windows-clashverge[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
windows-clashverge.exe
Size 44.9MB
Sample260718-pfjs8sbs5k
SHA256 203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51
MD5 726b4114172d3af73e6deb52d52873f9
SHA1 e8837f2c223ebfe4c9703fc0b080cfb9ee5a364a
SHA512 841577795207788629050ae3813122e8a6d882cce0aae56d0e213009d26fa1e1bc5326ba01c5595ccf8d4bfa2d967a75cbda390620f133ac91dae928a33252fe
SSDEEP 786432:BLR8F6BvAHI0ooazvRsF0wx6C2/NF6HGZRXYhl5+szEYmdY6yf/dq7f4kfVz2lUB:BLSF6WHVnazvR9LC2/NumYhl5ArYzddk
TLSH
T1A8A733EAA32C5418DAD1183319EC4C98D1C2DD05BAD551AED3AC3A147E0C89E4EBDEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 15 IoCs

Checks for missing Authenticode signature.

resource
windows-clashverge.exe
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/SimpleSC.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/clash-verge.exe
unpack001/resources/clash-verge-service-install.exe
unpack001/resources/clash-verge-service-uninstall.exe
unpack001/resources/clash-verge-service.exe
unpack001/verge-mihomo-alpha.exe
unpack001/verge-mihomo.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/resources/enableLoopback.exe

File Explorer

windows-clashverge.exe

.exe 44.9MB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/SimpleSC.dll

.dll 1.1MB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
$TEMP/MicrosoftEdgeWebview2Setup.exe

.exe 1.6MB
clash-verge.exe

.exe 47.2MB
resources/Country.mmdb

8.1MB
resources/clash-verge-service-install.exe

.exe 171KB
resources/clash-verge-service-uninstall.exe

.exe 152KB
resources/clash-verge-service.exe

.exe 1.7MB
resources/enableLoopback.exe

.exe 82KB
resources/geoip.dat

18.3MB
resources/geosite.dat

4.0MB
verge-mihomo-alpha.exe

.exe 44.1MB
verge-mihomo.exe

.exe 44.0MB

windows-clashverge.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 203bf29f7a5f0dc5fbc5e42772de6a474501603a19120c2f1259bb27c067df51
MD5 726b4114172d3af73e6deb52d52873f9
SHA1 e8837f2c223ebfe4c9703fc0b080cfb9ee5a364a
SHA512 841577795207788629050ae3813122e8a6d882cce0aae56d0e213009d26fa1e1bc5326ba01c5595ccf8d4bfa2d967a75cbda390620f133ac91dae928a33252fe
SSDEEP 786432:BLR8F6BvAHI0ooazvRsF0wx6C2/NF6HGZRXYhl5+szEYmdY6yf/dq7f4kfVz2lUB:BLSF6WHVnazvR9LC2/NumYhl5ArYzddk
TLSH
T1A8A733EAA32C5418DAD1183319EC4C98D1C2DD05BAD551AED3AC3A147E0C89E4EBDEF7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
MD5 4b8a750993567ac9a350ba9768fabfa0
SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
TLSH
T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/SimpleSC.dll

IMPHASH a9546246ff97b887a4072a24f9106617
SHA256 1620cdf739f459d1d83411f93648f29dcf947a910cc761e85ac79a69639d127d
MD5 7b89329c6d8693fb2f6a4330100490a0
SHA1 851b605cdc1c390c4244db56659b6b9aa8abd22c
SHA512 ac07972987ee610a677ea049a8ec521a720f7352d8b93411a95fd4b35ec29bfd1d6ccf55b48f32cc84c3dceef05855f723a88708eb4cf23caec77e7f6596786a
SSDEEP 12288:fRdJsAp4dXFcLBz75cwoCmJKHwe6VuoH9v0D/LF5mM6:fBsmyVS151oCmJKE1dv0DX
TLSH
T12F354B2BF645693EC5AF063E4673E714993BBB726912CC1F56F0084CCE2A5406B3EA47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

