LTK[.]Manager_1[.]30[.]4_x64-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
LTK.Manager_1.30.4_x64-setup.exe
Size 21.7MB
Sample261024-129gkaev4r
SHA256 0007230f8772c846d586f456aedee5846f7dbf4719715940e73bb073ae4eff23
MD5 25d9c2125fec36a1b5fc93a87fedece9
SHA1 93c5a0977fea5b5c900b10e41edec9cee62121ea
SHA512 c1f5738575e2a6268f4eafea9bec0b1ab84de6eb0ac0afd664b52db8e98ac5feedc8a8ce703acd026f1f12bd8c87a6d3380dfcd803cef48d6f9efaa52e8e0b2e
SSDEEP 393216:zMHxw9ucldkPOPhXpLrBlGFkw85oCBTJO6X1oSKFztMWy9+Fn/k:zVY0OGDSFC5oaT/X1o7RN5FM
TLSH
T1943733C28F786313D6667BB84AD6ED060D2E7573857F9B334A60C5C46AE7805CC2A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll

File Explorer

LTK.Manager_1.30.4_x64-setup.exe

.exe 21.7MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 48KB
file-icons/fantome.ico

48KB
file-icons/modpkg.ico

32KB
ltk-manager.exe

.exe 81.3MB
ltk_patcher_dll.dll

.dll 815KB
ltk_patcher_host.exe

.exe 1.2MB

LTK.Manager_1.30.4_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 0007230f8772c846d586f456aedee5846f7dbf4719715940e73bb073ae4eff23
MD5 25d9c2125fec36a1b5fc93a87fedece9
SHA1 93c5a0977fea5b5c900b10e41edec9cee62121ea
SHA512 c1f5738575e2a6268f4eafea9bec0b1ab84de6eb0ac0afd664b52db8e98ac5feedc8a8ce703acd026f1f12bd8c87a6d3380dfcd803cef48d6f9efaa52e8e0b2e
SSDEEP 393216:zMHxw9ucldkPOPhXpLrBlGFkw85oCBTJO6X1oSKFztMWy9+Fn/k:zVY0OGDSFC5oaT/X1o7RN5FM
TLSH
T1943733C28F786313D6667BB84AD6ED060D2E7573857F9B334A60C5C46AE7805CC2A3D8
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

a1:b5:ed:d4:8e:ba:f8:ff:55:c5:c1:2a:b7:ef:d3:9b:54:e7:86:0f:7a:20:3a:e6:f0:95:e1:f5:61:9a:72:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Chains

Oct 23, 2026

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:22:c3:fc:b3:9d:c7:f5:7a:39:ec:00:00:00:09:22:c3

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2026 - Oct 25, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5d:c6:39:78:4f:40:7d:33:fd:00:00:00:00:00:5d

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 9a2c633a5bc342cb5e8e679ce3cd4266186e5cfce6bac54379e4d3b3c5802239
MD5 119fa8cda61e7dda2f4b2cc871569c0a
SHA1 09a5494d1f13e3cf573479a64c5c3149516ec66b
SHA512 00771587b37014639745b39b93a3ab4e7b21c0198e333d00c0eed0d8f98eac0b364c58b975421a4535d60f997c2ac4f930d33efe64075b9f5cbac1779da48bbd
SSDEEP 1536:gwODZzTrAV5Oevq4DtXHVGqH8Hif9pfIExo:gwwy0gqaXHMVJ
TLSH
T1E3238E8CFDC46A67EBCF19711048C96F6E3FCA051510C967A2B29E92C593372AFD412E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

83:3a:0c:a6:a9:ea:fe:42:8b:8c:66:14:d5:bb:78:4d:6e:28:98:d1:44:45:77:45:9c:98:93:7f:05:54:8f:4a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Chains

Oct 23, 2026

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:22:c3:fc:b3:9d:c7:f5:7a:39:ec:00:00:00:09:22:c3

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2026 - Oct 25, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7800-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5e:2e:11:6e:1c:76:9c:ef:05:00:00:00:00:00:5e

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

ltk-manager.exe

IMPHASH fc53f74f8178a7bc7ba6da365915e335
SHA256 8bfa05938d88ad43f13796205da68a586d79577a0115114d8f5eebe75ceca818
MD5 12f981d1012d1974bc060f95240a0565
SHA1 58a7f8d001f2420f392ba2523202924b8356018b
SHA512 97a8ede276b3196f453205303c6101ea251b7802e836a645f7cbef044b4c23d76b5c9663004b4842e01b5521adee454d5632326da0c22ff7e121e07b7dff36a4
SSDEEP 1572864:1/azKC4h2YcwMVqRM8bIO6sC6Kh14bapTHzSU7:0X44SM
TLSH
T1D1182915BA9A596CD05AC4B083478A735A3434CB1B35B9FF54C8A2383F79AF46F38319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

