talktome_bridge_windows_x64_v1[.]6[.]1_setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
talktome_bridge_windows_x64_v1.6.1_setup.exe
Size 7.9MB
Sample261110-m6bjfaas2w
SHA256 7268a4a75b6d84d9c7e1b8b90ecfe0605b9839b1df12e66db44e88558d38bd6b
MD5 13a15d59b4dce168c73f60c158b9943d
SHA1 92e22b73c24359acbb38cf29555cc7a141281d9f
SHA512 c4f00a87dcf6e693b7856579fadcbf5190ed61e86e13fbd47d372906f39bf6d2ddc81383f9f6d4e152d51ee8b7bd34acb65bb3dc3b8967c3ee017a336f5a31e4
SSDEEP 196608:M5RP3Yzo4KHQibkjZ4WL/F48o17AsN8GkA8ZQuFQ:MnP3YlKQ0GZDLe88Pnui
TLSH
T13C86333C6AA04228EBB30C337D56C79ACCCDA0ACD4BC5A067B993F4564670D76B4BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 10 IoCs

Checks for missing Authenticode signature.

resource
talktome_bridge_windows_x64_v1.6.1_setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/ffmpeg.exe
unpack001/omt/libomt.dll
unpack001/omt/libvmx.dll
unpack001/talktome-bridge-client.exe

File Explorer

talktome_bridge_windows_x64_v1.6.1_setup.exe

.exe 7.9MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
ffmpeg.exe

.exe 6.7MB
licenses/OpenH264-Rust.txt

1KB
licenses/OpenH264.txt

1KB
omt/.gitignore

16B
omt/LICENSE-OMT.txt

1KB
omt/libomt.dll

.dll 6.6MB
omt/libvmx.dll

.dll 530KB
omt/runtime.json

308B
talktome-bridge-client.exe

.exe 13.0MB

talktome_bridge_windows_x64_v1.6.1_setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 7268a4a75b6d84d9c7e1b8b90ecfe0605b9839b1df12e66db44e88558d38bd6b
MD5 13a15d59b4dce168c73f60c158b9943d
SHA1 92e22b73c24359acbb38cf29555cc7a141281d9f
SHA512 c4f00a87dcf6e693b7856579fadcbf5190ed61e86e13fbd47d372906f39bf6d2ddc81383f9f6d4e152d51ee8b7bd34acb65bb3dc3b8967c3ee017a336f5a31e4
SSDEEP 196608:M5RP3Yzo4KHQibkjZ4WL/F48o17AsN8GkA8ZQuFQ:MnP3YlKQ0GZDLe88Pnui
TLSH
T13C86333C6AA04228EBB30C337D56C79ACCCDA0ACD4BC5A067B993F4564670D76B4BD46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 d3e61c4df837625ac0503cea5b6765a04d37fc35399899a5503b53a3108bfbf6
MD5 7c8182ee99c93fc3a1bc41a52f5007ca
SHA1 05e9155694fcb8eb928632265199a4c8b315021f
SHA512 c1d4e5f86656b945442bae1386081d8ed225b6cea8161e1d061382fff58fc77261b88fce74a4292269ee8ea5ef4c032eee700b0dce48bb35c419a5cb9317c79e
SSDEEP 384:8rSQMCOUILnCaSPy/yhJzmGSMRWyOUKi0:8rSQMCOp0yamMRWysi0
TLSH
T14C623D16B62084F5CBB2167034D73B3E6BB28F6A292848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 39870682e7d1c026cd2b33ca25591db28250dde17de7eb1feec404222d534ffc
MD5 128e19d3f6bc32de40ee88a431cd4a5b
SHA1 44cdb6a3bb285d6502888bc4aaa6fa951b059d1c
SHA512 109d164db47ae525ad9361a28e9b3265977cfefef6504d456c8e0272f4b2ff70c534bbb5404ba7048a6895441b7a49012ab82a62785ec9ac45c24c6f2acaa135
SSDEEP 96:8It3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/d3lkCTcaqHCI:thE+A0+sF6piUFkABlncviI
TLSH
T1D8F1B776F3D20673F9AB437428632F231B2AF521576981A6490316CE7A61DA3FE34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
MD5 564e01f2c6edfb8475573e1b809cb5eb
SHA1 5d767e8f685449d86cd8d16c83a814ef8f7d6264
SHA512 67486f8e996b29688cfb5a57ae4a7604fa0892ba0eeccdd55f514ca4bd9b79a6fe42bfab4fc85156c2258ae66539bdd9bb36a8b5f7f944f3007c2421f244c95c
SSDEEP 192:rjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ80QPi:X/Qlt7wiij/lMRv/9V4b8r
TLSH
T1FD426C1297B089F2F551493419667F2A6FBEAC5D27F405A3CFE304C63D212DB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
MD5 79c27de4d1c6d295fefaa70f608f1c67
SHA1 feba90c93db3fedd450a81eb2603f793332d1a83
SHA512 fbd79f3946032821584ea2fa4b559ac5809ab45fdc9107eb47c9ff3fa3229d7748a7b2ed588709e59cce16a4f8e58ed98b46cb061acf1080e78434d184f51ec7
SSDEEP 96:oQEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YbNqkzfFc:oQEvCu5e81785qHFcU0PuAw0uyBIFc
TLSH
T1E612E892A2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