989260

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

kernel32

EnterCriticalSection SetFilePointer GetACP CloseHandle LocalFree SuspendThread VirtualProtect TlsAlloc GetTickCount IsDebuggerPresent GetFullPathNameW VirtualFree HeapAlloc GetStartupInfoW ExitProcess GetFileAttributesW InitializeCriticalSection GetCPInfoExW GetThreadPriority GetCurrentProcess SetThreadPriority VirtualAlloc RtlUnwind GetCPInfo GetCommandLineW GetSystemInfo ResumeThread GetProcAddress LeaveCriticalSection EnumSystemLocalesW GetStdHandle GetVersionExW VerifyVersionInfoW GetModuleHandleW FreeLibrary HeapCreate HeapDestroy ReadFile GetDiskFreeSpaceW VerSetConditionMask GetUserDefaultUILanguage FindFirstFileW TlsFree HeapSize lstrcpynW SetLastError GetModuleFileNameW GetLastError GlobalAlloc lstrlenW SetEndOfFile CompareStringW CreateThread HeapFree WideCharToMultiByte MultiByteToWideChar FindClose LoadLibraryA ResetEvent SetEvent CreateFileW GetLocaleInfoW GetVersion RaiseException FormatMessageW SwitchToThread GetExitCodeThread GetLocalTime WaitForSingleObject GetCurrentThread WriteFile ExitThread DeleteCriticalSection GetDateFormatW TlsGetValue IsValidLocale TlsSetValue LoadLibraryExW GetSystemDefaultUILanguage EnumCalendarInfoW LocalAlloc GetCurrentThreadId UnhandledExceptionFilter VirtualQuery CreateEventW GlobalFree VirtualQueryEx GetThreadLocale Sleep SetThreadLocale

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

user32

CharUpperBuffW CharNextW MsgWaitForMultipleObjects FindWindowExW CharLowerBuffW LoadStringW CharUpperW PeekMessageW GetSystemMetrics MessageBoxW

oleaut32

SysAllocStringLen SafeArrayPtrOfIndex VariantCopy SafeArrayGetLBound SafeArrayGetUBound VariantInit VariantClear SysFreeString SysReAllocStringLen VariantChangeType SafeArrayCreate

netapi32

NetWkstaGetInfo NetApiBufferFree

advapi32

CloseServiceHandle ControlService CreateServiceW LookupAccountNameW DeleteService LsaAddAccountRights StartServiceW UnlockServiceDatabase GetServiceKeyNameW GetServiceDisplayNameW ChangeServiceConfigW LsaClose LockServiceDatabase OpenServiceW ChangeServiceConfig2W EnumDependentServicesW QueryServiceConfig2W LsaRemoveAccountRights QueryServiceStatus AdjustTokenPrivileges QueryServiceConfigW LookupPrivilegeValueW OpenSCManagerW LsaOpenPolicy OpenProcessToken RegOpenKeyExW RegQueryValueExW RegCloseKey

Name

.text

Size

956KB

Virtual Size

956KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.itext

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didata

Size

512B

Virtual Size

490B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

69B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

90KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 cb9b76a6dace90f5d4635f2d49cbb55a62f41e5e365a22cef4265c013af0bcdd
MD5 7d771a8de0076f9fc5169cf1ba088586
SHA1 180865c9fb67008f5f1900350be6bfd10c4ac0a1
SHA512 1143ac711e8589b7918091306b99ce70f534b0b6aa8c820dfb080f1d567969cdff2948a46adf3de36efdfd96715f214469c2c678eb6ffa494a970c0a14b7c472
SSDEEP 49152:X0iGA3AiBEIBB/4lR9Sk2qzV3dJnRoj8:Eix/7/4PzV3dlA8
TLSH
T14275222476D48031E5F3293159F4CAB25F7AFDB24A72598F13520E2D2E35AE2E235363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

78:7b:a2:60:a6:f5:3d:ab:99:c2:5e:4c:be:cb:03:a8:23:db:5f:05:d0:cc:f6:95:5b:48:fd:b4:ee:5e:6b:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Jul 17, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

78:7b:a2:60:a6:f5:3d:ab:99:c2:5e:4c:be:cb:03:a8:23:db:5f:05:d0:cc:f6:95:5b:48:fd:b4:ee:5e:6b:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 25, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

