Suspicious ^80% windows Download

AurelioAvila.PCTweaker

Unsigned, high-entropy overlay, many imports

CreateProcessW API symbolNullsoft NSIS installer marker

SHA-2563cece7ea6a98955392b4791a75e0bb37321325f003bb83fcff6991d3f2d4e3a9

URLhttps://github.com/AurelioAvila/pc-tweaker-app/releases/download/v1.4.1/pc-tweaker-app_1.4.1_x64-setup.exe

MaleculeO₃(AsC₂Dy)H₅(CmF₉Os₅Po₃U)Md₃(Bi₅PaSi)

Evidence

English function-word token "this" 0x0–0xb0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows

NSIS self-extracting installer 0x25c4–0x2694

⋯3 more rows
0x25f42f00008b45d8a9f0ffffff757c817ddc/...E......u|.}.
0x2604efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x26147de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x2624580945088b45088b0df08e410083e002X.E..E.....A....
⋯7 more rows

ShellExecuteEx API call 0x7438–0x7608

⋯3 more rows
0x74687565727956616c756545785700000502ueryValueExW....
0x747852656753657456616c75654578570000RegSetValueExW..
0x7488cb01526567436c6f73654b657900d901..RegCloseKey...
⋯13 more rows
0x7568bd0053484765745061746846726f6d49..SHGetPathFromI
0x7578444c6973745700000a015368656c6c45DListW....ShellE
0x7588786563757465457857005348454c4c33xecuteExW.SHELL3
0x7598322e646c6c006500436f5461736b4d652.dll.e.CoTaskMe
⋯7 more rows

Clears the clipboard to take ownership 0x78f4–0x7a04

⋯5 more rows
0x794465004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7954726400004a02536574436c6970626f61rd..J.SetClipboa
0x79647264446174610000c100456d70747943rdData....EmptyC
0x79746c6970626f6172640000f6014f70656elipboard....Open
0x7984436c6970626f61726400a40254726163Clipboard...Trac
0x79946b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows

Modify file creation/access/write times 0x7c06–0x7ef6

⋯3 more rows
0x7c363400436c6f736548616e646c65001f034.CloseHandle...
0x7c4653657446696c6554696d65003900436fSetFileTime.9.Co
0x7c566d7061726546696c6554696d6500dc02mpareFileTime...
⋯8 more rows
0x7ce6735700005603536c65657000df014765sW..V.Sleep...Ge
0x7cf6745469636b436f756e74000056004372tTickCount..V.Cr
0x7d066561746546696c655700630147657446eateFileW.c.GetF
0x7d16696c6553697a650071014765744c6173ileSize.q.GetLas
⋯7 more rows
0x7d9677734469726563746f7279570000d601wsDirectoryW....
0x7da647657454656d70506174685700001101GetTempPathW....
0x7db6476574436f6d6d616e644c696e655700GetCommandLineW.
⋯12 more rows
0x7e86726563746f7279570000c3036c737472rectoryW....lstr
0x7e96636d70694100d40147657454656d7046cmpiA...GetTempF
0x7ea6696c654e616d65570000a40357726974ileNameW....Writ
0x7eb66546696c6500c6036c73747263707941eFile...lstrcpyA
⋯4 more rows