clash-for-windows-setup[.]exe

resource
clash-for-windows-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/Clash for Windows.exe
unpack001/clash-meta.exe
unpack001/clash.exe
unpack001/resources/clash-verge-service.exe
unpack001/resources/install-service.exe
unpack001/resources/uninstall-service.exe
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/UserInfo.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll

clash-for-windows-setup.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 027f3a559be3fae3c56ba76db5363fdf3f7c83cb7fd2798df41e7d447f602550
MD5 acd0f1b049ea0612252d53b8207b9390
SHA1 6fca4038e00ee0a81ac5fb5507086db7a05aa42f
SHA512 fc816526f90e06bffe6a67af7b933f9369d1bc0d2739147dd5295a2c060609bc114544ea663e7d889206c72d09ed73ca6a50c8ef1df86485cc59e993e86de291
SSDEEP 393216:Li9MpNgYBwGV6yjG2osWvOUqt/eGc0i4wjgRmZ51zqu:LiRcMN2oXO5t/eGfBmhzZ
TLSH
T1F20733FEAB0C504EDDE022B1237F356A9525B02593E017CFC351E99CA161DD20BEABE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Clash for Windows.exe

IMPHASH 4b793869123870a67713beff4014cf77
SHA256 bc175660acdb665a58acd6e01b8f3c8553bbf58a503511be1674c5fbe1372370
MD5 2d30ab60eb1dd17e0138e936868cc88c
SHA1 bfb9c7ad79af067f8e99a730f125aa2ddb8a017f
SHA512 f33fe31a6d840cc52116fb1eeae9a21592141d38cb6b518c6208be43f06d99b292e16f05c7d0971e81c0e81a0423b4a1c545b2d4e726c45e85dd681d8c6974a5
SSDEEP 98304:WsXVHwcpS3w6eTVQaqlxiH8UAA7LpiKIZX/3P6RKIsK4PRTCWQ5rcgUGz9LBmY+d:HBjDMW7Lpi5Xfy12rHgUGz3
TLSH
T1F7969E43F69581E9C06EC0B4C35A9633FB72B88A4A34B2BB5BD44A312F56F506F1D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4555396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

clash_win.pdb

ntdll

RtlPcToFileHeader RtlUnwindEx NtQuerySystemInformation NtQueryInformationProcess NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlGetNtVersionNumbers NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtCancelIoFileEx RtlGetVersion

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

TlsFree AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetConsoleScreenBufferInfo GetProcessId TerminateProcess GetProcAddress WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex WideCharToMultiByte GetCurrentDirectoryW GetConsoleOutputCP MultiByteToWideChar HeapAlloc GetEnvironmentVariableW CreateDirectoryW GetFullPathNameW FindFirstFileExW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx FormatMessageW GetModuleFileNameW GetCommandLineW GetTempPathW GetStdHandle HeapReAlloc GetModuleHandleA Sleep SetHandleInformation CopyFileExW MoveFileExW CreatePipe QueryPerformanceFrequency CreateThread WriteFileEx SleepEx ReadFileEx QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer GetQueuedCompletionStatusEx CreateEventW CancelIo GetOverlappedResult GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle WaitForMultipleObjects SetFileCompletionNotificationModes GlobalUnlock GlobalLock GlobalAlloc FindNextFileW GetProcessTimes GetSystemTimes GetProcessIoCounters GetFinalPathNameByHandleW GetTickCount64 ReadProcessMemory GetSystemTimePreciseAsFileTime VirtualQueryEx SetLastError GetDiskFreeSpaceExW GlobalMemoryStatusEx lstrlenW SetConsoleTextAttribute CreateIoCompletionPort PostQueuedCompletionStatus OpenProcess GetConsoleMode SetEnvironmentVariableW LocalFree ReleaseSRWLockExclusive AcquireSRWLockExclusive FindClose WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime LoadLibraryW InitializeSListHead GetCurrentProcessId GetExitCodeProcess WaitForSingleObject TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime IsDebuggerPresent UnhandledExceptionFilter SystemTimeToTzSpecificLocalTime SetUnhandledExceptionFilter GetModuleHandleW IsProcessorFeaturePresent RaiseException EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId CloseHandle SetFileInformationByHandle GetLastError DeleteFileW TlsAlloc TlsGetValue SwitchToThread HeapFree GetProcessHeap LoadLibraryExW OutputDebugStringW OutputDebugStringA GetSystemTime GetTimeZoneInformation GetSystemInfo ReadFile LCIDToLocaleName GetUserDefaultUILanguage WriteConsoleW CreateFileW TlsSetValue GetCurrentProcess ExitProcess FreeLibrary