Major OS version

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

clash-verge.exe

IMPHASH 18134b12a0f762584da09f152cfe4b20
SHA256 e7d5b91b76f502f02255aac89dbd79fa7e51f7ede867749f2c63861b2d811a28
MD5 7a3bacf6d70bc135babe20fce9b910f0
SHA1 62e535cd55dd3364b4f3d25af8d42a535e50968e
SHA512 598acff9605798cb92811e7e8db8b3abdc57952071e636f6d571db3a5187bcd81a5d56480e65c38cce53a615c5f3dd3662e6b43e5839152c867d1ca5793e9576
SSDEEP 393216:wkBqbPr4cntu7f2a0vKafnIcN/jhwmD5scnJfnREVl7Tw:wkByPr4cnI7+aWKVi/jHDNJulHw
TLSH
T14AB716157A5FA96EC45AC8B0824A4A735E2134DB0A36B9BF44C442353F7EBF42B3D748
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

33006224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clash_verge.pdb

kernel32

GetModuleHandleW FreeLibrary GetProcAddress GetUserPreferredUILanguages FindNextFileW CancelIo RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForMultipleObjects TerminateProcess WriteFileEx SleepEx ReadFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal DuplicateHandle GetFileAttributesW CreateThread GetTimeZoneInformationForYear CreateWaitableTimerExW CreateEventW ExitProcess GetTempPathW GetFullPathNameW SetHandleInformation DeviceIoControl FindFirstFileExW GetFinalPathNameByHandleW DeleteFileW GetFileInformationByHandle GetFileInformationByHandleEx CreateSymbolicLinkW CreateDirectoryW SetFileInformationByHandle MoveFileExW CopyFileExW SetLastError SetThreadStackGuarantee AddVectoredExceptionHandler ReleaseMutex CreateMutexA WaitForSingleObjectEx GetProcessId SystemTimeToFileTime SystemTimeToTzSpecificLocalTime SetWaitableTimer SetFileCompletionNotificationModes CreateIoCompletionPort GetQueuedCompletionStatusEx GetOverlappedResult FlushFileBuffers UnhandledExceptionFilter GetComputerNameExW FormatMessageW QueryPerformanceFrequency GetExitCodeProcess GetFileType CancelIoEx ReadFile WriteFile Sleep WideCharToMultiByte GlobalSize GetSystemInfo GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetCurrentThread TlsFree SetUnhandledExceptionFilter MultiByteToWideChar GetACP GetOEMCP IsProcessorFeaturePresent WakeAllConditionVariable GetCurrentProcessId SleepConditionVariableSRW LoadLibraryA PostQueuedCompletionStatus GetSystemTimeAsFileTime FindClose GetCurrentProcess SetFilePointerEx InitializeSListHead IsDebuggerPresent RtlUnwindEx RtlPcToFileHeader lstrlenW RaiseException SetConsoleCtrlHandler GetConsoleOutputCP WaitForSingleObject EncodePointer LCIDToLocaleName GetUserDefaultUILanguage GetCurrentThreadId DeleteCriticalSection CreateFileW GetSystemTimePreciseAsFileTime GetLastError QueryPerformanceCounter SwitchToThread LoadLibraryW CreatePipe HeapReAlloc GetConsoleMode WriteConsoleW GetStdHandle GetModuleHandleA GetModuleFileNameW SetConsoleMode WaitNamedPipeW InitializeCriticalSectionAndSpinCount LoadLibraryExA LoadLibraryExW OutputDebugStringW OutputDebugStringA TlsSetValue TlsGetValue TlsAlloc InitOnceExecuteOnce AcquireSRWLockShared HeapAlloc AcquireSRWLockExclusive ReleaseSRWLockShared CloseHandle ReleaseSRWLockExclusive InitializeSRWLock HeapFree GetProcessHeap SetEnvironmentVariableW GetEnvironmentVariableW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW

advapi32

RegDeleteValueW RegGetValueW EventSetInformation RegOpenKeyExW RegCloseKey RegSetValueExW OpenProcessToken RegCreateKeyExW RegQueryValueExW EventRegister EventWriteTransfer EventUnregister SystemFunction036 CheckTokenMembership DuplicateTokenEx IsWellKnownSid GetTokenInformation CreateWellKnownSid RevertToSelf ImpersonateAnonymousToken

