AutoSubs-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
AutoSubs-windows-x86_64.exe
Size 65.3MB
Sample260701-e4lmmagt2x
SHA256 fdce7226b0514c85697f51374afb355a00591cc91a11b96146585d2f05ecd771
MD5 cec7164e3df70bdff0a2bdaf39e284c6
SHA1 5218918aa0604cb024bd521ca109babdd9250573
SHA512 0b70bd851e7209f076783ef8c97cf6755867e85170ef698b15f82cdf290a7a0843d7d633c7ceacce27360d1fe72a6d29fba215ea0fb8233d23e4a8a6181358fb
SSDEEP 1572864:7c+B92V5Wrk34Va4l8gixjZ4c6Ili9yoiwVj:7EXCFVa28giII+yoiwN
TLSH
T1EBE733905678F9AFFB34923046F0940B8F559F03DA9BDD2EE11A092E770E1C660578AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 5 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll

File Explorer

AutoSubs-windows-x86_64.exe

.exe 65.3MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
autosubs.exe

.exe 123.6MB
ffmpeg.exe

.exe 96.4MB
resources/AutoSubs (Dev).lua

2KB
resources/AutoSubs.lua

2KB
resources/AutoSubs/caption-bin.drb

.zip 23KB
MediaPool/Master/000_AutoSubs/MpFolder.xml

.xml 34KB
MediaPool/Master/MpFolder.xml

.xml 632B
project.xml

.xml 7KB
resources/com.autosubs.adobe/.debug

.xml 244B
resources/com.autosubs.adobe/CSXS/manifest.xml

.xml 1KB
resources/com.autosubs.adobe/assets/main-CFPuOZx_.css

3KB
resources/com.autosubs.adobe/assets/main-D2RE_pF2.cjs

.js 213KB
resources/com.autosubs.adobe/jsx/index.js

.js 42KB
resources/com.autosubs.adobe/main/index.html

.html .js 3KB
resources/com.autosubs.adobe/presets/WAV_48_kHz_16_bits.epr

.xml 131KB
resources/modules/autosubs_core.lua

.bat 73KB
resources/modules/dkjson.lua

.bat 22KB
resources/modules/font_fallback.lua

.bat 9KB
resources/modules/libavutil.lua

.js 9KB
resources/modules/ljsocket.lua

.js 37KB

AutoSubs-windows-x86_64.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 fdce7226b0514c85697f51374afb355a00591cc91a11b96146585d2f05ecd771
MD5 cec7164e3df70bdff0a2bdaf39e284c6
SHA1 5218918aa0604cb024bd521ca109babdd9250573
SHA512 0b70bd851e7209f076783ef8c97cf6755867e85170ef698b15f82cdf290a7a0843d7d633c7ceacce27360d1fe72a6d29fba215ea0fb8233d23e4a8a6181358fb
SSDEEP 1572864:7c+B92V5Wrk34Va4l8gixjZ4c6Ili9yoiwVj:7EXCFVa28giII+yoiwN
TLSH
T1EBE733905678F9AFFB34923046F0940B8F559F03DA9BDD2EE11A092E770E1C660578AF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

4a:e2:a6:ae:b5:97:1a:a6:bd:52:5c:80:08:7b:14:de:ce:6e:79:b6:a2:ac:5b:0c:42:3c:3e:c3:2f:d7:06:d0

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Chains

Jun 9, 2026

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Serial Number

3a:42:1b:92:83:b1:ca:f5:38:63:d9:94:13:02:bb:bd

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2026 - Apr 26, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/NSISdl.dll