ffmpeg.exe

IMPHASH c410362a30257f09dc4a2f1b6759d54c
SHA256 548c629e9249a5d449b167836ad2bee1c6677879f3bdcfc3fa7da732cc9f2a4f
MD5 81c9e7d4b79da41f95c9166f51bf15f2
SHA1 14271377aa9aee42a99c3dcdd814406217df20ee
SHA512 29c6e6cc53bff3fe4bd831ce5911c11d4a10175970da4d0d3dad4a0f3faa94b03d36188189b950fd9f696e1c4bde3d691edfccfe6df15b05655167dda5151e8a
SSDEEP 49152:tjNN307EWQvsKrvlAng1suaZTatxsS56NVNL+D5im3IH+O80vXiygO76LJ0gl3eh:5NN3oE/vLA0suaZTat7RsvP1A2rz5
TLSH
T10B666BCEE1E365ECC627D530527EAB63FA24341C11642D7A53A1CA306E63FC05F1AE69
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive CancelIoEx CloseHandle CreateEventA CreateEventW CreateMutexA CreateMutexW CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FileTimeToSystemTime GetCommandLineW GetConsoleMode GetConsoleScreenBufferInfo GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFullPathNameW GetHandleInformation GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessTimes GetStdHandle GetSystemTimeAdjustment GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation InitOnceBeginInitialize InitOnceComplete InitializeConditionVariable InitializeCriticalSection InitializeSRWLock IsDBCSLeadByteEx IsProcessorFeaturePresent K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryW LocalFree MoveFileExA MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore ResetEvent ResumeThread SetConsoleCtrlHandler SetConsoleTextAttribute SetDllDirectoryA SetEvent SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW

msvcrt

_XcptFilter ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _assert _beginthreadex _cexit _close _commode _dup _endthreadex _errno _exit _fdopen _fmode _fpreset _fstat64 _getch _gmtime64 _hypot _initterm _isatty _kbhit _localtime64 _lock _lseeki64 _mkdir _mktime64 _read _rmdir _setjmp _setmode _sopen _strdup _strtoi64 _strtoui64 _time32 _time64 _unlink _unlock _vscprintf _vsnprintf _waccess _wcsdup _wfopen atexit _wgetenv _wmkdir _write _wrmdir _wsopen _wunlink abort acos asin atan atoi bsearch calloc clock cosh exit fclose fflush fgets fopen fprintf fputc fputs fread free fwrite getchar getenv isdigit isspace getc isxdigit ldexp localeconv log10 longjmp malloc memchr memcmp memcpy memmove memset perror putchar puts qsort realloc rand setvbuf signal sinh strchr strcmp strcpy strcspn strerror strftime strlen strncmp strpbrk strrchr strspn strstr strtok strtol strtoul tan tanh tolower vfprintf ungetc wcscat wcscmp wcscpy wcscpy_s wcslen

