1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0

Sharing

Copy URL Twitter E-mail

General

Target
1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0
Size 14.7MB
Sample261102-e5kfyszygy
SHA256 1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0
MD5 08c21862b677d5e26a8a9db9f3d57f7f
SHA1 6a14acaf75ab201c1cf71b4defadb63ca8e1fa63
SHA512 1eba72127dcc745f41187ce1ad8fd13f9340f3b68eea23efa8dd34af7bdca2f4950a2f4e60dda959acd69e09da12b8fd7212e39769877d2c49aebd0e422f7f10
SSDEEP 393216:dFIM9jvDjiMh3vWa+FdV+MaVsb2a/vARfYF/:dFIMxvVZWx7cu2wF/
TLSH
T1BBF6338824C4D563FCFB1C3C69DA8356D422A6D22938693F4E6BE75091AFC9BF6050D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 11 IoCs

Checks for missing Authenticode signature.

resource
1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0
unpack001/$PLUGINSDIR/ApplicationID.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/QcClip.exe
unpack001/uninstall.exe
unpack002/$PLUGINSDIR/LangDLL.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0

.exe 14.7MB
$PLUGINSDIR/ApplicationID.dll

.dll 198KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 1.1MB
QcClip.exe

.exe 45.3MB
uninstall.exe

.exe 760KB
$PLUGINSDIR/LangDLL.dll

.dll 5KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 1.1MB
vcruntime140.dll

.dll 121KB

1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0
MD5 08c21862b677d5e26a8a9db9f3d57f7f
SHA1 6a14acaf75ab201c1cf71b4defadb63ca8e1fa63
SHA512 1eba72127dcc745f41187ce1ad8fd13f9340f3b68eea23efa8dd34af7bdca2f4950a2f4e60dda959acd69e09da12b8fd7212e39769877d2c49aebd0e422f7f10
SSDEEP 393216:dFIM9jvDjiMh3vWa+FdV+MaVsb2a/vARfYF/:dFIMxvVZWx7cu2wF/
TLSH
T1BBF6338824C4D563FCFB1C3C69DA8356D422A6D22938693F4E6BE75091AFC9BF6050D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$PLUGINSDIR/ApplicationID.dll

IMPHASH 8c45ff8a205d07c8c17066afebcdfc91
SHA256 f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117
MD5 91c2e2f34b5bba068e9a6178e13a4e5c
SHA1 affcac00894c9afd152e55d0bff7899349edcd6c
SHA512 ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000
SSDEEP 3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy
TLSH
T1B8149F11B491C172D1BF16340979DAA65A3C7D600BA88AEFA7D84D3E4F781C06B31BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35572

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\src\NSIS-ApplicationID\ReleaseUnicode\ApplicationID.pdb

kernel32

lstrcpynW GlobalAlloc GlobalFree WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlUnwind RaiseException GetLastError FreeLibrary LoadLibraryExW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle HeapSize CreateFileW

shell32

SHCreateItemFromParsingName SHGetPropertyStoreFromParsingName

ole32

CoCreateInstance CoInitialize CoUninitialize

shlwapi

SHStrDupW

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

58KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 110545415a59402635e1c9439acba15b44bab268ed02ad2a262ce12604a47855
MD5 a8c86996c4230c2209f5927f21321377
SHA1 45ce0ab93cb6a3a594e54878cce05df724024393
SHA512 69ee73496b916777936b0dddd2cc4a4f916e393f7d0b167cba77a4a239ee1e3f645d9b90dee1627c42a23eb6c3403e4d086546b9f78b3a2e4999c8f92f6a3bc3
SSDEEP 96:mIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/23lkCTcaqHCI:bhE+A0+sF6piUFkAylncviI
TLSH
T154F1C776F3D20673F9AB427428632F231B2AF521576581A6490316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 4b7d17da290f41ebe244827cc295ce7e580da2f7e9f7cc3efc1abc6898e3c9ed
MD5 1d8f01a83ddd259bc339902c1d33c8f1
SHA1 9f7806af462c94c39e2ec6cc9c7ad05c44eba04e
SHA512 28bf647374b4b500a0f3dbced70c2b256f93940e2b39160512e6e486ac31d1d90945acecef578f61b0a501f27c7106b6ffc3deab2ec3bfb3d9af24c9449a1567
SSDEEP 96:o4Ev02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YsNqkzfFc:o4EvCu5e81785qHFcU0PuAw0uyGIFc
TLSH
T12A120992E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 3d02628e8a8651e903e8432db76ebaca
SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
MD5 1e38f56aba852b737f2866c48b823165
SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
TLSH
T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

SystemFunction036

kernel32

HeapAlloc GetProcessHeap HeapFree HeapReAlloc CloseHandle Sleep GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess lstrcpyW GlobalFree GlobalAlloc lstrcpynW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetModuleHandleA GetProcAddress TlsGetValue TlsSetValue GetCurrentThread InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree GetStdHandle GetLastError GetConsoleMode WaitForSingleObject MultiByteToWideChar WriteConsoleW SetLastError WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex GetEnvironmentVariableW GetModuleHandleW FormatMessageW CreateFileW GetFullPathNameW CreateDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW FindClose SetHandleInformation CreateThread SetThreadStackGuarantee QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimeAsFileTime GetCurrentDirectoryW RtlCaptureContext AcquireSRWLockShared ReleaseSRWLockShared SetFilePointerEx GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle HeapSize GetStringTypeW GetFileType DecodePointer LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetModuleFileNameW GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwind InterlockedFlushSList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount FreeLibrary LoadLibraryExW RaiseException ExitProcess GetModuleHandleExW

user32

ShowWindow CreateWindowExW FindWindowExW SetWindowPos SetWindowTextW SendMessageW GetWindowLongW

ws2_32

WSASend WSARecv recv getsockname getsockopt closesocket WSAGetLastError getaddrinfo freeaddrinfo ioctlsocket accept WSACleanup WSAStartup send connect bind listen select getpeername setsockopt WSASocketW

ntdll

RtlNtStatusToDosError NtWriteFile

bcrypt

BCryptGenRandom

QcClip.exe

IMPHASH 80e5f54d99d5864091c84202af67cb8b
SHA256 10220f3ed5380c646aa82c2e111f88eb65412621d78f0b57e4d407014e132fbb
MD5 fdee57837851a7ea26da38f66a7b4980
SHA1 8a8629d3216e25e3e78c8a6553b8b3400961895c
SHA512 c29e6d24eed36001dc658494063bdc7ecae9be827d0eb6e40a8d1fb5e06190a4357d17007f5e764fb91b47c7669b3876424f1bf835d5037895292bcb4c01f5e3
SSDEEP 393216:oah2aZwRf1tl5tvLR8VD7bcVCuJDk1yFU/xHyTPfCizz5iVJb+l2N:Bh2caf1tl5tN8VDc/5q62
TLSH
T17EA77D47F7A280E9C46AC07986476732F7317C4A4224B6A77BDC8B203F51BA8573E749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28484508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

QcClip.pdb

kernel32

LocaleNameToLCID lstrlenW LockFileEx QueryFullProcessImageNameW DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection CreateEventA SetThreadPriority WaitForMultipleObjectsEx QueryPerformanceCounter CreateWaitableTimerExW SetWaitableTimer QueryPerformanceFrequency Sleep FormatMessageW WideCharToMultiByte InitializeCriticalSection GetCommandLineW GetUserDefaultLocaleName TerminateProcess GetExitCodeProcess WaitForSingleObject UnmapViewOfFile FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentPackageFullName GetEnvironmentVariableW GetCurrentDirectoryW CreateThreadpoolTimer SetThreadpoolTimer CloseThreadpoolTimer WaitForMultipleObjects GetOverlappedResult LocalFree FindCloseChangeNotification CreateEventW FindFirstChangeNotificationW GetSystemInfo FindNextChangeNotification GetModuleHandleW GetCurrentThreadId GlobalFree GetModuleHandleExW GetCurrentProcess GetProcAddress GetModuleHandleA AddVectoredExceptionHandler SwitchToThread SystemTimeToFileTime GetTimeZoneInformationForYear RtlVirtualUnwind RtlCaptureContext GlobalMemoryStatusEx SetEvent GlobalSize GetCurrentThread SetThreadStackGuarantee SetFilePointerEx GetSystemTimePreciseAsFileTime GlobalLock GlobalUnlock RemoveDirectoryW GlobalAlloc SetFileAttributesW HeapReAlloc CreateThread GetCurrentProcessId FlushFileBuffers OpenProcess GetLastError FindClose IsProcessorFeaturePresent IsDebuggerPresent LoadLibraryA FreeLibrary RaiseException AreFileApisANSI HeapCreate WriteFile UnhandledExceptionFilter GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer TrySubmitThreadpoolCallback GetFullPathNameA InitializeSListHead SetEndOfFile SetUnhandledExceptionFilter HeapAlloc UnlockFileEx GetSystemTimeAsFileTime CloseHandle HeapFree CreateMutexW HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW GetProcessHeap LoadLibraryW CreateFileMappingW MapViewOfFile DuplicateHandle VirtualProtect OutputDebugStringW FlushViewOfFile CreateFileA RtlLookupFunctionEntry SetLastError WaitForSingleObjectEx CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP DeleteFileA MultiByteToWideChar WriteConsoleW ReadFileEx SleepEx WriteFileEx GetNativeSystemInfo HeapCompact HeapDestroy UnlockFile GetFileSize GetSystemTime SetHandleInformation FormatMessageA GetTickCount LoadLibraryExA GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx GetBinaryTypeW CreateDirectoryW ExitProcess CancelIo ReadFile CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW GetTempPathW DeleteFileW GetFinalPathNameByHandleW CopyFileExW MoveFileExW FindNextFileW

advapi32

OpenProcessToken RegCreateKeyTransactedW CredDeleteW CredWriteW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyExW CredReadW RegOpenKeyTransactedW GetTokenInformation CredFree SystemFunction036 RegCloseKey

oleaut32

SafeArrayCreateVector VariantClear SysAllocStringLen SetErrorInfo GetErrorInfo SafeArrayPutElement SysFreeString SysStringLen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

user32

SetWindowPlacement CountClipboardFormats SetWindowLongPtrW TrackPopupMenuEx GetWindowPlacement TrackMouseEvent ToUnicode GetKeyboardState GetActiveWindow MessageBeep DestroyMenu GetPointerType ReleaseCapture SetCapture GetFocus ValidateRect GetCapture GetKeyState WindowFromPoint CreatePopupMenu AppendMenuW SetMenuItemInfoW KillTimer SetCursor SetTimer GetDoubleClickTime ScreenToClient GetRawInputData SetWindowPos GetSystemMetrics SetProcessDpiAwarenessContext UnregisterSuspendResumeNotification SystemParametersInfoW RegisterHotKey FlashWindowEx MessageBoxW TranslateMessage SendInput GetWindowLongPtrW SendMessageW ChangeWindowMessageFilterEx CreateIcon CreateWindowExW SetWindowTextW MapVirtualKeyW RegisterSuspendResumeNotification PeekMessageW SetFocus SetActiveWindow GetSystemMetricsForDpi DefWindowProcW CallWindowProcW SetLayeredWindowAttributes InvalidateRect SetPropW GetDpiForWindow IsIconic RemovePropW GetClientRect GetWindowRect IsWindowEnabled EnableWindow MonitorFromPoint SetClipboardData EmptyClipboard RegisterClipboardFormatW GetClipboardOwner OpenClipboard CloseClipboard PostQuitMessage GetClipboardData GetClipboardFormatNameW EnumClipboardFormats RemoveClipboardFormatListener PostMessageW AddClipboardFormatListener EnumDisplaySettingsW SetWinEventHook UnhookWinEvent DispatchMessageW GetMessageW RegisterRawInputDevices UnregisterHotKey GetWindow IsWindowVisible EnumWindows GetClassNameW GetAncestor GetClipboardSequenceNumber MonitorFromWindow GetAsyncKeyState IsWindow GetMonitorInfoW EnumDisplayMonitors SetWindowRgn LoadImageW IsZoomed DestroyWindow GetForegroundWindow RedrawWindow SetForegroundWindow ShowWindowAsync GetCursorPos ClientToScreen RegisterWindowMessageA TrackPopupMenu GetKeyboardLayoutNameW GetWindowThreadProcessId GetPropW DestroyIcon RegisterClassW

bcryptprimitives

ProcessPrng

ws2_32

bind recv sendto getaddrinfo send recvfrom getsockname connect select WSAStartup WSACleanup closesocket WSAGetLastError setsockopt ioctlsocket WSASocketW getsockopt getpeername WSADuplicateSocketW accept WSARecv listen freeaddrinfo WSASend

bcrypt

BCryptGenRandom

shell32

ShellExecuteW Shell_NotifyIconGetRect SHGetKnownFolderPath DragQueryFileW SHGetDesktopFolder SHOpenFolderAndSelectItems SHCreateItemFromParsingName Shell_NotifyIconW SetCurrentProcessExplicitAppUserModelID

dwmapi

DwmFlush DwmGetCompositionTimingInfo DwmSetWindowAttribute

psapi

GetProcessMemoryInfo EmptyWorkingSet

imm32

ImmGetCompositionStringW ImmNotifyIME ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmAssociateContextEx

ole32

CoInitializeEx CoCreateInstance CoUninitialize RevokeDragDrop OleInitialize RegisterDragDrop CreateStreamOnHGlobal DoDragDrop PropVariantClear ReleaseStgMedium OleUninitialize CoInitialize

dwrite

DWriteCreateFactory

comctl32

GetWindowSubclass RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect DefSubclassProc

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtWriteFile RtlGetVersion NtCreateNamedPipeFile

windowscodecs

WICConvertBitmapSource

dxgi

CreateDXGIFactory2 CreateDXGIFactory1

d3d11

D3D11CreateDevice

combase

CoTaskMemFree CoIncrementMTAUsage CoCreateFreeThreadedMarshaler

gdi32

GetDIBits DeleteDC CreateEllipticRgn DeleteObject CreateCompatibleDC CreateDIBSection GetObjectW CreateSolidBrush

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

crypt32

CryptUnprotectData CryptProtectData

uiautomationcore

UiaHostProviderFromHwnd UiaLookupId UiaRaiseAutomationPropertyChangedEvent UiaRaiseAutomationEvent UiaReturnRawElementProvider UiaGetReservedMixedAttributeValue UiaGetReservedNotSupportedValue

winmm

timeEndPeriod timeBeginPeriod

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

dcomp

DCompositionCreateDevice

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

icuuc

u_strlen

gdiplus

GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipGetImageThumbnail GdipCreateBitmapFromStream GdiplusStartup GdiplusShutdown

vcruntime140

memcpy strchr strrchr memmove __C_specific_handler memset memcmp __current_exception_context __current_exception memchr __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

tan acos log2 atan2f ceil log2f floor round _hypotf exp2 tanf sinf fmodf log roundf exp floorf cbrtf cosf powf logf acosf atan2 ceilf cos pow sin fmod expf __setusermatherr asinf truncf

api-ms-win-crt-string-l1-1-0

strlen strcspn strncmp strspn strcmp wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm terminate _initialize_narrow_environment _configure_narrow_argv _initterm_e exit _set_app_type _seh_filter_exe _crt_atexit _endthreadex _exit strerror _beginthreadex _register_onexit_function _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _get_initial_narrow_environment

api-ms-win-crt-heap-l1-1-0

malloc free _msize realloc _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

27.6MB

Virtual Size

27.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17.0MB

Virtual Size

17.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

206KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

311KB

Virtual Size

311KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

117KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

uninstall.exe

IMPHASH 9dda1a1d1f8a1d13ae0297b47046b26e
SHA256 2f24dcdd9485a4e6f39e6ddcd25981b9d6bc303f4c48b9b683f469c655a6b684
MD5 03888f66e9806cecd18fc0c630849b1e
SHA1 0f2f7c95e863ca96acc17f04ff27c42a9be7556a
SHA512 9e2aa29b841db5bd72612e392c4e01c92473c7e881f3073cbd297b5eca7e7cdf22c3d18cc7b9a8c96de666b148306f44427ae5e9d8d9524cba582d39c1234834
SSDEEP 12288:vnPdU1QNTj1vClJNFGkyauGpFu3RdYcdUrsePR7pfXLTJgKlEalTXDsSLic8jXxq:fPdfCljFRrK3RdYeUrtNXLlp+aJXtd8I
TLSH
T1EBF423A4A634C453CD2777308D3A977A8F74AA65201D23071F60DF96ADAB9D00D387E7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13893

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

$PLUGINSDIR/LangDLL.dll

IMPHASH fe3375e7e4529b73ba45ab2246b9269b
SHA256 32230128c18574c1e860dfe4b17fe0334f685740e27bc182e0d525a8948c9c2e
MD5 50016010fb0d8db2bc4cd258ceb43be5
SHA1 44ba95ee12e69da72478cf358c93533a9c7a01dc
SHA512 ed4cf49f756fbf673449dca20e63dce6d3a612b61f294efc9c3ccebeffa6a1372667932468816d3a7afdb7e5a652760689d8c6d3f331cedee7247404c879a233
SSDEEP 48:S46+/pTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8m/ofjLl:zbuPbO5tCZBVEAWyMEFv2CmCL
TLSH
T113C18370F3D248B9C5D1413778A732D36612AE74A784504F9B6315AA3820AE7AD3EBC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 9111099efe9d5c9b391dc132b2faf0a3851a760d4106d5368e30ac744eb42706
MD5 4add245d4ba34b04f213409bfe504c07
SHA1 ef756d6581d70e87d58cc4982e3f4d18e0ea5b09
SHA512 1bd260cabe5ea3cefbbc675162f30092ab157893510f45a1b571489e03ebb2903c55f64f89812754d3fe03c8f10012b8078d1261a7e73ac1f87c82f714bce03d
SSDEEP 192:VjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZv0QPi:B/Qlt7wiij/lMRv/9V4bvr
TLSH
T188426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DBA879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 3d02628e8a8651e903e8432db76ebaca
SHA256 0eed48313a7f904d7cc1977b70000ab3f11f18cadc8e6a69b807d288ca71f9db
MD5 1e38f56aba852b737f2866c48b823165
SHA1 53a7cfaeb6a4a9653d6d5fbff02a3c3b8720130a
SHA512 5cbf6ca67aee29f5afbbaf57a72eb58e8f85b692e69aa5acd5817b00dc6948486189a8e74f4fcae302e9c453cc770eef78b3ffa70a914d911246e5b4992fc9a4
SSDEEP 24576:wSi9LsLAEnNUYZbeC4JwA9HU7Ncot2O/rBWDTRYQn652FOVE5TmcnlgVIH06iyQ:di9Y/W07NP/eTRPLD1n2IU6i3
TLSH
T1E545AD81FAC29AB1C94F1674105FE33BAB3558084756CFE3D7809E31F8673A25DA929C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

537086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

SystemFunction036

kernel32

user32

ShowWindow CreateWindowExW FindWindowExW SetWindowPos SetWindowTextW SendMessageW GetWindowLongW

ws2_32

ntdll

RtlNtStatusToDosError NtWriteFile

bcrypt

BCryptGenRandom

vcruntime140.dll

IMPHASH 6b799efc51fdd03aa3707013f22955b8
SHA256 d5e4d9a3e835fa679450145d6a7d94e36573a509317111904d9b3712c30d9066
MD5 6ca4edb2b52ec46c7fca3fd372ca6c00
SHA1 3d2998a27d164dd7cc3bc7d3eca08acf89a0ee42
SHA512 bda93ff2c306c82f1942ebd538f5c77ba593e3e20792159b2a2f5ebd086c524f6c6bd3de5ad722c71ff7d832d0149608289929e9b23f7858ebb960dbb3422f5f
SSDEEP 3072:ltkenID0f6aifkHWBXjG/Iuecbfmg4DCUil:YWSIHWBXjGlecbfYmN
TLSH
T1E4C36C42B2B401FBD16ED174C2A6AE23FB76B84547209BDF07A58A640F53BE06D3D345
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2025

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Digest

16:1c:67:8a:c5:2f:a0:39:a4:a9:0f:75:90:8c:e8:cb:7d:a9:39:8b:9d:1e:9f:21:df:a7:31:d7:8e:36:45:9a

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 10, 2025

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:0d:c4:e7:bb:f4:af:f8:f0:90:00:00:00:00:01:0d

Issuer

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:14:9d:fb:c3:1f:1f:63:c3:10:00:00:00:00:00:14

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

May 1, 2013 - May 1, 2028

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 30, 2021 - Sep 30, 2030

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:04:7f:2f:42:2a:73:53:08:de:ea:00:00:00:00:04:7f

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

May 15, 2025 - May 15, 2026

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

61:0e:90:d2:00:00:00:00:00:03

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Jul 8, 2011 - Jul 8, 2026

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:651A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:01:f5:99:09:94:bc:f1:c6:50:8c:00:01:00:00:01:f5

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 25, 2024 - Oct 22, 2025

Minor OS version

Major OS version

Entry point

66448

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\binaries\amd64ret\bin\amd64\\vcruntime140.amd64.pdb

_CreateFrameInfo _CxxThrowException _FindAndUnlinkFrame _IsExceptionObjectToBeDestroyed _SetWinRTOutOfMemoryExceptionCallback __AdjustPointer __BuildCatchObject __BuildCatchObjectHelper __C_specific_handler __C_specific_handler_noexcept __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxFrameHandler2 __CxxFrameHandler3 __CxxQueryExceptionSize __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __FrameUnwindFilter __GetPlatformExceptionInfo __NLG_Dispatch2 __NLG_Return2 __RTCastToVoid __RTDynamicCast __RTtypeid __TypeMatch __current_exception __current_exception_context __intrinsic_setjmp __intrinsic_setjmpex __processing_throw __report_gsfailure __std_exception_copy __std_exception_destroy __std_terminate __std_type_info_compare __std_type_info_destroy_list __std_type_info_hash __std_type_info_name __telemetry_main_invoke_trigger __telemetry_main_return_trigger __unDName __unDNameEx __uncaught_exception __uncaught_exceptions __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_InitializeCriticalSectionEx __vcrt_LoadLibraryExW _get_purecall_handler _get_unexpected _is_exception_typeof _local_unwind _purecall _set_purecall_handler _set_se_translator longjmp memchr memcmp memcpy memmove memset set_unexpected strchr strrchr strstr unexpected wcschr wcsrchr wcsstr

Name

.text

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

504B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

976B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1143a96dba9d7390026666f1a69eacabc89805c4e1effac407ca14fb4529e8c0

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/ApplicationID.dll

kernel32

shell32

ole32

shlwapi

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

advapi32

kernel32

user32

ws2_32

ntdll

bcrypt

generic

QcClip.exe

kernel32

advapi32

oleaut32

api-ms-win-core-synch-l1-2-0

user32

bcryptprimitives

ws2_32

bcrypt

shell32

dwmapi

psapi

imm32

ole32

dwrite

comctl32

ntdll

windowscodecs

dxgi

d3d11

combase

gdi32

api-ms-win-shcore-scaling-l1-1-1

crypt32

uiautomationcore

winmm

api-ms-win-core-winrt-error-l1-1-0

dcomp

api-ms-win-core-winrt-l1-1-0

icuuc

gdiplus