user32

DispatchMessageW GetKeyboardState IsIconic SetMenu MonitorFromPoint GetMessageW GetWindowRect PeekMessageW SetWindowTextW GetWindowTextW GetWindowTextLengthW MonitorFromRect GetWindowLongPtrW VkKeyScanW AppendMenuW PostQuitMessage SendInput IsProcessDPIAware GetDC ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ShowCursor ClipCursor GetSystemMetrics IsWindowVisible GetActiveWindow ClientToScreen TrackPopupMenu SetForegroundWindow GetCursorPos TranslateMessage DestroyAcceleratorTable SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow GetMonitorInfoW DestroyIcon UnregisterHotKey GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW ReleaseCapture SendMessageW RegisterHotKey AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn SetWindowPos DefWindowProcW RegisterClassExW CheckMenuItem SystemParametersInfoA MsgWaitForMultipleObjectsEx EnumDisplayMonitors SetWindowDisplayAffinity IsWindow RegisterTouchWindow CreateAcceleratorTableW EnumChildWindows DispatchMessageA GetMessageA RedrawWindow CreateMenu CreatePopupMenu PostThreadMessageW CloseTouchInputHandle SetCapture CreateIcon PostMessageW GetAncestor TranslateAcceleratorW CreateWindowExW SetWindowLongPtrW RegisterRawInputDevices GetRawInputData ValidateRect GetUpdateRect MapVirtualKeyW GetTouchInputInfo SetMenuItemInfoW SetCursor DestroyWindow LoadCursorW GetClientRect ScreenToClient TrackMouseEvent MonitorFromWindow GetKeyState OpenClipboard EmptyClipboard SetClipboardData GetAsyncKeyState RegisterClassW SetCursorPos GetForegroundWindow GetClipCursor FlashWindowEx CloseClipboard RegisterWindowMessageA

comctl32

SetWindowSubclass TaskDialogIndirect DefSubclassProc RemoveWindowSubclass

secur32

ApplyControlToken InitializeSecurityContextW DeleteSecurityContext AcquireCredentialsHandleA AcceptSecurityContext QueryContextAttributesW FreeCredentialsHandle EncryptMessage DecryptMessage FreeContextBuffer

crypt32

CertDuplicateStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertCloseStore CertFreeCertificateChain CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertOpenStore

ws2_32

closesocket connect getsockopt bind getsockname setsockopt WSASocketW WSACleanup listen recv send getaddrinfo freeaddrinfo WSAIoctl WSAStartup getpeername ioctlsocket WSAGetLastError shutdown select WSASend accept

shell32

ShellExecuteExW ShellExecuteW Shell_NotifyIconW CommandLineToArgvW SHAppBarMessage DragQueryFileW DragFinish SHGetKnownFolderPath Shell_NotifyIconGetRect

ole32

OleInitialize CreateStreamOnHGlobal CoSetProxyBlanket RegisterDragDrop CoTaskMemFree CoUninitialize RevokeDragDrop CoCreateInstance CoTaskMemAlloc CoInitializeEx CoInitializeSecurity

advapi32

DuplicateTokenEx RegQueryValueExW CreateWellKnownSid SystemFunction036 OpenProcessToken RegOpenKeyExW RegSetValueExW EventRegister EventSetInformation EventWriteTransfer EventUnregister GetLengthSid RegGetValueW IsValidSid RegCloseKey RegDeleteValueW CopySid CheckTokenMembership IsWellKnownSid GetTokenInformation

iphlpapi

ConvertInterfaceLuidToIndex GetAdaptersAddresses ConvertLengthToIpv4Mask GetIfEntry2

dwmapi

DwmExtendFrameIntoClientArea DwmEnableBlurBehindWindow

bcrypt

BCryptGenRandom

pdh

PdhGetFormattedCounterValue PdhAddEnglishCounterW PdhCollectQueryData PdhRemoveCounter PdhCloseQuery PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