63:f0:de:28:6a:92:da:d0:1f:fe:1f:1f:53:8a:48:4a:e9:45:b1:50:13:4b:8a:ef:5e:e0:aa:85:7d:28:e5:0a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Chains

Oct 23, 2026

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:22:c3:fc:b3:9d:c7:f5:7a:39:ec:00:00:00:09:22:c3

Issuer

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2026 - Oct 25, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 03,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:18:0d:eb:91:55:a9:8a:00:98:00:00:00:00:00:18

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:60:72:06:24:8a:4a:05:b8:d9:00:00:00:00:00:60

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

59964768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ltk_manager.pdb

kernel32

GetSystemTimeAsFileTime SleepConditionVariableSRW WakeAllConditionVariable CreateMutexW GetTimeZoneInformationForYear AcquireSRWLockExclusive ReleaseSRWLockExclusive RaiseException GetModuleHandleW CancelIo WaitForSingleObjectEx GetFileAttributesW GetConsoleMode GetCurrentProcess ReleaseMutex LoadLibraryExW GetLastError GetFinalPathNameByHandleW GetModuleFileNameW OutputDebugStringW OutputDebugStringA GetUserDefaultUILanguage LCIDToLocaleName GetCurrentThreadId CreatePipe GlobalLock GlobalAlloc SetLastError GlobalUnlock GetDiskFreeSpaceExW CreateFileW GlobalSize HeapReAlloc DuplicateHandle WideCharToMultiByte FindFirstVolumeW GlobalFree FindNextVolumeW GetCurrentThread FormatMessageW WaitForSingleObject GetSystemInfo GlobalMemoryStatusEx GetCurrentProcessId LocalFree VirtualQueryEx GetProcessTimes SetHandleInformation OpenProcess GetExitCodeProcess GetSystemTimes GetProcessIoCounters ReadProcessMemory FreeLibrary CreateIoCompletionPort LoadLibraryExA RtlPcToFileHeader ReleaseSemaphore PostQueuedCompletionStatus GetQueuedCompletionStatusEx ReadDirectoryChangesW SetFileCompletionNotificationModes ReadFile GetOverlappedResult WriteFile CancelIoEx UnmapViewOfFile VirtualProtect CreateFileMappingW MapViewOfFile FlushFileBuffers SetFileAttributesW MoveFileExW CreateSemaphoreW GetProcAddress GetFileInformationByHandle CloseHandle FindVolumeClose lstrlenW LoadLibraryA Sleep GetModuleHandleA GetVolumePathNamesForVolumeNameW FlsGetValue SetNamedPipeHandleState EncodePointer LoadLibraryW CreateEventW GetDriveTypeW HeapAlloc HeapFree GetProcessHeap DeviceIoControl MultiByteToWideChar GetVolumeInformationW RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead FindNextFileW QueryPerformanceFrequency GetTempPathW WaitForMultipleObjects FlsSetValue IsThreadAFiber GetModuleHandleExW FlsAlloc FlsFree SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW SetEnvironmentVariableW DeleteFileW CreateSymbolicLinkW CreateMutexA SwitchToThread ExitProcess FindClose FindFirstFileExW RemoveDirectoryW GetCurrentDirectoryW SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW GetEnvironmentStringsW TerminateProcess GetProcessId CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileInformationByHandleEx SetFileTime GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry RtlCaptureContext LockFileEx WriteFileEx SleepEx ReadFileEx CreateThread QueryPerformanceCounter CreateHardLinkW CopyFileExW GetStdHandle SetFileInformationByHandle GetFullPathNameW FreeEnvironmentStringsW CompareStringOrdinal GetCommandLineW K32GetPerformanceInfo RtlVirtualUnwind CreateToolhelp32Snapshot Process32FirstW Process32NextW GetEnvironmentVariableW DeleteCriticalSection InitializeCriticalSectionEx

advapi32

ImpersonateAnonymousToken GetTokenInformation RevertToSelf RegEnumValueW RegEnumKeyExW RegQueryInfoKeyW RegCloseKey RegSetValueExW RegGetValueW IsValidSid RegDeleteKeyExW GetLengthSid CopySid OpenProcessToken RegQueryValueExW RegDeleteTreeW RegDeleteValueW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW SystemFunction036 EventUnregister EventWriteTransfer EventSetInformation EventRegister

ntdll

NtReadFile NtCreateFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtQuerySystemInformation NtQueryInformationProcess NtDeviceIoControlFile NtCreateNamedPipeFile NtWriteFile NtOpenFile

user32

DestroyIcon ReleaseCapture SetCapture GetSystemMenu MsgWaitForMultipleObjectsEx RegisterRawInputDevices RegisterWindowMessageA GetWindow SetParent SetMenu MapWindowPoints EnableMenuItem SetFocus ShowWindow GetMenuItemInfoW CreateMenu CreatePopupMenu RemoveMenu DrawMenuBar DestroyAcceleratorTable SetWindowLongW UnregisterHotKey RegisterClassW ShowCursor GetClipCursor RegisterHotKey GetAsyncKeyState ClipCursor SetWindowDisplayAffinity SetPropW MonitorFromPoint ChangeWindowMessageFilterEx AllowSetForegroundWindow IsProcessDPIAware SystemParametersInfoA IsWindowVisible GetMenu SetTimer KillTimer TrackPopupMenu GetWindowTextLengthW GetWindowTextW SetWindowTextW AdjustWindowRect RedrawWindow GetRawInputData AppendMenuW SendMessageW AdjustWindowRectEx InsertMenuW CreateWindowExW SetWindowLongPtrW GetWindowLongPtrW IsWindow IsWindowEnabled GetSystemMetrics CloseClipboard RegisterTouchWindow RegisterClipboardFormatW EnableWindow EnumDisplayMonitors DrawIconEx SetForegroundWindow SendInput CheckMenuItem ReleaseDC SetMenuItemInfoW GetDC PostQuitMessage GetClipboardData SetClipboardData DestroyMenu GetMenuBarInfo OffsetRect GetWindowDC EmptyClipboard IsClipboardFormatAvailable OpenClipboard SetWindowRgn GetKeyboardLayout DrawTextW EnumChildWindows VkKeyScanW GetKeyboardState DispatchMessageA GetMessageA GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW IsIconic SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect FindWindowExW GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos GetClientRect GetWindowLongW ScreenToClient GetKeyState LoadCursorW GetUpdateRect MapVirtualKeyW ValidateRect PostThreadMessageW PeekMessageW DefWindowProcW FlashWindowEx DispatchMessageW TranslateMessage GetMessageW GetParent RegisterClassExW FindWindowW MapVirtualKeyExW ToUnicodeEx CreateIcon GetWindowRect GetWindowThreadProcessId GetShellWindow GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos InvalidateRgn SetWindowPos CreateAcceleratorTableW ClientToScreen TranslateAcceleratorW PostMessageW DestroyWindow

shell32

SHCreateItemFromParsingName DragQueryFileW ShellExecuteExW Shell_NotifyIconW SHGetKnownFolderPath CommandLineToArgvW ShellExecuteW Shell_NotifyIconGetRect SHChangeNotify SHAppBarMessage DragFinish SHOpenFolderAndSelectItems ord190 ord155

gdi32

CreateCompatibleDC GetDeviceCaps CombineRgn CreateDIBSection BitBlt SelectObject DeleteObject DeleteDC SetBkMode SetTextColor CreateSolidBrush CreateRectRgn

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

ole32

CoCreateFreeThreadedMarshaler CoInitialize CoTaskMemFree CoTaskMemAlloc RevokeDragDrop RegisterDragDrop OleInitialize CoUninitialize CoInitializeEx CoCreateInstance

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

comctl32

TaskDialogIndirect DefSubclassProc SetWindowSubclass RemoveWindowSubclass

shlwapi

SHCreateMemStream AssocQueryStringW

oleaut32

SysStringLen VariantClear SysFreeString SysAllocStringLen GetErrorInfo SetErrorInfo

bcryptprimitives

ProcessPrng

secur32

DecryptMessage InitializeSecurityContextW QueryContextAttributesW ApplyControlToken AcceptSecurityContext EncryptMessage DeleteSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA FreeContextBuffer

ws2_32

WSASend ioctlsocket connect recv send WSASocketW shutdown WSAIoctl getsockname getsockopt freeaddrinfo WSAStartup getpeername closesocket getaddrinfo bind WSAGetLastError setsockopt

crypt32

CertDuplicateStore CertAddCertificateContextToStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertSetCertificateContextProperty CertFreeCertificateContext CertFreeCertificateChain CertAddEncodedCertificateToStore CertEnumCertificatesInStore CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertCloseStore CertFreeCertificateChainEngine CertCreateCertificateChainEngine

bcrypt

BCryptGenRandom

pdh

PdhGetFormattedCounterValue PdhOpenQueryA PdhCollectQueryData PdhCloseQuery PdhAddEnglishCounterW PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

wintrust

WinVerifyTrust

api-ms-win-crt-math-l1-1-0

expf floorf floor fmax fmin trunc sinf roundf ceilf _dpcomp _dclass _fdclass fmod pow log2 round acos atan ceil cos sin sqrt exp cosf tan truncf powf log2f fmaf log10 fma logf sqrtf log __setusermatherr

