Benign windows Download

Softplicity.TotalThunderbirdConverter

Signed legitimate installer

Innoextract found setup loader checksum mismatchInnoextract found unexpected setup loader revision

SHA-256e086e97cd61fb75368ad2196f3a9cc1dda1187838274a05c715f48df39703372

URLhttps://www.coolutils.com/Downloads/TotalThunderbirdConverter.exe

MaleculeK(Te)O₂(Dy₂Pr)H₈(CmCr₂Db₃F₃Mg₂Os₉Po₄U)Md₃(Bi₇PaSi₃)

Evidence

Borland locales registry key 0xb73c–0xb80c

⋯3 more rows
0xb76c4c006f00630061006c00650073000000L.o.c.a.l.e.s...
0xb77c53006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb78c5c0042006f0072006c0061006e006400\.B.o.r.l.a.n.d.
0xb79c5c004c006f00630061006c0065007300\.L.o.c.a.l.e.s.
⋯7 more rows

Disk free space query 0x2332f–0x233ef

⋯3 more rows
0x2335f002e0064006c006c0000000000470065...d.l.l.....G.e
0x2336f0074004400690073006b004600720065.t.D.i.s.k.F.r.e
0x2337f00650053007000610063006500450078.e.S.p.a.c.e.E.x
⋯7 more rows

ChaCha20 cipher algorithm reference 0x25da8–0x25e68

⋯3 more rows
0x25dd8490073005c0069007300730072006300I.s.\.i.s.s.r.c.
0x25de82d006200750069006c0064005c004300-.b.u.i.l.d.\.C.
0x25df86f006d0070006f006e0065006e007400o.m.p.o.n.e.n.t.
⋯7 more rows

GetMethods member-name token 0x3ca94–0x3cb54

⋯3 more rows
0x3cac4414e616d650200020035009c4f45000aAName....5..OE..
0x3cad44765744d6574686f6473030030234400GetMethods..0#D.
0x3cae408000208dcd9430000000453656c6602......C....Self.
⋯7 more rows

References the GetMethod member name 0x3cb73–0x3cc33

⋯3 more rows
0x3cba3440001000101020002003800744f4500D.........8.tOE.
0x3cbb3094765744d6574686f64030054fc4300.GetMethod..T.C.
0x3cbc308000208dcd9430000000453656c6602......C....Self.
⋯7 more rows