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

oleaut32

SysStringLen SysFreeString SetErrorInfo GetErrorInfo

comctl32

RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass DefSubclassProc

ole32

CoInitialize CoUninitialize OleInitialize RevokeDragDrop CoInitializeEx RegisterDragDrop CoCreateInstance

ws2_32

setsockopt bind ioctlsocket WSASocketW connect getaddrinfo listen socket closesocket accept WSAStartup WSACleanup getsockname getpeername recv getsockopt WSAIoctl WSAGetLastError shutdown WSASend freeaddrinfo send

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile RtlGetVersion NtOpenFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile NtReadFile

shell32

SHCreateItemFromParsingName Shell_NotifyIconW ILFree SHOpenFolderAndSelectItems ILCreateFromPathW ShellExecuteW DragQueryFileW SHAppBarMessage SHGetKnownFolderPath ShellExecuteExW Shell_NotifyIconGetRect DragFinish

shlwapi

SHCreateMemStream

combase

CoTaskMemAlloc CoIncrementMTAUsage CoTaskMemFree CoCreateFreeThreadedMarshaler

wininet

InternetSetOptionW

iphlpapi

ConvertInterfaceLuidToIndex ConvertLengthToIpv4Mask GetAdaptersAddresses GetIfTable2 FreeMibTable

rasapi32

RasEnumEntriesW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

user32

DrawMenuBar SetMenuItemInfoW DrawIconEx AppendMenuW InsertMenuW SystemParametersInfoA IsProcessDPIAware CheckMenuItem EnableMenuItem GetDC TrackPopupMenu ShowWindow PostQuitMessage DrawTextW ReleaseDC GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo CreateAcceleratorTableW DestroyAcceleratorTable GetAsyncKeyState RegisterClassW CreateIcon DestroyIcon RemoveMenu DestroyMenu MsgWaitForMultipleObjectsEx RegisterHotKey RegisterClipboardFormatW ShowCursor GetClipCursor GetClipboardData SetClipboardData CloseClipboard IsClipboardFormatAvailable EmptyClipboard ClipCursor TranslateAcceleratorW AdjustWindowRect UnregisterHotKey GetMenuItemInfoW GetForegroundWindow GetSystemMenu SendInput SetForegroundWindow RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx GetActiveWindow UpdateWindow CreateMenu SetCursorPos LoadCursorW GetWindowRect InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect GetRawInputData GetMonitorInfoW SetCursor GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect MonitorFromRect ClientToScreen GetWindowLongW ScreenToClient DefWindowProcW SetWindowLongPtrW PostThreadMessageW PeekMessageW DispatchMessageW GetMessageW PostMessageW IsWindowEnabled MonitorFromPoint EnumDisplayMonitors MonitorFromWindow IsIconic IsWindowVisible EnableWindow RedrawWindow GetCursorPos SendMessageW EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetClientRect RegisterRawInputDevices GetWindowLongPtrW SetWindowLongW GetKeyState SetMenu InvalidateRect ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetMenu GetWindowTextLengthW GetWindowTextW SetWindowTextW GetKeyboardState SetPropW RegisterWindowMessageA SetWindowRgn FindWindowExW SetParent SetFocus GetWindow CreatePopupMenu SetTimer KillTimer ChangeWindowMessageFilterEx SetWindowDisplayAffinity GetParent OpenClipboard

gdi32

CreateRectRgn CreateSolidBrush CombineRgn DeleteDC CreateCompatibleDC CreateDIBSection GetDeviceCaps SetTextColor SetBkMode BitBlt DeleteObject SelectObject

dwmapi

DwmGetWindowAttribute DwmSetWindowAttribute DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom

crypt32

CertCreateCertificateChainEngine CertVerifyCertificateChainPolicy CertSetCertificateContextProperty CertFreeCertificateChainEngine CertGetCertificateChain CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateChain CertOpenStore CertFreeCertificateContext

api-ms-win-crt-math-l1-1-0

floor trunc fma cos exp log sin round acos asin log10 atan expm1 atan2 roundf log1p __setusermatherr tan cbrt fmod ceil _hypot pow tanh sinh cosh log2

api-ms-win-crt-string-l1-1-0

wcscmp strcmp wcslen strcpy_s wcsncmp strlen _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _errno _set_app_type _crt_atexit _wassert abort _c_exit _cexit __p___argv __p___argc _exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _configure_narrow_argv exit strerror _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe terminate

api-ms-win-crt-heap-l1-1-0

_callnewh malloc realloc calloc free _set_new_mode

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

fwrite ftell fseek _fileno _setmode fread fopen _set_fmode fgets __acrt_iob_func fflush __stdio_common_vfprintf __stdio_common_vsprintf ferror __stdio_common_vsscanf feof fclose __p__commode