IMPHASH ed06d61f6957c32cd324837726a5a070
SHA256 419485a096bc7d95f872ed1b9b7b5c537231183d710363beee4d235bb79dbe04
MD5 ee68463fed225c5c98d800bdbd205598
SHA1 306364af624de3028e2078c4d8c234fa497bd723
SHA512 b14fb74cb76b8f4e80fdd75b44adac3605883e2dcdb06b870811759d82fa2ec732cd63301f20a2168d7ad74510f62572818f90038f5116fe19c899eba68a5107
SSDEEP 384:7py18oahashajPmIYInUJggBOZgAHhUKijb:7py18oafmeggBOCAHpij
TLSH
T175622D45AA2084F1DBA2167034D73A7A67F18E752A2449C347F35D4EEE16307B33A986
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8905

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 80469f6834e579db68a646d49780b9d5
SHA256 42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7
MD5 d070f3275df715bf3708beff2c6c307d
SHA1 93d3725801e07303e9727c4369e19fd139e69023
SHA512 fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d
SSDEEP 96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI
TLSH
T1CCF1C7B6F3D10673F9AB427428232F221B1AF5215765C1AB450316CE7661CE3FD34B21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
TLSH
T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
TLSH
T17012F992E6A450B3C5D6533B35AA2F2DCBBD5325B0926C00C7738E4D39395B66E38353
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH e6c3208e90c430388b2da3b455c174ba
SHA256 3697d11bdbe1e34daa26b1e89d84276d9ff28148906943d0fe888354c3b13620
MD5 acde70f73d3b71b1c4222b763537780d
SHA1 b053b2e5fdb97257954c8f935d80964f056520ae
SHA512 598fc58a5f561e7995eccccb065faf2a2386bce0cfc4199fa95ba9fb74e9fcb291914676996c90728dd283223c2180de9fe073a4c936e60fbabe036d7e0a40de
SSDEEP 768:L8+c2MM0Hxd1fBTsRmMZdauVKAFKpnp0jdhK7R+qVQTxM:L8+DMfHPxAIMtXIVQTx
TLSH
T144F24A18FCC47EB6E6DF0570080D4A7E826FC8181B14CE9BD3A51EA2D5A63729EE501F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4250

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

autosubs.exe

IMPHASH 84871d2a75316f3534c267dc068f1b05
SHA256 ca76d1cdc9bc5bfccd96478b235a4bc6ef21e305596590a849787be33c043c37
MD5 09c81ad432987b94ea5c6d2eb8c1d824
SHA1 ca14112d5d3763417f95052a5a8b6ce99636965f
SHA512 34eb754c55c059f9f41b49d3d97fa1ea6d0878b76accc0ff70e06e30a7460a81cf3dccac530ed6aac1e02bd6c808e9316c44b4dcabe6b2cbbd5d2e0116b71ef1
SSDEEP 786432:0pLNgG+b0LFtqAn9zXPskGmnvRv3febYvYBeCR1vedTNzmuO1p4Dr4uBS:Yn+bkqA97P9vtPebYvkeCrvGvg
TLSH
T101584C11FAF64F27E82A863D82F76221BA38F09D5723DB571118B5383F567701EA6318
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

0f:4c:f9:d2:55:d9:b1:f1:35:ae:56:be:a0:0f:85:2e:aa:8a:a7:c1:ba:43:c2:27:1a:61:57:84:a5:61:a9:4d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Chains

Jun 9, 2026

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Serial Number

3a:42:1b:92:83:b1:ca:f5:38:63:d9:94:13:02:bb:bd

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2026 - Apr 26, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

34264788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

autosubs.pdb

kernel32

InitOnceComplete SetUnhandledExceptionFilter GetLastError CreateMutexW AttachConsole LCIDToLocaleName GetUserDefaultUILanguage InitOnceBeginInitialize GetCurrentThreadId ReleaseMutex GetModuleHandleW AreFileApisANSI GetFileAttributesExW CloseHandle GetLocaleInfoEx TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent DeleteCriticalSection GetSystemTimeAsFileTime InitializeSListHead EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx UnhandledExceptionFilter CreateFileW GetQueuedCompletionStatusEx CancelIoEx ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeConditionVariable WakeConditionVariable SetFileCompletionNotificationModes RtlVirtualUnwind UnlockFile MoveFileExW InitializeSRWLock WriteFile PostQueuedCompletionStatus GetOverlappedResult RegisterWaitForSingleObject UnregisterWaitEx LockFileEx SleepConditionVariableSRW DuplicateHandle OutputDebugStringA ReleaseSRWLockShared AcquireSRWLockShared WakeAllConditionVariable CreateThread LoadLibraryExA GlobalFree SetThreadPriority FormatMessageW SetThreadInformation CreateIoCompletionPort GlobalSize SetThreadAffinityMask GetMaximumProcessorCount GetMaximumProcessorGroupCount GetProcessHeap HeapFree HeapAlloc SetHandleInformation GetEnvironmentVariableA RtlCaptureStackBackTrace GetComputerNameExW GetCurrentDirectoryW LoadLibraryW VirtualFree GetFileInformationByHandleEx GlobalMemoryStatusEx GetNativeSystemInfo GetSystemInfo VirtualAlloc GetSystemTimePreciseAsFileTime VerSetConditionMask QueryPerformanceFrequency RtlLookupFunctionEntry GetUserPreferredUILanguages RtlCaptureContext VerifyVersionInfoW GetConsoleMode TerminateProcess MultiByteToWideChar WideCharToMultiByte CreateDirectoryA QueryPerformanceCounter CreateDirectoryW LocalFree GetProcessId GetExitCodeProcess DeleteFileW FindClose WriteFileEx CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW InitOnceExecuteOnce CreateEventW FindFirstFileW SleepEx ReadFileEx WaitForMultipleObjects SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW FindNextFileW CancelIo lstrlenW ExitProcess GetTempPathW SetEnvironmentVariableW GetFileType GetFileInformationByHandle FindFirstFileExW SwitchToThread GlobalUnlock GetFileAttributesA GetFileAttributesW DeviceIoControl GetFileSizeEx CreateSymbolicLinkW CopyFileExW GlobalAlloc GetCommandLineW GetEnvironmentStringsW SetThreadStackGuarantee AddVectoredExceptionHandler SetNamedPipeHandleState CreatePipe GetFinalPathNameByHandleW ReadFile RemoveDirectoryW GetStdHandle GlobalLock SetFileTime SetFilePointerEx SetFileInformationByHandle LoadLibraryA CreateMutexA GetCurrentProcessorNumber HeapReAlloc GetEnvironmentVariableW CreateFile2 IsDebuggerPresent DebugBreak CreateSemaphoreExW OutputDebugStringW SetLastError WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId GetCurrentThread GetLogicalProcessorInformationEx CreateFileMappingW MapViewOfFile UnmapViewOfFile FreeLibrary GetModuleFileNameA GetModuleFileNameW GetProcAddress GetModuleHandleA GetLogicalProcessorInformation GetModuleHandleExW LoadLibraryExW SetThreadGroupAffinity FormatMessageA ReleaseSemaphore WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW GetFullPathNameW

bcryptprimitives

ProcessPrng

advapi32

RegQueryValueExW RegGetValueW CryptDestroyKey CryptAcquireContextW RegOpenKeyExW RegCloseKey RegCreateKeyTransactedW RegCreateKeyExW RegOpenKeyExA RegQueryValueExA CryptImportKey ImpersonateAnonymousToken RevertToSelf SystemFunction036 RegOpenKeyTransactedW CryptReleaseContext EventRegister EventSetInformation EventWriteTransfer OpenSCManagerW EnumServicesStatusExW CloseServiceHandle EventUnregister

oleaut32

SetErrorInfo GetErrorInfo SysStringLen SysFreeString

ntdll

NtCreateFile RtlGetVersion NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError NtDeviceIoControlFile NtWriteFile NtCancelIoFileEx

ws2_32

socket WSAGetLastError WSASend closesocket shutdown listen bind WSASocketW WSAIoctl connect ioctlsocket setsockopt accept getsockopt getpeername getsockname send recv freeaddrinfo getaddrinfo select WSAStartup WSACleanup

user32

RegisterClipboardFormatW SetWindowRgn FindWindowExW GetParent GetWindowRect IsWindowEnabled EnableWindow IsProcessDPIAware ShowWindow SetFocus GetWindow MapWindowPoints SetParent RegisterWindowMessageA MsgWaitForMultipleObjectsEx SetCapture ReleaseCapture RegisterRawInputDevices ReleaseDC MonitorFromPoint EnumDisplayMonitors IsWindowVisible GetClipCursor ClipCursor ShowCursor GetMenu DestroyIcon SetForegroundWindow SendInput SetWindowDisplayAffinity GetWindowTextLengthW GetWindowTextW SetWindowTextW GetRawInputData GetSystemMenu EnableMenuItem SetWindowLongW CloseClipboard SystemParametersInfoA GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState GetAsyncKeyState CreateIcon GetDC GetMenuItemInfoW VkKeyScanW SetMenu DrawMenuBar DestroyAcceleratorTable CreateAcceleratorTableW PostQuitMessage TrackPopupMenu InsertMenuW AppendMenuW SetMenuItemInfoW CreateMenu CreatePopupMenu RemoveMenu CheckMenuItem DestroyMenu GetMenuBarInfo RegisterClassExW CreateWindowExW OffsetRect GetWindowDC DrawTextW PostThreadMessageW RedrawWindow DefWindowProcW GetClipboardData SetClipboardData OpenClipboard IsClipboardFormatAvailable FindWindowW DispatchMessageA GetMessageA SetPropW GetForegroundWindow GetWindowLongPtrW SetWindowLongPtrW DestroyWindow TranslateAcceleratorW RegisterTouchWindow IsWindow AdjustWindowRectEx GetActiveWindow UpdateWindow InvalidateRect SetCursorPos GetMessageW IsIconic EnumChildWindows TranslateMessage AdjustWindowRect LoadCursorW InvalidateRgn SetWindowPos GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW SendMessageW GetUpdateRect MapVirtualKeyW ValidateRect SetCursor CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW FillRect EmptyClipboard GetSystemMetrics DrawIconEx GetMonitorInfoW MonitorFromRect MonitorFromWindow GetCursorPos ClientToScreen GetClientRect GetWindowLongW ScreenToClient DispatchMessageW FlashWindowEx PeekMessageW PostMessageW

comctl32

RemoveWindowSubclass TaskDialogIndirect SetWindowSubclass DefSubclassProc

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance OleInitialize CoUninitialize CoTaskMemAlloc RevokeDragDrop RegisterDragDrop CoTaskMemFree CoInitialize CoInitializeEx

gdi32

SetTextColor CreateSolidBrush BitBlt CreateCompatibleDC DeleteObject SetBkMode DeleteDC SelectObject CreateRectRgn CombineRgn CreateDIBSection GetDeviceCaps

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute DwmGetWindowAttribute

shlwapi

SHCreateMemStream

secur32

FreeCredentialsHandle QueryContextAttributesW DeleteSecurityContext DecryptMessage ApplyControlToken AcquireCredentialsHandleA FreeContextBuffer InitializeSecurityContextW AcceptSecurityContext EncryptMessage

dbghelp

SymFromAddr ImageDirectoryEntryToData

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchRemoveBackslash

shell32

ILCreateFromPathW SHGetKnownFolderPath SHOpenFolderAndSelectItems ShellExecuteExW ILFree ShellExecuteW SHAppBarMessage DragFinish DragQueryFileW SHCreateItemFromParsingName

crypt32

CertAddCertificateContextToStore CryptDecodeObjectEx CertDuplicateCertificateChain CertEnumCertificatesInStore CryptStringToBinaryA CertCreateCertificateContext CertCreateCertificateChainEngine CertFreeCertificateChain CertFreeCertificateChainEngine CertDuplicateCertificateContext CertGetCertificateChain CertOpenStore CertFreeCertificateContext CertCloseStore CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertSetCertificateContextProperty CertDuplicateStore

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory2

d3d12

D3D12SerializeVersionedRootSignature ord101

directml

ord2

vulkan-1

vkGetInstanceProcAddr vkCmdCopyBuffer vkGetPhysicalDeviceFeatures2

setupapi

SetupDiGetDeviceRegistryPropertyW SetupDiOpenDevRegKey SetupDiGetClassDevsA SetupDiEnumDeviceInfo SetupDiDestroyDeviceInfoList

api-ms-win-crt-math-l1-1-0

log trunc floor roundf logf cos cosf pow sin sqrtf expf sqrt sinf atan truncf ceilf llroundl exp _fdclass _dclass __setusermatherr ldexp tanhf lroundf erff fminf fmaxf expm1f log1pf log2f floorf tanh acoshf asinhf frexp atanhf fmax _ldclass _ldsign _dsign acosf asinf atanf coshf fmod fmodf round log10 nearbyint remainderf rintf rint nearbyintf _fdsign log2 scalbnf ilogbf scalbn ilogb tanf sinhf powf

api-ms-win-crt-string-l1-1-0

isalpha strncmp isalnum _towlower_l wcsncmp strcpy_s strncpy strlen _towupper_l strcmp wcslen strnlen tolower isspace towlower isdigit wcscmp _wcsicmp

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _crt_atexit _register_onexit_function _initialize_onexit_table _exit _register_thread_local_exe_atexit_callback _wassert exit _seh_filter_exe _set_app_type _configure_narrow_argv strerror strerror_s _c_exit _initialize_narrow_environment _get_initial_narrow_environment _cexit _initterm abort __p___argv __p___argc _initterm_e _invalid_parameter_noinfo _errno terminate _set_errno __doserrno _set_doserrno _beginthreadex

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _sopen_s _close fflush _wsopen_s fgetc fgetpos fputc __stdio_common_vswprintf __stdio_common_vsnprintf_s fread fsetpos _fseeki64 fwrite _set_fmode setvbuf ungetc __stdio_common_vsprintf _write fputs __stdio_common_vfprintf __acrt_iob_func __p__commode _read fclose __stdio_common_vsprintf_s

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _callnewh _aligned_free realloc calloc _aligned_malloc

api-ms-win-crt-convert-l1-1-0

strtod wcstoul strtoul _wtoi wcstol _ultow_s strtoull strtol strtoll strtof atoi

api-ms-win-crt-filesystem-l1-1-0

remove _unlock_file _lock_file _fstat64i32

api-ms-win-crt-time-l1-1-0

_mktime64 wcsftime _gmtime64_s _localtime64_s _difftime64

api-ms-win-crt-locale-l1-1-0

localeconv _create_locale _free_locale ___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z _Cnd_do_broadcast_at_thread_exit _Thrd_join ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z ??0task_continuation_context@Concurrency@@AEAA@XZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AEAAXXZ ?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ ?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ ?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z ?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z _Cnd_unregister_at_thread_exit _Cnd_register_at_thread_exit _Cnd_broadcast ?__ExceptionPtrRethrow@@YAXPEBX@Z ?__ExceptionPtrCurrentException@@YAXPEAX@Z ?__ExceptionPtrToBool@@YA_NPEBX@Z ?__ExceptionPtrAssign@@YAXPEAXPEBX@Z ?__ExceptionPtrCopy@@YAXPEAXPEBX@Z ?__ExceptionPtrDestroy@@YAXPEAX@Z ?__ExceptionPtrCreate@@YAXPEAX@Z ?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@PEAV32@@Z ?setf@ios_base@std@@QEAAHH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ _Thrd_yield ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A ?id@?$numpunct@_W@std@@2V0locale@2@A ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z ?classic@locale@std@@SAAEBV12@XZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ _Mbrtowc ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z ?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z ?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z ?rdstate@ios_base@std@@QEBAHXZ ?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?c_str@?$_Yarn@D@std@@QEBAPEBDXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z _Strxfrm _Strcoll ??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_signal _Cnd_init_in_situ _Thrd_id ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z ?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QEBA_JXZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??Bios_base@std@@QEBA_NXZ _Cnd_wait _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks ?eof@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?setf@ios_base@std@@QEAAHHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?id@?$ctype@_W@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WXZ ?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ ?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBAPEAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W0@Z ?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXPEA_W00@Z ?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXH@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?pbase@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEBAPEA_WXZ ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_hardware_concurrency ??1_Lockit@std@@QEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0_Lockit@std@@QEAA@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?uncaught_exceptions@std@@YAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_unlock _Mtx_lock ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?flags@ios_base@std@@QEBAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ _Mtx_init_in_situ ?_Xbad_function_call@std@@YAXXZ ?_Xbad_alloc@std@@YAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

