pushapp-ui-windows-latest[.]zip

resource
unpack001/Push Tethered App-amd64_arm64-installer.exe
unpack002/$PLUGINSDIR/InstallOptions.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/Push Tethered App.exe
unpack002/libusb-1.0.dll

pushapp-ui-windows-latest.zip

SHA256 fab589eeea3cb99d7c5d06f76087a9e2365eee8f186688e27d1d85925a530a5a
MD5 e97101c052a8eeae48b741035d3f02a5
SHA1 da5d83cd1d60ffaa0dedc716e0c64c54e2f9217b
SHA512 889d72e20180ee314d2e5cd6f8a4e87028ef1ddbb808c96901afd528e0d712ec2d425587197826fe08d5b4ffcb24fb52706c1a9d9522b315786040e413fbbdca
SSDEEP 98304:FMQGBgaq6XCVC7EJEaCGP2Q3KsIUuKPVLTdFJYKk0MQNBqCli5+n71dHG7TR90eO:FMQgcowMGP53VvHdBxwIARbGZj8dRDA
TLSH
T1788633DA8078C28C3FD2AA14055F8F704FA0A51E8C3D6366C9796E77DBE958E7DE1090
MD5 SHA1 SHA512 SSDEEP TLSH

Push Tethered App-amd64_arm64-installer.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 d9ec6186ba80cfffc65d57c90838fd2dd4b5da3467c1fa9b412c90fbe7986ac3
MD5 135b20899e0710c1fe5f5720b66d12ec
SHA1 fac1d469f4a445c9c60d449cba573c57f48ee939
SHA512 0f890b049be04e6702c25e5eab2ef46c8d6eb1a958df45359802e101f9d6eb02a3ced396ce4d576a18d82291d88c5e0045b6dffa7faddae104dc88587bf14557
SSDEEP 196608:OG70yAyMGBZ4LPwHffHAR7gE66XNPtbPsiB7kHud6j:O9OBZ4LPw/IR7d66914e7guUj
TLSH
T1AC8633766061D20EDA9A743088EA03344FE1D91B9E78431F45F09D77EFE288DEEBA550
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/InstallOptions.dll

IMPHASH 85f08eb0cbec010ecbc287fa68321173
SHA256 a778d3d9855d5c28a0ffcbc7d21c33a99beef4bf9587a7d7a65c65745801a29c
MD5 ca28ddf732c58331d10b840600b2e519
SHA1 e18db6b0e858b2f3e6d1cb89df1ed973710f1f34
SHA512 2d833fc745e8d7036a2ca500bc0a8274e61338382c4437700510b0361661202fdba36c1ade6fef7591ca4b591568cebbccdcb03830e32b00364eb3705d35420e
SSDEEP 192:EMGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoTT611929WtshLAzgSrX8:EMNt+4t7uJalUnGesY7Lt8nCT6/Yosa
TLSH
T102624D1137D598B3E2E62A797EF377138FA5F722A4428E0BC7332E4638565846D78311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

11022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryW GetCurrentDirectoryW GlobalUnlock GlobalLock GetModuleHandleW CloseHandle SetEndOfFile GetPrivateProfileIntW SetFilePointer MultiByteToWideChar ReadFile GetFileSize CreateFileW lstrcmpiW GetPrivateProfileStringW lstrcatW lstrcpynW WritePrivateProfileStringW lstrlenW lstrcpyW GlobalFree WriteFile GlobalAlloc

user32

PtInRect LoadCursorW GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard GetClientRect SetWindowRgn LoadIconW LoadImageW SetWindowLongW CreateWindowExW MapDialogRect SetWindowPos GetWindowRect CreateDialogParamW ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageW TranslateMessage GetMessageW IsDialogMessageW SetCursor DrawTextW GetWindowLongW DrawFocusRect CallWindowProcW PostMessageW MessageBoxW GetSysColor CharNextW wsprintfW GetWindowTextW SetWindowTextW SendMessageW MapWindowPoints

gdi32

SetTextColor CreateCompatibleDC GetObjectW GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderW SHGetDesktopFolder SHGetPathFromIDListW ShellExecuteW

comdlg32

GetOpenFileNameW GetSaveFileNameW CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe

IMPHASH ccc6e30409f96054ca558f4765d32e38
SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
MD5 60366cbf515774ffde2b49297c3d2e9b
SHA1 0158273f35fb5069ae6ad2950045d3656e86b444
SHA512 b6e1142835e2945f38f478d1ffb9d3f551357d0a65efbe23f4d0a3f4bd4e1933542251233f37f2c47ab5a6cd6b959164b813d43756b49ef72d7dbf73669fa99f
SSDEEP 49152:8S13Oud1Ux5s7EIludZCcYdm4I1VKqlnfU16O8vdR:8SIuHSs4IluPCJAnOudR
TLSH
T17685221176E08135F1F22E705DF59A714EBAFC300E705A5F53852A2D1FB09A2EA70B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

PE Signature issue

Digest

04:3a:7c:79:39:d1:49:44:6f:2d:46:7c:3b:c6:8d:89:67:b1:4b:fd:cd:5f:9f:1d:33:a5:17:9b:41:84:03:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Oct 26, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

04:3a:7c:79:39:d1:49:44:6f:2d:46:7c:3b:c6:8d:89:67:b1:4b:fd:cd:5f:9f:1d:33:a5:17:9b:41:84:03:0e

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 24, 2021

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:e2:f1:7d:92:02:0e:49:f8:7f:00:00:00:00:01:e2

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Dec 15, 2020 - Dec 2, 2021

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Operations Puerto Rico+OU=Thales TSS ESN:0A56-E329-4D4D,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:5b:7c:b0:ba:34:67:37:c1:a7:00:00:00:00:01:5b

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jan 14, 2021 - Apr 11, 2022

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:09:81:2a:00:00:00:00:00:02

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 1, 2010 - Jul 1, 2025

Minor OS version

1

Major OS version

5

Entry point

29707

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer QueryPerformanceCounter LoadLibraryExW GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegOpenKeyExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegSetValueExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Push Tethered App.exe

IMPHASH 1f4e8f7868e504b447dbe0f976572a9b
SHA256 93ca0cd72ad20e0c5555cd9acd85a352ccc45ee0c8bc78471c3236bc2a6bbcdc
MD5 7309e67c0ddc5c6b2d7d2cdebd0cfafe
SHA1 3659b7b2cb7774d7bc1999f1d94e3f9d43a8c437
SHA512 1bb34c4b66905021031eb7f0e8dca0def226e1b510d54232b4c905aedbc3fbe564627dda20c52774f00089dd4620f34eb179bc7faa5a8daa512a233b354c2037
SSDEEP 98304:vXSd3Up6Od8qhkF/7a21O9aoJy1Dm2duOsUzE/P68DBMztcZwbGKw6aY0WEdm/ZS:/WEIOaqhkMYo41Dm4uOsUg/PPDgUwe
TLSH
T1C7F67C87E96500E4C5AEC5358672A673BB717C490B3027C71B64F6243F76BE0AEBA350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CancelIoEx CancelWaitableTimer CloseHandle CreateEventA CreateEventW CreateFileA CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerA CreateWaitableTimerExW DeleteCriticalSection DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FormatMessageA FreeEnvironmentStringsW FreeLibrary GetCPInfo GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetModuleHandleA GetOverlappedResult GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatus GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetVersionExA InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetLastError SetProcessAffinityMask SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableCS SleepEx SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoA VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _endthreadex _errno _exit _fdopen _filelengthi64 _fileno _fileno _fmode _fstat64 _get_osfhandle _initterm _lock _lseeki64 _read _setjmp _strdup _strdup _stricmp _strtoi64 _strtoui64 _unlock _vscprintf _vsnprintf _wfopen atexit _write abort calloc exit fclose fflush fgetpos fopen fprintf fputc fputs fread free fsetpos fwrite getenv getwc isdigit isspace getc iswctype isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset putc puts putwc realloc setlocale setvbuf strchr strcmp strcoll strerror strftime strlen strncmp strrchr strstr strtok strtol strtoul strxfrm ungetwc tolower toupper vfprintf towlower towupper ungetc wcscoll wcsftime wcslen wcsxfrm