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

resources/clash-verge-service-install.exe

IMPHASH 13cd03b6f4bb856452389e74e994788b
SHA256 ea73082094d12a0782389667b9a608ceed3814df442eed25ba9b56820d0a1a1d
MD5 9da7abf96be07992d516ccaa42bc8537
SHA1 839cc4df0d2bebfd6125f55af564b71473fee313
SHA512 0a9d5fe23afa31efd517af3857f040411815dee8b70c48263a97fe65d395c1c0a5f16e88a15ef0340695e9c68e26422433d2414da58b37bf0897c41b20ceb3e3
SSDEEP 1536:TWNPqB+pv9M1Qn0/OVCZPfht5mpjDI2Xw6jwUz5m9JuUH1snVYtEXsxvy9ZtYkwW:TWNnpjnluhDOnIx6fVUH0XsxuZ+8JB
TLSH
T1A7044B63FA5691FCD45AC078C3159563BA77B8C90F2269FF026512383E69EE17F38A10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124012

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clash_verge_service_install.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

GetCurrentThread UnhandledExceptionFilter SetThreadStackGuarantee IsDebuggerPresent AddVectoredExceptionHandler RtlVirtualUnwind GetCurrentProcess RtlCaptureContext GetModuleHandleA GetLastError HeapReAlloc HeapFree GetProcessHeap ExitProcess GetModuleFileNameW FormatMessageW GetModuleHandleW SetUnhandledExceptionFilter WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle WriteConsoleW MultiByteToWideChar HeapAlloc GetFullPathNameW FindClose FindFirstFileExW GetFileInformationByHandleEx lstrlenW GetEnvironmentVariableW GetFileInformationByHandle CreateFileW ReleaseMutex CloseHandle CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx GetCurrentDirectoryW WideCharToMultiByte GetCurrentThreadId GetProcAddress RtlLookupFunctionEntry SetLastError QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent

advapi32

QueryServiceStatusEx CloseServiceHandle ChangeServiceConfig2W StartServiceW OpenServiceW CreateServiceW OpenSCManagerW

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__C_specific_handler memcpy __CxxFrameHandler3 memset __current_exception_context __current_exception memmove memcmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

resources/clash-verge-service-uninstall.exe

IMPHASH 30cc4bf5ccf466dae60f632258a4b5d5
SHA256 1cdfcfc3cab2f26ed4e62fbce128bc58b6d5c2a3d435bfc8042a5051e288350f
MD5 ca0231511f8c4add294871f451bfd838
SHA1 a988379ab70ab01d71d9781a044aa4566a7a94f6
SHA512 b173dbf45b4740caf5e77bafe043201a72f6844363315efbcae1679840066b7488a7959070c9645c8548483f8170600ea7dcbd459d5ce00ead7fde5d29a14087
SSDEEP 3072:Vc0WOb6jQ3QtaOEnt1UN9+OD+cGe1HWFufk:VP6jmQtDEzUNvDRGe19
TLSH
T1ADE35C137951A1F8E01BC07CC3159A73B736B8C51F2269FF166416382E69EE97F38A50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

105516

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clash_verge_service_uninstall.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

UnhandledExceptionFilter SetThreadStackGuarantee AddVectoredExceptionHandler RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThread QueryPerformanceFrequency GetCurrentThreadId GetLastError HeapReAlloc IsProcessorFeaturePresent SetLastError GetModuleHandleA GetCurrentDirectoryW GetModuleHandleW Sleep SetWaitableTimer CreateWaitableTimerExW SetUnhandledExceptionFilter WaitForSingleObject GetConsoleOutputCP GetConsoleMode GetStdHandle WriteConsoleW MultiByteToWideChar HeapAlloc HeapFree ReleaseMutex CloseHandle CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte GetProcAddress GetProcessHeap GetCurrentProcess lstrlenW QueryPerformanceCounter GetEnvironmentVariableW FormatMessageW GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