SetErrorInfo SysStringLen GetErrorInfo SysFreeString SysAllocString VariantClear

wininet

InternetSetOptionA

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

uxtheme

SetWindowTheme

psapi

GetModuleFileNameExW GetPerformanceInfo

api-ms-win-crt-heap-l1-1-0

realloc _callnewh malloc _set_new_mode calloc _msize free

api-ms-win-crt-string-l1-1-0

wcslen strcpy_s strcpy _wcsicmp strlen strcat strcmp wcsncmp

api-ms-win-crt-math-l1-1-0

_dsign fmod pow fmax fmin hypot lrint _fdclass _dclass log2 atanh expm1 log1p acos acosh asin cbrt __setusermatherr asinh trunc floor round tanh ceil tan sqrt sinh sin log10 log fabs exp cosh cos atan2 atan

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc _exit exit terminate _initterm_e _initterm _crt_atexit _get_initial_narrow_environment _register_onexit_function _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe fesetround _wassert abort _c_exit

api-ms-win-crt-convert-l1-1-0

wcstol strtod atoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __acrt_iob_func _set_fmode __p__commode __stdio_common_vsprintf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

clash-meta.exe

IMPHASH ea509d361799935a94335b88f534a970
SHA256 ac8650b0fa158922ce73f144df11b5d00d03a651123cf9ed94177ee4550fd847
MD5 c618279974d7d99d3760850bf5814294
SHA1 9a783883bef8510b013a52bc8500601a85927770
SHA512 15b725ae6c7460688e94733109707745b648e5221317928c521b68302724b34bd2f09accb346f64269d827f66d103aa4338daf9d4629e57bfa9ceb9e00c603c3
SSDEEP 196608:fWyFTnOeL4NB6RHjXe0ChRIgaUrSKasySsayYEZ5Y:lFnOeUNB6RHjS6gaUrSKasySsI
TLSH
T19D574B47EC6444E4C8EDC534C56AA2637BB17C488B3463D72B60F7286F76BD0AAB9350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

473664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.2MB

Virtual Size

13.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1016KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

clash.exe

IMPHASH ea509d361799935a94335b88f534a970
SHA256 ac8650b0fa158922ce73f144df11b5d00d03a651123cf9ed94177ee4550fd847
MD5 c618279974d7d99d3760850bf5814294
SHA1 9a783883bef8510b013a52bc8500601a85927770
SHA512 15b725ae6c7460688e94733109707745b648e5221317928c521b68302724b34bd2f09accb346f64269d827f66d103aa4338daf9d4629e57bfa9ceb9e00c603c3
SSDEEP 196608:fWyFTnOeL4NB6RHjXe0ChRIgaUrSKasySsayYEZ5Y:lFnOeUNB6RHjS6gaUrSKasySsI
TLSH
T19D574B47EC6444E4C8EDC534C56AA2637BB17C488B3463D72B60F7286F76BD0AAB9350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

473664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

11.6MB

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.2MB

Virtual Size

13.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1016KB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

333KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

248KB

Virtual Size

247KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

resources/Country.mmdb

SHA256 c8ef334908cd606c5a49770e8453881381ec88c9c29b765561f559839c4ef7ab
MD5 723dd21b3ab379e49af8d7eec89125eb
SHA1 7937be5a38734d3506a2a3d720a0be83a7a8b15e
SHA512 cabf2ce8382606e80c544e3ab9132cf72344d7c8a71e197346ad9b0309d2e1c1d6ae9fc18f8f6c1a1ce360571b957705546fb82d58d1eb4b73a57ec3c3d3d268
SSDEEP 98304:fubOG2XlmCgs9/J9K1AT4Qt9Rh5GKbO8VKycotc3:fubFMtgKLp35GuO8VKycoa3
TLSH
T10F569D5B284D278431AFF2E8C288536C4ECD5FBED397795862C891F1869E17D27284F2
MD5 SHA1 SHA512 SSDEEP TLSH

resources/clash-verge-service.exe

IMPHASH 47b59f58ebc44d6f8d90a28cbea0211b
SHA256 d5b0eec51154c066ede97201b3f28c95372096b4ae260df87de8608c00b112e6
MD5 4a92be3abc1d42cd4523eb4270a96294
SHA1 1731b057d91100161cbebe7de737de5ba3c523b0
SHA512 427d1ee56e904282d2a0688beca090d0d5a12dedb062905aa294f31c9702518f313362316ecfa99d08aaabec427ee037b6c8c4c325afd33ea9fee864fd4a203d
SSDEEP 12288:0FkNDNyOa3UcE4Heq7MsYJt1qjEkVNCQq2fgdbK77fjWQiB:IIDUOsO45ABQjX2QqLAT0
TLSH
T1CC054B17EA5889FFC46AC07483475632FB71BC8A0724F6AB5BD066313E66BA05F2D344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