winmm

midiInAddBuffer midiInClose midiInGetDevCapsA midiInGetNumDevs midiInOpen midiInPrepareHeader midiInReset midiInStart midiInStop midiInUnprepareHeader midiOutClose midiOutGetDevCapsA midiOutGetNumDevs midiOutLongMsg midiOutOpen midiOutPrepareHeader midiOutShortMsg midiOutUnprepareHeader

Name

.text

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6.6MB

Virtual Size

6.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

202KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

132KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libusb-1.0.dll

IMPHASH c98782bacc5ed2827f7604dd0e269312
SHA256 9858e2381221619e26a78a2824e5970c2a7ec48cdb75071c19eb7b61baa268e2
MD5 4f74a1672956aa30db64f27e16c0ff5f
SHA1 d5f01cb749fd77735b0fcf7279cdebceca49bac4
SHA512 c82b689694769f0bf2d697a74ddce1846427aab19e3e168282bf7b92b4d7c77236eb0c7862394bbbca817afca7cdc3a90f9cb3c572ebc539d83f4b6abb2d608e
SSDEEP 6144:NsKNw3cxdSJu5j3L9pTUUIyAhdZTRKky38:Nbw3lCbhpjo4ky38
TLSH
T1E9346C1FA2D368FCD5C7C0344683CA72F571F8284221EDBF17A4C6351F62D91AA6DA29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

kernel32

CancelIoEx CancelWaitableTimer CloseHandle CreateEventA CreateFileA CreateIoCompletionPort CreateWaitableTimerA DeleteCriticalSection DeviceIoControl EnterCriticalSection FormatMessageA FreeLibrary GetCPInfo GetCurrentProcess GetCurrentThreadId GetLastError GetModuleHandleA GetOverlappedResult GetProcAddress GetQueuedCompletionStatus GetSystemDirectoryA GetSystemTimeAsFileTime GetVersionExA InitializeConditionVariable InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadLibraryW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFile ResetEvent SetEvent SetWaitableTimer Sleep SleepConditionVariableCS SleepEx TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VerSetConditionMask VerifyVersionInfoA VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteFile

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _assert _beginthreadex _errno _fileno _initterm _lock _setmode _strdup _stricmp _strtoi64 _strtoui64 _unlock _write abort calloc fflush fprintf fputc fputs free fwrite getc getenv isdigit isspace isxdigit localeconv malloc memcpy memmove memset realloc strchr strcmp strerror strlen strncmp strrchr strstr strtol strtok strtoul tolower toupper ungetc vfprintf wcslen