ControlService OpenServiceW DeleteService OpenSCManagerW QueryServiceStatusEx CloseServiceHandle

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__C_specific_handler memcpy __CxxFrameHandler3 memcmp memset memmove __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

resources/clash-verge-service.exe

IMPHASH 08e5ccac6994b89a12e09cd612e3d246
SHA256 92ad792abb91bd84b89894e63a8251434a631a5803d9d043c18f7a5a7961e9d2
MD5 f992435c52564c74c56606e1b9376658
SHA1 e148f357dc29277e9f2a98c4178924e47c04f660
SHA512 a46687a8c0da79bb80d62999a9216f90ec99a73a86c82a3608041037754465c9d8c8767eefa6bcc4a1a2b6198e6a9ff93aeccc693b528e0fc10c83b92766fbca
SSDEEP 24576:T9+uwx7kUK6dU9y33enQhtbN9Nyx4T8qid1Ef+5iBETFuAc3dl/vA53A5gYH:TdK7rK6dlN9vfzyFuAc3dl/vA5Q5gY
TLSH
T19B855B03FA66C0ECC56EC078C3566232BA72B88A073579EB56945A353E65FE06F3D710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1264092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clash_verge_service.pdb

kernel32

TerminateProcess GetExitCodeProcess GetStdHandle GetCurrentProcess DuplicateHandle WaitForMultipleObjects CreateDirectoryW SetThreadStackGuarantee GetCurrentThread MoveFileExW FindFirstFileExW CreateEventW WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW HeapAlloc WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleHandleW GetModuleFileNameW GetCurrentThreadId GetTempPathW CancelIo FindNextFileW SetConsoleCtrlHandler UnregisterWaitEx RegisterWaitForSingleObject GetFullPathNameW SetLastError WriteFileEx GetSystemTimePreciseAsFileTime SleepEx ReadFileEx IsProcessorFeaturePresent QueryPerformanceFrequency QueryPerformanceCounter CompareStringOrdinal RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CreateProcessW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW AddVectoredExceptionHandler GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW GetSystemInfo WideCharToMultiByte MultiByteToWideChar FormatMessageW GetFileInformationByHandleEx CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent WriteFile ReadFile GetOverlappedResult LocalAlloc CreateNamedPipeW LocalFree CreateThread WaitForSingleObject FindClose FlushFileBuffers SetFilePointerEx SetFileInformationByHandle PostQueuedCompletionStatus GetProcessId ConnectNamedPipe GetFileInformationByHandle GetCurrentProcessId SwitchToThread WaitNamedPipeW CreateFileW HeapReAlloc HeapFree GetProcessHeap SetFileTime GetProcAddress GetModuleHandleA Sleep CloseHandle GetLastError GetEnvironmentStringsW UnhandledExceptionFilter ExitProcess GetTimeZoneInformationForYear SetUnhandledExceptionFilter

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

advapi32

StartServiceCtrlDispatcherW SetServiceStatus SetSecurityDescriptorGroup RegisterServiceCtrlHandlerExW GetSecurityDescriptorControl CopySid GetSidLengthRequired GetSidSubAuthorityCount IsValidSid AddAce GetAce InitializeAcl GetSecurityDescriptorGroup GetAclInformation InitializeSecurityDescriptor ConvertStringSecurityDescriptorToSecurityDescriptorW SetSecurityDescriptorOwner GetSecurityDescriptorDacl SetSecurityDescriptorDacl FreeSid GetSecurityDescriptorSacl SetSecurityDescriptorSacl GetSecurityDescriptorOwner SetSecurityDescriptorControl

ntdll

NtOpenFile NtWriteFile NtReadFile NtCancelIoFileEx RtlNtStatusToDosError NtDeviceIoControlFile NtCreateNamedPipeFile

vcruntime140

__current_exception_context __current_exception memcmp __C_specific_handler memcpy __CxxFrameHandler3 memmove memset

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _initterm_e _initterm _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