591596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\clash-verge-service\clash-verge-service\target\release\deps\clash_verge_service.pdb

kernel32

FormatMessageW CreateFileW GetFullPathNameW WriteConsoleW WaitForSingleObject GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleHandleW GetModuleFileNameW GetConsoleMode GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle RtlLookupFunctionEntry GetEnvironmentVariableW GetCurrentProcessId CompareStringOrdinal CreateNamedPipeW CreateThread ReadFileEx SleepEx WriteFileEx GetStdHandle GetCurrentProcess QueryPerformanceFrequency QueryPerformanceCounter GetSystemTimeAsFileTime GetCurrentDirectoryW RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared PostQueuedCompletionStatus GetCurrentThread GetProcAddress GetModuleHandleA Sleep GetQueuedCompletionStatusEx SetFileCompletionNotificationModes CreateMutexA CreateIoCompletionPort LoadLibraryA ReleaseMutex ReleaseSRWLockExclusive TryAcquireSRWLockExclusive GetFinalPathNameByHandleW SetLastError SwitchToThread GetProcessHeap HeapAlloc SetThreadStackGuarantee AddVectoredExceptionHandler HeapReAlloc GetSystemInfo TerminateProcess ExitProcess GetCurrentThreadId InitializeSListHead RtlVirtualUnwind IsDebuggerPresent SetHandleInformation UnhandledExceptionFilter SetUnhandledExceptionFilter GetLastError WaitForSingleObjectEx CloseHandle AcquireSRWLockExclusive GetSystemDirectoryW HeapFree IsProcessorFeaturePresent

ws2_32

WSACleanup WSAStartup shutdown closesocket recv send WSAIoctl setsockopt accept getsockname ioctlsocket listen bind WSAGetLastError WSASocketW WSASend

advapi32

SetServiceStatus SystemFunction036 RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW

ntdll

NtDeviceIoControlFile RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx

bcrypt

BCryptGenRandom BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider

vcruntime140

__current_exception __current_exception_context memcpy memcmp memset __CxxFrameHandler3 memmove __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv exit _get_initial_narrow_environment _exit __p___argc __p___argv _initialize_narrow_environment _initterm _seh_filter_exe _set_app_type _initterm_e _cexit _initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

resources/geoip.dat

SHA256 af332ab88eb4bb15e3cd10f03f5542e90655ee4bd5bf0e23949cfbd1e46bc20f
MD5 ee3a9467e846cdeb4a5bd7c3df5266a8
SHA1 03863ce779b0ded7fea72b5e419fed06d1446351
SHA512 2e64d93ba62ed41e839150499b813c48519f90629e4a369c0746d8742d8537bdf4e1eb7afdeed40198275ef1be16d7cb397631de22be5694b7cbd52d98142502
SSDEEP 98304:145EEwcgWVZuBDncOk+eq+HqHqxJ3DYwu15WPk9hNzcxgFrPc:EHLYcYPc
TLSH
T19B07CC33D63650F6EE9BE57CC25D39222F0FA4A498E4D0B0A2C55448FEA8A50F536F4D
MD5 SHA1 SHA512 SSDEEP TLSH

resources/geosite.dat

SHA256 3b89d35b0ec475acf1cbed5dcae1a0bced3052b2c6b512866b04dd797a3fdc7e
MD5 6bd7ed5ce71fb801f4fb4af0b67874e6
SHA1 e31e5e368a010a505a17d5b47b0829898c8288e5
SHA512 7f602e9fee3e2eda6816c883fff6aacb788451fc424cb827ae290c998caa0d4bf9c0d5a21528c0694de770df9d75be2488ed0a196d367bda0182745e8f0e64b0
SSDEEP 49152:RhlFwrW7/aK4LXrdy6BKRxaKqeLu6sRnr8ksasHjy:y
TLSH
T1961673FF4C1546913268A539A30D20C8340CA3B5A6ECDFD68A245AA7F6F467633C49FD
MD5 SHA1 SHA512 SSDEEP TLSH

resources/install-service.exe

IMPHASH f4de7888b138cd01c2137acbef7c3639
SHA256 4d477bf0ed5747fe57f9a44a1997da8b0bee11d99f1d19fed010556dedd52f78
MD5 4821f02d75659867c888506b7b5bf164
SHA1 0da9dd7f05e1364cb23ca898a944ea3607a5adfb
SHA512 2596b4e14a6320200115db1f2265c9ba4530797656e420a06e5cd7d31970d2373fcfc711db35dcbc2b762bdfa979e3fc29bf58d52b927e3d4faff8b5d86cfdc0
SSDEEP 3072:7alHqd4qfKU3bVVZPc316f2SPnByu1FJl8XO4IXunLWs:mqd40bVfcsfTnByu16+Xs
TLSH
T137F33923B64624FDC42BC0B483565972B636BCD90B257AFF15E472362E39AE47E3C604
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

120764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\clash-verge-service\clash-verge-service\target\release\deps\install_service.pdb

kernel32

AddVectoredExceptionHandler HeapFree CloseHandle FindClose FindFirstFileW SetThreadStackGuarantee GetFileInformationByHandle CreateFileW GetModuleFileNameW GetCurrentThread GetEnvironmentVariableW GetProcessHeap AcquireSRWLockShared RtlCaptureContext GetCurrentDirectoryW ExitProcess AcquireSRWLockExclusive GetFullPathNameW FormatMessageW GetModuleHandleW RtlLookupFunctionEntry ReleaseMutex GetCurrentProcess CreateMutexA LoadLibraryA SetLastError WaitForSingleObjectEx WriteConsoleW WaitForSingleObject GetConsoleMode GetStdHandle ReleaseSRWLockExclusive TryAcquireSRWLockExclusive GetProcAddress GetLastError GetModuleHandleA HeapReAlloc GetFileInformationByHandleEx HeapAlloc ReleaseSRWLockShared QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

advapi32

CloseServiceHandle StartServiceW QueryServiceStatusEx OpenServiceW OpenSCManagerW CreateServiceW ChangeServiceConfig2W

vcruntime140

__CxxFrameHandler3 memcpy memset memcmp memmove __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

resources/uninstall-service.exe

IMPHASH 6fd202c06119b79bf42d3c74b91a75ec
SHA256 4559bf18e2b118200db3b8f150a30c119779280aac439fab2163e92a908d4539
MD5 8da5d0de0d8388fc57710092dee1a5ff
SHA1 41cffef58ba700f5570faa78e66e15e80ec93e27
SHA512 058bd7fc6cde83dc8459473c1c0e9ec6979472dcedb437d091fce42662dcb124db44de7bf33e7b19d4506595c5312e1d5fe98f33e0f175e691d6aef81b9d20a2
SSDEEP 3072:3WeAd6WWuhQ51LvWDlTqB76ON3JlMQRRkrulTdD:/Ad6351K9+NJl8q
TLSH
T1D4E34B23B65660FDC42BC1B483525972BB72BCE50B216EFF15A472352E36AE07E3D604
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

103996

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\clash-verge-service\clash-verge-service\target\release\deps\uninstall_service.pdb

kernel32

HeapAlloc GetProcessHeap GetProcAddress CloseHandle Sleep TryAcquireSRWLockExclusive ReleaseSRWLockExclusive GetEnvironmentVariableW ReleaseSRWLockShared AcquireSRWLockShared RtlCaptureContext GetLastError HeapFree AcquireSRWLockExclusive FormatMessageW GetModuleHandleW RtlLookupFunctionEntry ReleaseMutex GetCurrentThread HeapReAlloc GetCurrentProcess CreateMutexA LoadLibraryA WaitForSingleObjectEx SetLastError WriteConsoleW WaitForSingleObject SetThreadStackGuarantee GetCurrentDirectoryW GetConsoleMode GetModuleHandleA GetStdHandle AddVectoredExceptionHandler QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent

advapi32

CloseServiceHandle DeleteService OpenSCManagerW ControlService QueryServiceStatusEx OpenServiceW

vcruntime140

__current_exception_context __current_exception __C_specific_handler memmove memset memcmp memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _c_exit _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

resources/wintun.dll

IMPHASH 01ce5951b7d0dcca222159a28511a055
SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
MD5 e861eb5789c50997d9476a6172d1c269
SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
TLSH
T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d8:b2:c9:fd:88:91:f9:1c:30:2d:36:f9:b1:b3:95:7d:da:2e:ea:b0:e7:6f:7a:16:e7:90:01:98:4b:e8:2f:39

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Oct 17, 2021

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Serial Number

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 1, 2021 - Jan 6, 2031

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

61:20:4d:b4:00:00:00:00:00:27

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 15, 2011 - Apr 15, 2021

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Serial Number

06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 10, 2018 - Dec 14, 2021

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Minor OS version

0

Major OS version

6

Entry point

35968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Jason A. Donenfeld\Projects\wintun\Release\amd64\wintun.pdb

kernel32

HeapCreate GetCurrentProcess LoadLibraryExA CloseHandle HeapDestroy GetProcAddress LocalFree GetModuleHandleW IsWow64Process HeapFree SetLastError WaitForSingleObject CreateFileW OpenProcess QueueUserWorkItem CreateEventW Sleep GetLastError SetEvent HeapAlloc GetCurrentProcessId GetProcessTimes RemoveDirectoryW DeleteFileW FormatMessageW EnterCriticalSection CreatePrivateNamespaceW OpenPrivateNamespaceW LeaveCriticalSection InitializeCriticalSection CreateBoundaryDescriptorW CreateMutexW ReleaseMutex ClosePrivateNamespace AddSIDToBoundaryDescriptor DeleteCriticalSection DeleteBoundaryDescriptor ExpandEnvironmentStringsW HeapReAlloc CreateDirectoryW SizeofResource WriteFile LockResource LoadResource FindResourceW GetWindowsDirectoryW VirtualFree DeviceIoControl VirtualAlloc InitializeCriticalSectionAndSpinCount ReadFile SetHandleInformation CreatePipe GetExitCodeThread CreateThread CreateProcessW WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize RaiseException GetSystemInfo VirtualProtect VirtualQuery FreeLibrary RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle

ntdll

NtQuerySystemInformation RtlNtStatusToDosError RtlGetNtVersionNumbers NtQueryKey NtQuerySystemTime

Name

.text

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

536B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

252B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 4803c167e1175a72b66682c8f7c06b9f5014b798c4d9915bc0cdcb5244778705
MD5 7126a065044c0c10d606e9f8bbcd87aa
SHA1 347ff4fa5ebfffd51f62c1664d4cca0a9274fe4e
SHA512 9606c8d467a217f1a3e4074e42112284f6aed61bab29e3e8e56fabe05a68ff08957c39555a636fccd1a3484218b0c0e2b181ad47152a899782b415ddb7380e63
SSDEEP 1536:RmsAYBdTU9fEAIS2PEtuZgVK2jwNLhAQCBRV+FAVJwDyUTB/QQAjZ7:AfY/TU9fE9PEtuZc5w1hAoesDTF4QAV
TLSH
T1B393D00463E0C4BBC5BA0B319A7E97A77FF5B9222064971B2B509B5D7D22340DE0E763
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
TLSH
T16BC19474B3C248B9C491513768AB33D36612EE746784500F9F6711AA38209F7AD3EBC3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
TLSH
T1818162BB93B00CF3D0A44B7B44A71CE762B6DD301762001F4A478AA92591B67EE7EB15
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 17cb20871354b907f678c7c220e4ca60
SHA256 5ef1f010f9a8be4ffe0913616f6c54acf403ee0b83d994821ae4b6716ec1d266
MD5 c5bd51b72a0de24a183585da36a160c7
SHA1 f99a50209a345185a84d34d0e5f66d04c75ff52f
SHA512 1349027b08c7f82e17f572e035f224a46f33f0a410526cf471b22a74b7904b54d1befb5ea7f23c90079605d4663f1207b8c81a45e218801533d48b6602a93dbc
SSDEEP 768:jnvg/4R1C7063G5I1CabuqcFKpnq0jdhK7W+q:jvu4RM2WCqYMX/
TLSH
T139D23818FDC83EBAD6DF1172281C4A6E559FC8080754CEABD3B15E62D4A63722EE510F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4348

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

Sharing

General

Malware Config

Signatures

File Explorer