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s strcmp strlen wcslen _wcsicmp wcscmp

api-ms-win-crt-runtime-l1-1-0

abort _crt_atexit _register_onexit_function _initialize_onexit_table strerror _register_thread_local_exe_atexit_callback terminate _c_exit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _cexit __p___argc __p___argv _wassert

api-ms-win-crt-heap-l1-1-0

realloc _callnewh malloc calloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _wfopen_s __p__commode fclose __stdio_common_vsprintf puts fgetpos _set_fmode __stdio_common_vfprintf rewind ferror _ftelli64 fseek fsetpos fread

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-utility-l1-1-0

bsearch qsort

msvcp140

?_Xbad_function_call@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z

Name

.text

Size

58.2MB

Virtual Size

58.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20.0MB

Virtual Size

20.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

295KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

146KB

Virtual Size

145KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ltk_patcher_dll.dll

IMPHASH 2d0092ede8166ecba468ba39962d3773
SHA256 0b024a3a839f55ff7cf7ee93d9ed2078bcbb07d3b7f320463d678f8a6209e5ff
MD5 14a62ce744c507507877fd047d0c5df4
SHA1 3759ec54bf09894a4069f02ede69650b6ba63ccc
SHA512 417594ecb8444f89b18293fc4d074c366e9ada9c3015a05d9925796bf3ef67d64f97846e56618e1b9b3cdf524b69ca9d00848599f59287a2b5c53abc573c2ad1
SSDEEP 12288:tiNGFb3U3CPfAvvcD6pG6WlrZ09eEnTGccPgT3itVb9:YNFQfAvvcuCZ+e4coTyjh
TLSH
T1E7058C03F65691E9C06AC074C35BA233FA72BC890B217AEB47D49A353E66BD0673D705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

96:cc:89:5d:75:50:e8:d1:83:a6:2c:b5:8b:35:22:f0:3c:20:2a:d6:4b:69:86:06:d2:6f:e6:cd:0c:1c:85:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Chains

Oct 21, 2026

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:08:f7:0b:9c:85:0d:00:2b:9c:f0:00:00:00:09:08:f7

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2026 - Oct 23, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7D00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:5f:2a:e4:f8:23:45:bc:1a:49:00:00:00:00:00:5f

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

519284

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

ltk_patcher_dll.pdb

kernel32

GetNamedPipeServerProcessId GetLastError ReadFile CreateFileW GetCurrentProcessId WriteFile UnmapViewOfFile SetLastError HeapReAlloc GetModuleHandleExW ReadProcessMemory GetModuleHandleExA GetProcessTimes GetCurrentProcess GetFileInformationByHandleEx GetModuleFileNameW GetFileInformationByHandle SetFileInformationByHandle SetFileTime GetFullPathNameW HeapAlloc FlsFree FlsSetValue IsThreadAFiber FlsAlloc HeapFree WaitForSingleObject FormatMessageW GetModuleHandleW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry DuplicateHandle MapViewOfFile CreateFileMappingW FindNextFileW FindClose FindFirstFileExW GetProcessHeap GetCurrentThreadId WriteProcessMemory VirtualProtect GetProcAddress CloseHandle IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess EncodePointer RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader GetEnvironmentVariableW DeleteCriticalSection InterlockedFlushSList RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter SetUnhandledExceptionFilter UnhandledExceptionFilter WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle WideCharToMultiByte RtlVirtualUnwind lstrlenW RtlCaptureContext GetCurrentDirectoryW InitializeCriticalSectionAndSpinCount GetSystemInfo GetCommandLineW

user32

CallNextHookEx MessageBoxA

bcryptprimitives

ProcessPrng

wintrust

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain

crypt32

CertGetNameStringW CertGetEnhancedKeyUsage

ntdll

RtlNtStatusToDosError NtQuerySystemInformation NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

api-ms-win-crt-string-l1-1-0

strcmp wcsncmp strlen wcslen strcpy_s

api-ms-win-crt-heap-l1-1-0

calloc free malloc

api-ms-win-crt-runtime-l1-1-0

_seh_filter_dll _configure_narrow_argv _initialize_narrow_environment abort terminate _initterm_e _initterm _cexit _initialize_onexit_table _crt_atexit _execute_onexit_table _register_onexit_function

ltk_patcher_host.exe

IMPHASH 2b0adb6d6e5b53339eda23f9003c6e21
SHA256 27de1bfdbf37129e42c12b18cc7b4f75c15d39bcd7afefe65c4c33d0e99fe856
MD5 727e4815773040d013e55474ba7f4bf1
SHA1 0c50e86b509c76d0b0746901de02288c18326228
SHA512 08f4852ebda85e34dd52460569c329e1a2567dd561b3d61e39e7686492975d4243b7b3ca97efa29452c0d4a32a3af4c6ea0be5cf9f09035e12296e238cb88c04
SSDEEP 24576:3yMapjvSKcx8JS27BPAV9dQi2t0Okk8+rUJ:3yMejvVcgZHVt0zkFry
TLSH
T138453943F26290FDC56AC074935A6233BA327C4947357AEB4BE48B313E65F906A3DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

77:d4:61:8d:40:dc:23:b8:4a:79:63:4a:bd:84:dc:75:6c:df:e7:22:30:0f:f7:cf:71:ee:cc:3c:89:5b:0c:d3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Chains

Oct 21, 2026

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Natoken LLC,O=Natoken LLC,L=Austin,ST=Texas,C=US

Serial Number

33:00:09:08:f7:0b:9c:85:0d:00:2b:9c:f0:00:00:00:09:08:f7

Issuer

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 20, 2026 - Oct 23, 2026

Subject

CN=Microsoft ID Verified CS AOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:16:31:92:8d:92:02:65:7b:9a:00:00:00:00:00:16

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:60:72:06:24:8a:4a:05:b8:d9:00:00:00:00:00:60

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 17, 2026 - Sep 14, 2027

Minor OS version

Major OS version

Entry point

980796

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ltk_patcher_host.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

kernel32

SetStdHandle FreeConsole ExitProcess GetStdHandle CreateNamedPipeW FreeLibrary CreateIoCompletionPort WriteFile ReadConsoleW CloseHandle GetModuleHandleA FlsFree FlsSetValue FlushFileBuffers IsThreadAFiber GetModuleHandleExW GetFullPathNameW WriteConsoleW MultiByteToWideChar GetFileAttributesW GetConsoleOutputCP GetConsoleMode GetModuleHandleW WideCharToMultiByte ReleaseMutex LoadLibraryExW CreateMutexA lstrlenW LoadLibraryA WaitForSingleObjectEx SetLastError GetCurrentThreadId GetModuleFileNameW CancelIoEx GetOverlappedResult GetQueuedCompletionStatusEx GetCurrentProcessId SwitchToThread GetProcAddress WaitForSingleObject GetLastError GetSystemTimeAsFileTime ReadFile PostQueuedCompletionStatus GetExitCodeProcess ConnectNamedPipe CreateThread FlsAlloc GetCurrentThread GetCurrentProcess SetThreadStackGuarantee DisconnectNamedPipe CreateFileW IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree TerminateProcess AddVectoredExceptionHandler RtlPcToFileHeader InitializeCriticalSectionAndSpinCount DeleteCriticalSection GetProcessHeap HeapFree RaiseException HeapReAlloc GetCurrentDirectoryW EncodePointer RtlUnwindEx InitializeSListHead SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlCaptureContext GetCommandLineW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW HeapAlloc FormatMessageW RtlLookupFunctionEntry RtlVirtualUnwind

advapi32

GetTokenInformation ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken

user32

UnhookWindowsHookEx GetWindowThreadProcessId SetWindowsHookExW PostThreadMessageW FindWindowExA

shell32

ShellExecuteExW

ntdll

NtReadFile NtWriteFile NtCancelIoFileEx NtDeviceIoControlFile RtlNtStatusToDosError

bcryptprimitives

ProcessPrng

api-ms-win-crt-string-l1-1-0

strcpy_s wcsncmp strlen wcslen strcmp

api-ms-win-crt-runtime-l1-1-0

terminate _c_exit __p___argv __p___argc _exit abort _initterm_e _initterm _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc malloc free

Sharing

General

Malware Config

Signatures

File Explorer

LTK.Manager_1.30.4_x64-setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

file-icons/fantome.ico

file-icons/modpkg.ico

ltk-manager.exe

kernel32

advapi32

ntdll

user32

shell32

gdi32

dwmapi

ole32

api-ms-win-core-synch-l1-2-0

comctl32

shlwapi

oleaut32

bcryptprimitives

secur32

ws2_32

crypt32

bcrypt

pdh

powrprof

psapi

wintrust

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0