ole32

CoCreateInstance CoGetMalloc CoInitialize CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleLoadFromStream OleSaveToStream

oleaut32

OleCreatePropertyFrame

shell32

CommandLineToArgvW

shlwapi

SHCreateStreamOnFileA

ws2_32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getnameinfo getsockname getsockopt htons ioctlsocket listen ntohl ntohs recvfrom select send sendto setsockopt shutdown socket

Name

.text

Size

5.6MB

Virtual Size

5.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

862KB

Virtual Size

861KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2.1MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

omt/libomt.dll

IMPHASH e13d0ebf9776747f0ef3e06ee91863db
SHA256 83830687a9eb79630af16f8b1cb1cd5b2f6c36423fa0bdfd40ec7f5ed90a448d
MD5 705cbae27c92b23b78276a11082d168f
SHA1 af40790a2fd5f7a5503cf5ddabafa5caa3c51411
SHA512 bf651e850f4193ee3845a456ace10ba94c2db156835553f85e0f854e7f2848f8437b5f53f07f8f5e867c90a15a0e946c616c6f5a773a32b003674c790cd5d3f1
SSDEEP 98304:+B7J2Y1ldhnrVmD+iL1Gk1dZmdwjlcDVpI67DV2rQR7mO:E7kQl7nZ++QB1LmdwjlcDVpI67DM0
TLSH
T1C0669D14A3A400A1E57BD734CA65D333CABCBCA25635C10F165DE2C62F73A628B6F725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

462884

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\OMT Projects\libomt\bin\Release\net8.0\win-x64\native\libomt.pdb

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegEnumValueW GetTokenInformation OpenThreadToken RevertToSelf ImpersonateLoggedOnUser

bcrypt

BCryptDestroyKey BCryptCloseAlgorithmProvider BCryptSetProperty BCryptOpenAlgorithmProvider BCryptImportKeyPair BCryptImportKey BCryptHashData BCryptGetProperty BCryptFinishHash BCryptExportKey BCryptDecrypt BCryptEncrypt BCryptCreateHash BCryptGenRandom BCryptDestroyHash

crypt32

CertFreeCertificateChainEngine CertCloseStore PFXImportCertStore PFXExportCertStore CryptFindOIDInfo CryptQueryObject CryptMsgGetParam CryptMsgClose CryptImportPublicKeyInfoEx2 CryptFormatObject CryptDecodeObject CertVerifyTimeValidity CertSetCertificateContextProperty CertSerializeCertificateStoreElement CertSaveStore CertOpenStore CertVerifyCertificateChainPolicy CertFreeCertificateContext CertEnumCertificatesInStore CertDuplicateCertificateContext CertGetCertificateContextProperty CertAddCertificateContextToStore CertAddCertificateLinkToStore CertControlStore CertCreateCertificateChainEngine CertFindCertificateInStore CertFindExtension CertFreeCertificateChain CertGetCertificateChain CertGetIntendedKeyUsage CertGetNameStringW CertGetValidUsages CertNameToStrW