GUID_DEVINTERFACE_LIBUSB0_FILTER GUID_DEVINTERFACE_USB_DEVICE GUID_DEVINTERFACE_USB_HOST_CONTROLLER GUID_DEVINTERFACE_USB_HUB GUID_USB_PERFORMANCE_TRACING GUID_USB_TRANSFER_TRACING GUID_USB_WMI_DEVICE_PERF_INFO GUID_USB_WMI_NODE_INFO GUID_USB_WMI_STD_DATA GUID_USB_WMI_STD_NOTIFICATION GUID_USB_WMI_SURPRISE_REMOVAL_NOTIFICATION GUID_USB_WMI_TRACING active_contexts_list active_contexts_lock discovered_devs_append htab_hash libusb_alloc_streams libusb_alloc_transfer libusb_attach_kernel_driver libusb_bulk_transfer libusb_cancel_transfer libusb_claim_interface libusb_clear_halt libusb_close libusb_control_transfer libusb_detach_kernel_driver libusb_dev_mem_alloc libusb_dev_mem_free libusb_endpoint_set_raw_io libusb_endpoint_supports_raw_io libusb_error_name libusb_event_handler_active libusb_event_handling_ok libusb_exit libusb_free_bos_descriptor libusb_free_config_descriptor libusb_free_container_id_descriptor libusb_free_device_list libusb_free_interface_association_descriptors libusb_free_platform_descriptor libusb_free_pollfds libusb_free_ss_endpoint_companion_descriptor libusb_free_ss_usb_device_capability_descriptor libusb_free_ssplus_usb_device_capability_descriptor libusb_free_streams libusb_free_transfer libusb_free_usb_2_0_extension_descriptor libusb_get_active_config_descriptor libusb_get_active_interface_association_descriptors libusb_get_bos_descriptor libusb_get_bus_number libusb_get_config_descriptor libusb_get_config_descriptor_by_value libusb_get_configuration libusb_get_container_id_descriptor libusb_get_device libusb_get_device_address libusb_get_device_descriptor libusb_get_device_list libusb_get_device_speed libusb_get_device_string libusb_get_interface_association_descriptors libusb_get_max_alt_packet_size libusb_get_max_iso_packet_size libusb_get_max_packet_size libusb_get_max_raw_io_transfer_size libusb_get_next_timeout libusb_get_parent libusb_get_platform_descriptor libusb_get_pollfds libusb_get_port_number libusb_get_port_numbers libusb_get_port_path libusb_get_session_data libusb_get_ss_endpoint_companion_descriptor libusb_get_ss_usb_device_capability_descriptor libusb_get_ssplus_usb_device_capability_descriptor libusb_get_string_descriptor_ascii libusb_get_usb_2_0_extension_descriptor libusb_get_version libusb_handle_events libusb_handle_events_completed libusb_handle_events_locked libusb_handle_events_timeout libusb_handle_events_timeout_completed libusb_has_capability libusb_hotplug_deregister_callback libusb_hotplug_get_user_data libusb_hotplug_register_callback libusb_init libusb_init_context libusb_interrupt_event_handler libusb_interrupt_transfer libusb_kernel_driver_active libusb_lock_event_waiters libusb_lock_events libusb_open libusb_open_device_with_vid_pid libusb_pollfds_handle_timeouts libusb_ref_device libusb_release_interface libusb_reset_device libusb_set_auto_detach_kernel_driver libusb_set_configuration libusb_set_debug libusb_set_interface_alt_setting libusb_set_log_cb libusb_set_option libusb_set_pollfd_notifiers libusb_setlocale libusb_strerror libusb_submit_transfer libusb_transfer_get_stream_id libusb_transfer_set_stream_id libusb_try_lock_events libusb_unlock_event_waiters libusb_unlock_events libusb_unref_device libusb_wait_for_event libusb_wrap_sys_device load_system_library usb_api_backend usbd_status_to_libusb_transfer_status usbdk_backend usbi_add_event_source usbi_alloc_device usbi_alloc_event_data usbi_arm_timer usbi_attach_device usbi_backend usbi_clear_event usbi_cond_timedwait usbi_connect_device usbi_create_event usbi_create_timer usbi_default_context usbi_destroy_event usbi_destroy_timer usbi_detach_device usbi_disarm_timer usbi_disconnect_device usbi_fallback_context usbi_get_device_by_session_id usbi_get_monotonic_time usbi_handle_disconnect usbi_handle_transfer_cancellation usbi_handle_transfer_completion usbi_hotplug_exit usbi_hotplug_init usbi_hotplug_notification usbi_hotplug_process usbi_io_exit usbi_io_init usbi_log usbi_remove_event_source usbi_sanitize_device usbi_signal_event usbi_signal_transfer_completion usbi_wait_for_events windows_error_str windows_force_sync_completion windows_version winusb_backend

Name

.text

Size

166KB

Virtual Size

166KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

652B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer