cff13d305341a3e4af79
SSDEEP 3072:5WjuhX0CVRaakGjW9E8SSOQfX/JlwVOMxrboRPqWxXfQvO7zjBf:5iFGj1QfXr8Gd
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_da.qm

SHA256 7d1e5ca3310b54d104c19bf2abd402b38e584e87039a70e153c4a9af74b25c22
MD5 859ce522a233af31ed8d32822da7755b
SHA1 70b19b2a6914da7d629f577f8987553713cd5d3f
SHA512 f9faa5a19c2fd99ccd03151b7be5dda613e9c69678c028cdf678adb176c23c7de9eb846cf915bc3cc67abd5d62d9cd483a5f47a57d5e6bb2f2053563d62e1ef5
SSDEEP 3072:XzswP2UvZ5aZ9jFTkmq/gnBNW/+PcWrqm2Vliz0DGdaS4KSLZjwTTgwUR0toT:j3m27AjCT
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_de.qm

SHA256 553c046835db9adef15954fa9a576625366ba8bfd16637038c4bcd28e5ebace1
MD5 40760a3456c9c8abe6ea90336af5da01
SHA1 b249aa1cbf8c2636ce57eb4932d53492e4ce36ac
SHA512 068e55f39b5250cc937e4b2bd627873132d201d351b9351be703cd9b95d3bafb4bd649cb4df120a976d7c156da679758d952cac5e0523107244e517d323bc0c5
SSDEEP 3072:7w8go8+ph6JVB8XVXYWpSNEeg8+vaD+p4N8DDiEKugwGZulh15ce4M+4NsPYXCZW:88h8Sj286tTiDD
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_es.qm

SHA256 4ffda56ba3bb5414ab0482d1dde64a6f226e3488f6b7f3f11a150e01f53fa4c8
MD5 c7c58a6d683797bfdd3ef676a37e2a40
SHA1 809e580cdbf2ffda10c77f8be9bac081978c102b
SHA512 c5aed1a1aa13b8e794c83739b7fddeafd96785655c287993469f39607c8b9b0d2d8d222ecd1c13cf8445e623b195192f64de373a8fb6fe43743baf50e153cda5
SSDEEP 1536:JVwzuvb+Ta64KQd84arHX5pxiVhA8QlOD/BnFNa8NsvsfFsfcoZtIx6F:JVwSTG4KqVaLX5pEVK7OJFczstgRtIx8
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_fa.qm

SHA256 f78e59b5bdd586181a999034ba418868ed17fe9c05707fb65e523f70e92253d2
MD5 b4222dd74c92c888a7c25dc42e989d83
SHA1 b0adbe950790924242806f671712c57b584b58fb
SHA512 e7f048a7dab56ffd6c0f316962684c01c86c3c7c1d516d71b6a23ed0fc00a04ba5dda919321697eb81290acbb9984de97bae0170f54c5880873741fcd23e68a0
SSDEEP 1536:p0hbtxBPlwdOgOP6RT9MnrtrnfpSglHPPkzF0BGF8APbyuQQdJFK:ehZxXLgK6RGnrtNVlHPcp9hOurdLK
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_fi.qm

SHA256 e47fe13713e184d07fa4495dde0c589b0e8f562e91574a3558a9363443a4fa72
MD5 8472cf0bf6c659177ad45aa9e3a3247c
SHA1 7b5313cda126bb7863001499fb66fb1b56c255fc
SHA512 de36a1f033bd7a4d6475681edc93cc7b0b5dcb6a7051831f2ee6f397c971b843e1c10b66c4fb2eff2a23dc07433e80fbf7b95e62c5b93e121ab5ad88354d9cb8
SSDEEP 3072:lvdTgO2Yl97ZWnbgTLt/Tf9IlqAeiy5uWkYGM0wNCdRjSK2YUlUs:lvdkA9vh5uWkY0MK2YXs
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_fr.qm