iphlpapi

GetAdaptersAddresses GetPerAdapterInfo GetNetworkParams if_nametoindex

kernel32

InterlockedFlushSList RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter EncodePointer IsDebuggerPresent SetLastError FormatMessageW GetLastError GetCPInfoExW GetConsoleMode GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte K32EnumProcessModulesEx CloseHandle IsWow64Process GetExitCodeProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId DuplicateHandle GetCurrentProcess QueryPerformanceCounter GetTickCount64 LoadLibraryExW CancelIoEx CloseThreadpoolIo GetCurrentProcessId RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable InitializeCriticalSection InitializeConditionVariable CreateThreadpoolTimer SetThreadpoolTimer WaitForMultipleObjectsEx GetCurrentThreadId CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW GetCPInfo LocalAlloc GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CancelSynchronousIo CreateIoCompletionPort CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW OpenThread QueryUnbiasedInterruptTime SetFileInformationByHandle SetThreadErrorMode CreateThread ResumeThread GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW GetComputerNameExW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlLookupFunctionEntry InitializeSListHead

ncrypt

NCryptOpenKey NCryptDeleteKey NCryptOpenStorageProvider NCryptGetProperty NCryptSetProperty NCryptFreeObject NCryptImportKey

ole32

CoInitializeEx CoUninitialize CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoWaitForMultipleHandles CoTaskMemFree

user32

LoadStringW

ws2_32

WSARecv WSAConnect shutdown setsockopt sendto WSASend select recv listen ioctlsocket getsockopt getsockname send WSAGetOverlappedResult closesocket GetNameInfoW GetAddrInfoW FreeAddrInfoW WSASocketW GetAddrInfoExW WSAStartup WSACleanup FreeAddrInfoExW WSAEventSelect WSAIoctl bind getpeername

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh malloc

api-ms-win-crt-math-l1-1-0

fmod nan ceil cos floor pow sin tan modf

api-ms-win-crt-string-l1-1-0

strncpy_s strcpy_s wcsncmp strcmp _stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initterm_e _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _seh_filter_dll _cexit _configure_narrow_argv terminate abort _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vfprintf __acrt_iob_func

Name

.text

Size

479KB

Virtual Size

478KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

272KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

866B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

omt/libvmx.dll

IMPHASH 77cf80a39d57c629dd3bc3389476d795
SHA256 a33167041939bce24729343963ca8fca373b5878a36ea475a76c2393c48b70ce
MD5 6d95ec351901d1c78c26a04aef51a747
SHA1 f3a39be3f167c515d3ce598497f9680774a8945a
SHA512 fc2d52ca5a62f82444ccb73745f7ea31671b2cd3e10ec11126dad3a8bca80637cd4ec45b93e5e45a896aa9aa7169ca2a83d9c264154f83203a29587367b64667
SSDEEP 12288:3X9xvi3k1/NoBdWUeZPJNAW6XHiyEZAfyc9+oh44:3XbviENoBdWUkRlTc3
TLSH
T10BB46C07E1917698D117CE7981276B13F6333C195711B6EB4B88D6353E2ABF0A63EB80
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

302844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\OMT Projects\libvmx\x64\Release\libvmx.pdb

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW CreateThread DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileSizeEx GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetThreadLocale HeapAlloc HeapFree HeapQueryInformation HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter VirtualProtect WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

?VMX_BGRXToUYVY@@YAXPEAEH0HUVMX_SIZE@@@Z ?VMX_BGRXToUYVYConditional@@YAHPEAE0H0HUVMX_SIZE@@@Z ?VMX_CalculatePSNR@@YAMPEAE0HHUVMX_SIZE@@@Z ?VMX_Create@@YAPEAUVMX_INSTANCE@@UVMX_SIZE@@W4VMX_PROFILE@@W4VMX_COLORSPACE@@@Z ?VMX_DecodeBGRA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodeBGRX@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodeP216@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePA16@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePlane16@@YAXPEAUVMX_INSTANCE@@PEAUVMX_PLANE@@PEAUVMX_SLICE_SET@@@Z ?VMX_DecodePlane@@YAXPEAUVMX_INSTANCE@@PEAUVMX_PLANE@@PEAUVMX_SLICE_SET@@@Z ?VMX_DecodePlanePreview@@YAXPEAUVMX_INSTANCE@@PEAUVMX_PLANE@@PEAUVMX_SLICE_SET@@@Z ?VMX_DecodePreviewBGRA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePreviewBGRX@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePreviewUYVA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePreviewUYVY@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodePreviewYUY2@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodeUYVA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodeUYVY@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_DecodeYUY2@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_Destroy@@YAXPEAUVMX_INSTANCE@@@Z ?VMX_EncodeBGRA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodeBGRX@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodeNV12@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH1HH@Z ?VMX_EncodeP216@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodePA16@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodePlanar@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@H@Z ?VMX_EncodeUYVA@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodeUYVY@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodeYUY2@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEHH@Z ?VMX_EncodeYV12@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH1H1HH@Z ?VMX_GetEncodedPreviewLength@@YAHPEAUVMX_INSTANCE@@@Z ?VMX_GetEncodingParameters@@YAXPEAUVMX_INSTANCE@@PEAH111@Z ?VMX_GetQuality@@YAHPEAUVMX_INSTANCE@@@Z ?VMX_GetThreads@@YAHPEAUVMX_INSTANCE@@@Z ?VMX_LoadFrom@@YA?AW4VMX_ERR@@PEAUVMX_INSTANCE@@PEAEH@Z ?VMX_SaveTo@@YAHPEAUVMX_INSTANCE@@PEAEH@Z ?VMX_SetEncodingParameters@@YAXPEAUVMX_INSTANCE@@HHHH@Z ?VMX_SetQuality@@YAXPEAUVMX_INSTANCE@@H@Z ?VMX_SetThreads@@YAXPEAUVMX_INSTANCE@@H@Z ?VMX_Test@@YAHPEAUVMX_INSTANCE@@PEAF1@Z VMX_BGRXToUYVY VMX_BGRXToUYVYConditional VMX_CalculatePSNR VMX_Create VMX_DecodeBGRA VMX_DecodeBGRX VMX_DecodeP216 VMX_DecodePA16 VMX_DecodePreviewBGRA VMX_DecodePreviewBGRX VMX_DecodePreviewUYVA VMX_DecodePreviewUYVY VMX_DecodePreviewYUY2 VMX_DecodeUYVA VMX_DecodeUYVY VMX_DecodeYUY2 VMX_Destroy VMX_EncodeBGRA VMX_EncodeBGRX VMX_EncodeNV12 VMX_EncodeP216 VMX_EncodePA16 VMX_EncodeUYVA VMX_EncodeUYVY VMX_EncodeYUY2 VMX_EncodeYV12 VMX_GetEncodedPreviewLength VMX_GetEncodingParameters VMX_GetQuality VMX_GetThreads VMX_LoadFrom VMX_SaveTo VMX_SetEncodingParameters VMX_SetQuality VMX_SetThreads VMX_Test

Name

.text

Size

403KB

Virtual Size

403KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.trace

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

talktome-bridge-client.exe

IMPHASH 2e23c59dcd676b2c22a50f0f9484784a
SHA256 d33c5319a80ebd90a279d442f3f2727e2eba39112452bfe42b6066e657c91300
MD5 74f9e8333db35a39f08e6c3628c4e2d8
SHA1 176bad52383a255e58e994319127fe78ba2606b0
SHA512 b634e07d582c527288b5438d0b9d96d066f513fb91bde796fc01b3924dc9e4bd60aa616ffd08f37ade7792e98e19b67367a5fa8a46425a5bd3f0579d1b16ba62
SSDEEP 196608:+897k+wmWhDZVFUtdJjBPomeYYLSxgfZN2aH:XBk+wmWhDZVFUtdJlPPOLSxgfZN2aH
TLSH
T1EDD6F8213B5A98A8C05BC47483874AA25D7130DB0F35B9FF44D596392FBAAF52F38358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9464496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

talktome_bridge_client.pdb

kernel32

GetModuleHandleW WakeAllConditionVariable CreateMutexW ReleaseMutex SleepConditionVariableSRW GetSystemTimeAsFileTime CreateIoCompletionPort SetFileCompletionNotificationModes ReadFile GetOverlappedResult WriteFile PostQueuedCompletionStatus CancelIoEx GetQueuedCompletionStatusEx AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileAttributesW GetModuleFileNameW FreeLibrary GetFileInformationByHandle GetConsoleMode FlsGetValue RtlPcToFileHeader RaiseException CreateEventA CloseHandle SetHandleInformation LoadLibraryExW LoadLibraryW LoadLibraryA lstrlenW GetModuleHandleExW SetThreadErrorMode QueryPerformanceFrequency GetCurrentThreadId GetUserDefaultUILanguage Sleep GetModuleHandleA GetProcAddress GetLastError EncodePointer LCIDToLocaleName GetNativeSystemInfo GetSystemInfo SetNamedPipeHandleState CreateFileW OutputDebugStringA OutputDebugStringW QueryPerformanceCounter SetEvent WaitForSingleObject CreateThread GetCurrentThread CreateEventW WaitForMultipleObjectsEx HeapAlloc HeapFree GetProcessHeap FormatMessageW GetFullPathNameW LoadLibraryExA FlsSetValue IsThreadAFiber FlsAlloc FlsFree SetWaitableTimer GetTempPathW GetConsoleOutputCP WriteConsoleW RtlUnwindEx MultiByteToWideChar SetUnhandledExceptionFilter InitializeSListHead FindNextFileW CreateWaitableTimerExW InitializeCriticalSectionEx RtlVirtualUnwind GetEnvironmentVariableW InitializeCriticalSection SetEnvironmentVariableW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection CompareStringOrdinal FreeEnvironmentStringsW SetLastError SetFileInformationByHandle GetStdHandle GetCurrentProcess DuplicateHandle DeviceIoControl HeapReAlloc GetCurrentProcessId ReadFileEx GetFinalPathNameByHandleW SleepEx WriteFileEx CreateMutexA RtlCaptureContext RtlLookupFunctionEntry GetSystemTimePreciseAsFileTime SetFileTime GetFileInformationByHandleEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WaitForSingleObjectEx WideCharToMultiByte SwitchToThread TerminateProcess GetEnvironmentStringsW GetExitCodeProcess CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentDirectoryW GetCommandLineW FindFirstFileExW FindClose ExitProcess

advapi32

RegCreateKeyTransactedW RegOpenKeyTransactedW RegOpenKeyExW RegGetValueW RegQueryValueExW RegSetValueExW RegCreateKeyExW RegDeleteValueW RegCloseKey EventWriteTransfer EventSetInformation EventRegister SystemFunction036 EventUnregister

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile NtOpenFile RtlGetVersion NtDeviceIoControlFile NtCreateNamedPipeFile RtlNtStatusToDosError NtCancelIoFileEx NtCreateFile NtReadFile

ws2_32

WSAIoctl setsockopt shutdown WSASocketW bind sendto send recv connect ioctlsocket WSASend closesocket getsockopt WSAGetLastError getpeername getsockname WSAStartup freeaddrinfo getaddrinfo

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

GetTouchInputInfo CloseTouchInputHandle RegisterTouchWindow VkKeyScanW DrawTextW GetWindowDC OffsetRect GetMenuBarInfo DestroyMenu PostQuitMessage AppendMenuW InsertMenuW GetMessageA SetMenuItemInfoW CheckMenuItem RemoveMenu CreatePopupMenu CreateMenu DrawMenuBar SetMenu CreateAcceleratorTableW GetMenuItemInfoW DrawIconEx DestroyAcceleratorTable SetTimer KillTimer TrackPopupMenu ChangeWindowMessageFilterEx RegisterClassW TranslateMessage CreateIcon GetAsyncKeyState GetKeyboardState GetKeyState MapVirtualKeyExW ToUnicodeEx DispatchMessageA SystemParametersInfoA SetPropW SendInput SetForegroundWindow SetWindowTextW GetWindowTextW GetWindowTextLengthW DestroyWindow GetKeyboardLayout GetMenu IsWindowVisible TranslateAcceleratorW FindWindowW RegisterClassExW CreateWindowExW GetWindowThreadProcessId EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity ClipCursor GetClipCursor ShowCursor SetWindowLongW EnableMenuItem GetSystemMenu ReleaseCapture SetCapture MsgWaitForMultipleObjectsEx AllowSetForegroundWindow RegisterRawInputDevices SendMessageTimeoutW GetMessageW RegisterWindowMessageA GetWindow SetParent MapWindowPoints SetFocus ShowWindow GetWindowRect GetRawInputData FindWindowExW SetWindowRgn EnableWindow IsWindowEnabled DispatchMessageW ReleaseDC GetDC IsProcessDPIAware PostMessageW DestroyIcon GetIconInfo LoadImageW SetWindowLongPtrW GetWindowLongPtrW FlashWindowEx MapVirtualKeyW GetForegroundWindow GetActiveWindow UpdateWindow InvalidateRect SetCursorPos PostThreadMessageW GetParent GetMonitorInfoW MonitorFromWindow GetCursorPos SystemParametersInfoW MonitorFromRect TrackMouseEvent FillRect GetSystemMetrics ClientToScreen GetClientRect GetWindowLongW ScreenToClient AdjustWindowRectEx RedrawWindow GetUpdateRect ValidateRect IsIconic SendMessageW EnumChildWindows DefWindowProcW AdjustWindowRect SetCursor LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement PeekMessageW ChangeDisplaySettingsExW

ole32

CoInitialize OleInitialize RevokeDragDrop CoInitializeEx CoUninitialize RegisterDragDrop CoCreateInstance PropVariantClear StringFromIID

shell32

ShellExecuteW DragQueryFileW DragFinish ShellExecuteExW ILFree ILCreateFromPathW SHOpenFolderAndSelectItems SHGetKnownFolderPath SHAppBarMessage Shell_NotifyIconGetRect Shell_NotifyIconW SHGetStockIconInfo

gdi32

CreateSolidBrush CreateRectRgn DeleteObject DeleteDC SelectObject BitBlt GetDIBits CreateCompatibleDC GetDeviceCaps SetTextColor SetBkMode CombineRgn CreateDIBSection

shlwapi

SHCreateMemStream

comctl32

DefSubclassProc RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

combase

CoTaskMemFree CoTaskMemAlloc CoCreateFreeThreadedMarshaler

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

mmdevapi

ActivateAudioInterfaceAsync

oleaut32

SysFreeString SysStringLen GetErrorInfo SetErrorInfo

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

round __setusermatherr ceil log10 roundf powf log log10f sqrtf floor pow trunc

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp strcmp _wcsicmp strlen wcslen strncpy_s

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi wcstol

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh malloc free

api-ms-win-crt-runtime-l1-1-0

_set_app_type exit _get_initial_narrow_environment _seh_filter_exe _exit _configure_narrow_argv _initialize_narrow_environment __p___argc __p___argv _cexit _wassert _c_exit _register_thread_local_exe_atexit_callback abort terminate _crt_atexit _register_onexit_function _initterm _initialize_onexit_table _initterm_e

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf _set_fmode __stdio_common_vsnprintf_s __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

9.2MB

Virtual Size

9.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

522KB

Virtual Size

521KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

talktome_bridge_windows_x64_v1.6.1_setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

ffmpeg.exe

bcrypt

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

ws2_32

generic

licenses/OpenH264-Rust.txt

licenses/OpenH264.txt

omt/.gitignore

omt/LICENSE-OMT.txt

omt/libomt.dll

advapi32

bcrypt

crypt32

iphlpapi

kernel32

ncrypt

ole32

user32

ws2_32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic

omt/libvmx.dll

kernel32