resources/enableLoopback.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 f0c328376bd5ae0ef3b0eb19ac1f343c24a9abfe7bc1008d3b2f6ef3573d04d1
MD5 d6d0eeb5a95606ddde1ab29bfb66969e
SHA1 499937e698e9a62ccc7a5118d132a91c646f556e
SHA512 dabab25522b53ab10c25e4ad872801957fa59c1067861909d762ed796589523eddbe9cdfa00e8c7b0b411b7a1558bad4f720c3ad43ab81058ffd3215cd13a203
SSDEEP 768:kREI16zcI2eupxmhm/ljPb0O7/Al25znrShUAEg4CqnZI6qmmlk1QPFLCxf1ml0n:e1HLdwOLFzrShU+wZ9xmlk11fIbW
TLSH
T13A8317003BE84266F6FA8B759572E4509B79BD5B48B0E6CD2DD4B49F09F3B408321727
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

f9:15:24:8c:65:69:b2:f2:5c:45:e2:b6:20:c3:36:9f:61:47:ad:2a:f3:7d:1d:6d:b7:de:43:71:b7:10:70:37

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=5743582,CN=PROGRESS SOFTWARE CORPORATION,O=PROGRESS SOFTWARE CORPORATION,STREET=15 Wayside Rd Ste 400,L=Burlington,ST=Massachusetts,C=US,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Chains

Mar 31, 2025

Subject

Serial Number

72:6c:00:6f:e8:1f:27:d3:83:f0:b6:58

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 11, 2024 - Nov 27, 2025

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=Thales TSS ESN:E462-96F0-442E,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:4a:fd:b8:55:c7:62:aa:c9:89:00:00:00:00:00:4a

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 26, 2024 - Nov 19, 2025

Minor OS version

Major OS version

Entry point

61958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\fiddler-classic\fiddler-classic\Fiddler2\BundledExtensions\EnableLoopback\obj\Release Signed\EnableLoopback.pdb

verge-mihomo-alpha.exe

IMPHASH f9446c531a0baf10ff7aa8398cbc025b
SHA256 76bb1f090fe44f222b88a504b51fe73f90d76e40830382fba54b5c1b00f6ba83
MD5 b69f7e28a10ebf934bc70ff26e450190
SHA1 b77cec7b0f6b40c0e5c5ec7e14c72ac92f9a46ce
SHA512 c72e9712f886bc4542eef223f5003c6c9b11b79b93b7a40a1534218b86ea9578ee14cfdecaeeb5ddc2abbfc734a47ec3a36b90cd967e257870df08eceea3e2f7
SSDEEP 196608:yu0D183qI7DJjTBsvQve3EuEBrG8t8364EzSLiEhoJBHruVjHdZ5Zc:y7G3qIbKke3is64EzSLFo3L6H1y
TLSH
T146A7394BF8564CE4F9ADC438C5A682137B703C69972523D71B20FA146F7EBD06ABA350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

590144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

19.5MB

Virtual Size

19.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.0MB

Virtual Size

22.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

34.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

484KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

451KB

Virtual Size

450KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

verge-mihomo.exe

IMPHASH f9446c531a0baf10ff7aa8398cbc025b
SHA256 c897eeb215ab3c67e7a73267e4a5169b609d0821d4164d3fffc039aa58ff4521
MD5 b2a3b3328a8734ee64ff412e0499a24a
SHA1 8dcc76b3c029bf61799dd23fc2410e06c2b91b29
SHA512 439a76daf5a3ac5ff689e0e5462bbbd979ff2be8943b2a9e795574641ca4480c3831c40313cab3be1dbb8d04e8562f7a0d3972edb65fd09cfe8c7ce9155df201
SSDEEP 196608:fvugFNQzrpzY7P8WewbS9FFQRA38EXEx8F6AiEk88o63J74HTM2VUP5Zc:f2WNQzr64mSN3F64k88oc78CRy
TLSH
T189A74B5BF8654CE8E9ADC534C5A682137B707C69572423D71B20FA242F3EBD06AFA350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

590144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

19.5MB

Virtual Size

19.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22.0MB

Virtual Size

22.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

34.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

484KB

Virtual Size

483KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

448KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

windows-clashverge.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/SimpleSC.dll

kernel32

version

user32

oleaut32

netapi32

advapi32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

$TEMP/MicrosoftEdgeWebview2Setup.exe

PE Signature issue

kernel32

advapi32

ole32

shell32

user32

generic

clash-verge.exe

kernel32

advapi32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

oleaut32

comctl32