SHA256 edb32a933cef376a2636634e14e2977ced6284e4aa9a4ac7e2292f9ca54c384a
MD5 1f41ff5d3a781908a481c07b35998729
SHA1 ecf3b3156ffe14569ecdf805cf3be12f29681261
SHA512 a492e8ac88095a38a13549c18c68e1f61c7054ab9362c2b04c65b93e48e4a07941c8da6950bae79041094623e0ed330ca975110fde8248b4d9380b9f729ad891
SSDEEP 1536:CLZ1w8McowCppcPwL5pYFw+G00QsbLckCiWxvq+sjs06oFm:C91wxcowspc4L5pUw+cz39CiQ7tloFm
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_gd.qm

SHA256 63b439dd44139aa3aed54c2ebe03fa9bc77f22c14ed8fba8eff2608445bb233d
MD5 eb1fb93b0be51c2ad78fc7ba2f8b9f42
SHA1 24f7ff809e2f11c579cd388fea5a4c552ff8d4d0
SHA512 e13770aef33b6666ed7d54e03ee20ca291d4167d673ba6c61d8e64cdd5f7ffe0a9521b95af67be719bf263932ecf16e2b2d0b5f3404f9bcd7879114fcc6fc474
SSDEEP 1536:SiaI3C87jhakhR0VGkw7ys7CskUH6y4e6IFB4xyMuhvDnJGhFaCo527arBbm07LZ:S2yGjh17yGqxTXhvQoejJd8FUjVgk
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_he.qm

SHA256 e1ebca16afe8994356f81ca007fbdb9ddf865842010fe908923d873b687cad3f
MD5 deaf87d45ee87794ab2dc821f250a87a
SHA1 db39c6baa443aa9bb208043ef7fb7e3403c12d90
SHA512 276fce81249effe19e95607c39f9acb3a4afa3f90745da21b737a03fea956b079bca958039978223fd03f75ac270ec16e46095d0c6dda327366c948ec2d05b9c
SSDEEP 3072:XSue8Z7T3iJsqBejt/zNHSLzdetY2ZISfC/S:XSueK3w7Ijt8zUtYAISfC/S
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_hr.qm

SHA256 bb9eec9a9a652c1340dc75eb2e749be50df00f885b3d6900dfc76799c45b244d
MD5 8799d8cc6739637c9859e981db122a6e
SHA1 c95a416388521ef5bdb3ee5d11e9dcd4ce22ebbd
SHA512 332d2ee630c5bbaa28bd49307f3d36fcac0d025c7ce3ae33e7179cd7e030efee04c569c1fa9fa8e339404ef63d45d57fb425615e5d7bb6d0c7b1e40c6b4bf264
SSDEEP 3072:c5s0kXuz8fKXjSE/21DZVRtaKSfReeo4McCn/Xw9sufWB4Elq7Flcfrc+R:6+oC/fq8R
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_hu.qm

SHA256 c61b67bb9d1e84f0ab0792b6518fe055414a68e44d0c7bc7c862773800fa8299
MD5 e9d302a698b9272bda41d6de1d8313fb
SHA1 bbf35c04177cf290b43f7d2533be44a15d929d02
SHA512 12947b306874cf93aba64bb46fac48179c2d055e770d41af32e50fffb9f0c092f583afcea8b53fe9e238ef9370e9fffbeb581270dfa1a7cb74ebe54d9bff459f
SSDEEP 3072:BmOMZadV9n51xXeQvjOiIzz7/Vs9Db3ihuJNvMfWxBNlYzYbTrIkfwb03l24cNKu:HkWa5pg0MahBHDd
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_it.qm

SHA256 7808ed542a7833c4bd94ec8bdfbbca00bb4f2fe15979b9121ce3249323687300
MD5 19dbf4aad2cce123cdc9ecf5f12ab4a1
SHA1 98ad7a889db2059d3079b0335f9bf18de81f035e
SHA512 8c4b63a515c80283a20ac2a992b565ec5ac6666fa307075216a90cab47f9823f611279c6543d69902c385a1447e37280fbe0ec8cab97a1403f5b51ba8441c015
SSDEEP 1536:E/FKffdO4BKJb0td5pqCOIUPdPFIM7gxGQ9sRrFM6QJ4m8ihkM:E/F8FO4BKJb0td5pnOr1Cqg9mRK4IkM
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_ja.qm

SHA256 cba382acc44d3680d400f2c625de93d0c4bd72a90102769edfd1fe91cb9b617b
MD5 608b80932119d86503cddcb1ca7f98ba
SHA1 7f440399aba23120f40f6f4fcae966d621a1cc67
SHA512 424618011a7c06748aadfc2295109d2d916289c81b01c669da4991499b207b781604a03259c546739a3a6cf2f8f6dfa753b23406b2e2812f5407aee343b5cbdd
SSDEEP 1536:W8YYSCjKBJ26c1Z7f25pVmuLXpxfqt7FEUWNrfQje9kWI23pKXvx:xYuKBJ01Z7u5pQuLbESUWNzAAI23pKfx
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_ko.qm

SHA256 0179ed1b136e1cb3f583351eaa2c545ba3d83a6ee3f82c32505926a1a5f5f183
MD5 082e361cbac2e3a0849f87b76ef6e121
SHA1 f10e882762dcd2e60041bdd6cc57598fc3df4343
SHA512 f378a42116924e30fa0b8fff1d3c3cb185dc35b2746dce2818be7c2aa95c5de103df44aac74da969c36c557f1d4de42ac7647ec41066247f8ad2697bded667ea
SSDEEP 1536:rvTy18hhPekHs1iNXVExWbStnn8TExgkYOvYejZOvXx4Mmf0MwUL8smk/pDZyy:y18hJ61nMStnn8TOgknQRLWZmkxNyy
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_lv.qm

SHA256 846e047573ae40c83671c3ba7f73e27efc24b98c82701da0df9973e574178bb2
MD5 bd8bdc7bbdb7a80c56dcb61b1108961d
SHA1 9538c4d8bb9a95c0d9dc57c7708a99dd53a32d1f
SHA512 f040ec410ebfea21145f944e71adcae8e5f60907d1d3716a937a9a59a48f70c6b7eaac91c2c554f59357a7bc820cdbd17c73a4decc20b51f68eb79edd35c5554
SSDEEP 3072:y5pmbKIhooMbGe91MrjOhmGzP6LJbWz5XIxELpU6:yObeqrjPGzeJyJLy6
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_nl.qm

SHA256 f61513bcdbb6ad800585f9437a95d018aab17fa12ee414aa31462ff279d8240e
MD5 5034443529b94a017f63aadcf4be76a3
SHA1 5cce892cd7ed9243b0b57923ee92c79ad626153b
SHA512 7085718a81418ce18c8bea2c1a8f5f75f55f4c001bfec1f04abb73be1d37ef1069490ee9c99610dda7597c170135a17dd58290082225558101ccebd148261079
SSDEEP 3072:qufM3bk4pXtXJB/Pz9DLjlrIQatXqRIqv5C5PwhgwIbUrwiCqT0voFN:TE3ljncQl35N
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_nn.qm

SHA256 983734b40aa4d250421ba0d1614416cb8b424d6f140f4a7dbf8b11e65eef63dc
MD5 6dac3cad287cd86a5b047c3651f05be0
SHA1 69fc47ff3a33adc23415f4f87272053998d6149a
SHA512 2d8308a0e1b0405a2a16d2c28c0187d510bc249c7716f14cec2b1f8695232036ae0cd2684620e178f345c9b3b2ec82ad45927ad68edabb41409e0ec6eb38abb2
SSDEEP 3072:ocFM5fgnggr7pNt4uiQjYc/giREtCSAKl8DzMm81MviqEcMIJ:9MZHY+eYc1nisJ
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_pl.qm

SHA256 ce99032a3b0bf8abad758895cc22837088ead99fd2d2514e2d180693081cfe57
MD5 f9475a909a0baf4b6b7a1937d58293c3
SHA1 76b97225a11dd1f77cac6ef144812f91bd8734bd
SHA512 8a4f1b802b6b81ff25c44251fb4a880e93e9a5fe25e36825a24bfe0efb34e764e7e1ee585d3a56554964b7921e7813c67f12d200d6e0c5eaf4bb76b064b5c890
SSDEEP 1536:sXpestp/YIFtDT8FIWYbIJmPYuIpnmxAk6mwyJNqSm9+P:sxpTDT8FIWfJmdCmxApmbnqSm9+P
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_pt_BR.qm

SHA256 8344f5bc333c45d37cfd425a09124eb11f12439f33737ec0b8683d04a416746e
MD5 c9d3d4f3a7bd0b50fd7256a360026756
SHA1 fd1373417c7e93d63c97b3be7956cd7dd80cebe9
SHA512 294301aef9d8b1cc14dc442cc59f5e9004007ad0f2558d97c83bcab0bbac7fb40768b24fb3b2f8f75f58fc02a28447d94f9d1f2c29f4c5664a36cddf0a27c4c8
SSDEEP 3072:3xbdpdlyy2nnN0wu3oV+4qftiDfEY3kHwlH:hbdpKNsoVhP4qH
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_ru.qm

SHA256 3da6605668f9178d11a838c4515478084dcfb4f9cf22f99d7a92b492db9c224b
MD5 5096ad2743bf89a334fba6a2964300d4
SHA1 405f45361a537c7923c240d51b0ff1c46621c203
SHA512 7b88b501792b5831426baa669138192ed94cc3f8323a3df9d5287655dc4d877706908c517ab7523ae8a283bf50b47123f13b8ae40ea2f3081c3459edc47fc8dd
SSDEEP 1536:hn4dEJ63pdhPpy6gu5fs4MHQv6sLlxnrncF423ZL9xyuXwdcX8LZuf76CW+WeXFx:aN3pdV5fZbpItXsttRY+WSq
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_sk.qm

SHA256 d586ae2c314074cf398417fdecb40709d5478dfeb0a67c2fe60d509ee9b59ed7
MD5 3d60e50dcbcbd70ee699bc9b1524fcb9
SHA1 0211b4911b5b74cc1a46c0fca87d3bf5632aa44a
SHA512 f98211867f1dbcb8a342c00e23fa5718be6e999f7449cb8470b41bf0f527c7f78cc4d6666e28968f32e96026907156753979bfada7e6bf4225d02a902d24906d
SSDEEP 3072:roXDuC1u/2lUBGjJirE5tsd/aev1GIfOdvhw:OucMGjH5tbm
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_tr.qm

SHA256 6a0bf6e70e7920c2b193e76e92f78f315936955d3b06ac039d917f2e06c43281
MD5 6cbc5d8e1eabec96c281065ecc51e35e
SHA1 4e1e6ba3772428227cb033747006b4887e5d9ad1
SHA512 ce1f9ee180176153d5f523d71e0db06f4dea65c24e5e2cd56341cfaee349a8e9a0f606d99f7219a35dd4516d1528c90aea4bb87548a55392b8f2b36164d478b1
SSDEEP 3072:yRRhAFCvqDBitD/iDG9AOH+l4TcwZBPqHo9fd9CFRK+2IKAimxsjucV2p0ZqvRu7:yRRHs5mksWVX3lA3
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_uk.qm

SHA256 51b8ff55b37dc5907d637a8ddda12fbe816852b0244c74eb4f0fb84867a786e0
MD5 d6234e4e21021102b021744d5fa22346
SHA1 63a14327d0cf0941d6d6b58bfa7e8b10337f557b
SHA512 37d24a092c5f29bacb7a4ca8207c4eefd0f073b7e74a492402867f758084091bf1d79d2ba2b4a28b35fef42e8023c371fde97578f74bb2033551154e77102de6
SSDEEP 1536:jXwjFVUDdMUD4TzdAhpQgO5poZHvJllEnhmdK4I77/dnPJX/imfb1jhvv3BxT8ue:jBzD4Tzaw5pCvJ8hVPdlvj3p8
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_zh_CN.qm

SHA256 98fd4b97dbec8af5cdd15f85a16c33efc77301b1aeb0469daafc04b9ab2f3570
MD5 4c8a57b5405b7cfea0a5a98362dd3b2d
SHA1 3561f95f646b2172d2e870973b6d81e983ed00a6
SHA512 8bf1c1e01a10f356ab775cc96ead12f6981349ebfacb9f5f1a2337058b4745faad4361f054884ec3cdaa005ad3a4a85920ba47b16b73851200bc604d4311e3b1
SSDEEP 1536:axTFoXJaVZyqPtoMaOBlmxTRnYtKi0mqElZ1djWIWTcc8Z:axi6yqPe/OBlyTRYYvmbxbc8Z
MD5 SHA1 SHA512 SSDEEP

translations/qtbase_zh_TW.qm

SHA256 21012b2b427f8d09d31ce9cae582ca27955b478ca3dc2ec18a3068d808638c6a
MD5 ca0a16eb14d6c36a0ea90a4d4ca3832e
SHA1 62f789e8fa0c13c5fd4fe250576bf45b07c85781
SHA512 94094ef2fe663d752311777660730bdd3c44627b816aa973424b780e90efdae5ed49d3a1e2df6c513f1810f69876906c147772ce9c986b326ff65fef6c148700
SSDEEP 3072:59WqMP10JBOs6ZcFOsJoYqaWFzerP5P8pa:3wAYs6uFOEor/x28pa
MD5 SHA1 SHA512 SSDEEP

uninst.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 09d1cc6f80cfa7d019365ca50de6dc78adcae147ebf061ae381e0304c3891f13
MD5 91069149dbc3b622415e8526caaed735
SHA1 8487fb850aabff16ab683b707cbcce4c69220d99
SHA512 c7cb0efe1256d4888d183740419f0f849fb8634ef1892791ac2bd25ad5b021e1ed3efeaad5616940926c4221d8312d781318e1e6addd6f1092b593ab42716f4f
SSDEEP 3072:gfY/TU9fE9PEturceAmpgcfpGmhStrEr04oDmcWEF5lWinUM:2Ya6lmmpR1dr04oDmIr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/FindProcDLL.dll

IMPHASH 0cd94af3a016a5de4ab9a5a9a02d4173
SHA256 c0948b2ec36a69f82c08935fac4b212238b6792694f009b93b4bdb478c4f26e3
MD5 b4faf654de4284a89eaf7d073e4e1e63
SHA1 8efcfd1ca648e942cbffd27af429784b7fcf514b
SHA512 eef31e332be859cf2a64c928bf3b96442f36fe51f1a372c5628264a0d4b2fc7b3e670323c8fb5ffa72db995b8924da2555198e7de7b4f549d9e0f9e6dbb6b388
MD5 SHA1 SHA512

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

%!f(<nil>)

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/modern-header.bmp

SHA256 766a893fe962aefd27c574cb05f25cf895d3fc70a00db5a6fa73d573f571aefc
MD5 940c56737bf9bb69ce7a31c623d4e87a
SHA1 f2f3b4e7b9c28df6687ceeaed300a793e3bac445
SHA512 81c60431619d7eb826b8da997c227c4f7077cc754caa15df6e0e7ae0e33690432bc2a27a7e295998f15e33a17b3d80e492d7cc09fd70dc43daf1cfe86b8746ff
SSDEEP 192:TYw3C/LSnMoejFXnknIHbGoijTr3dBZ9KPPsnY/T0x9j:TY3LSnlepnknIHKoUrdBZ9uPsY/Ix9j
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsisFirewallW.dll

IMPHASH 18ecfc7436b69f8c13ec22664f9f1857
SHA256 53be5716ad80945cb99681d5dbda60492f5dfb206fbfdb776b769b3eeb18d2c2
MD5 f5bf81a102de52a4add21b8a367e54e0
SHA1 cf1e76ffe4a3ecd4dad453112afd33624f16751c
SHA512 6e280a75f706474ad31b2ce770fa34f54cb598528fac4477c466200a608b79c0f9b84011545595d9ba94331ad08e2f51bd42de91f92379db27686a28ba351256
SSDEEP 96:8SMPv+eLDUDp+weLv2lstU+0IgNB2Aa20kdArfOwJKbFrMiRsuHdRYL:wnxLDUwp6sgN2RDrzJMMmsuYL
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6903

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

qbittorrent_4.5.4_x64_setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/FindProcDLL.dll

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/UAC.dll

kernel32

user32

shell32

advapi32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsisFirewallW.dll

kernel32

user32

ole32

oleaut32

msvcrt

generic

qbittorrent.exe

powrprof

wsock32

ws2_32

iphlpapi

crypt32

kernel32

user32

gdi32

shell32

ole32

oleaut32

advapi32

mpr

userenv

version

netapi32

winmm

imm32

uxtheme

dwmapi

wtsapi32

dbgeng

bcrypt

generic

qbittorrent.pdb

qt.conf

translations/qt_gl.qm

translations/qt_lt.qm