msvcp140_1

_Aligned_get_default_resource

Name

.text

Size

33.3MB

Virtual Size

33.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88.3MB

Virtual Size

88.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

201KB

Virtual Size

770KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

414KB

Virtual Size

414KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ffmpeg.exe

IMPHASH b43df9fe54bdb656a73eda5e00a596bb
SHA256 87170ac0aa3a8f2401be7faf596ce9c19c273650221043b28f8ea504af6c6496
MD5 95d8ac02ca2db15fa3b0f7fb912771ab
SHA1 4cce2d9dc6b58348b1e68e83ddad734300ced65c
SHA512 93fd54bea7343e859e5365e984387b49a7ca9c63ccfd189f3397af54eb443a62470fe74e5f038faa7054c1d193b9c8d1ea54d6b33583deb7baaff41db2ea0d6c
SSDEEP 1572864:8EeVu5Zdvf5vphdJhYe/swdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFh3A:04+e8B
TLSH
T100287C9EE1E7509CC22BD4B0437EFB73BA24746C10246A7A62D9DA306E63FC0571AF54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Digest

b8:19:3f:d3:65:16:59:a0:9f:dd:4f:ee:89:57:b5:29:54:19:bf:7b:6b:15:f1:98:b1:71:dc:c6:df:fb:20:ef

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Chains

Apr 28, 2026

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=Thomas Moroney,O=Thomas Moroney,L=Donabate,ST=County Dublin,C=IE

Serial Number

3a:42:1b:92:83:b1:ca:f5:38:63:d9:94:13:02:bb:bd

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 26, 2026 - Apr 26, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Timestamp 2026,O=Asseco Data Systems S.A.,C=PL

Serial Number

28:f0:77:c1:1c:36:bd:fe:5f:74:32:47:70:27:2e:03

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 11, 2026 - Feb 27, 2036

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Serial Number

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 31, 2021 - Sep 17, 2029

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptGenRandom CryptGetHashParam CryptGetProvParam CryptReleaseContext CryptSetHashParam CryptSetProvParam CryptSignHashA DeregisterEventSource GetUserNameA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SystemFunction036

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CertCloseStore CertDeleteCertificateFromStore CertEnumCRLsInStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreW PFXImportCertStore

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesW ExtCreateRegion ExtSelectClipRgn ExtTextOutW GdiFlush GetCharWidth32A GetClipBox GetClipRgn GetDIBColorTable GetDeviceCaps GetFontData GetFontUnicodeRanges GetGlyphIndicesW GetGlyphOutlineW GetGraphicsMode GetObjectA GetObjectW GetOutlineTextMetricsA GetStockObject GetTextFaceW GetTextMetricsA GetWorldTransform IntersectClipRect ModifyWorldTransform RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetMapMode SetTextAlign SetTextColor SetWorldTransform StretchDIBits

iphlpapi

GetAdaptersAddresses if_indextoname if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIoEx CloseHandle ConvertFiberToThread ConvertThreadToFiberEx CreateEventA CreateEventW CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateSemaphoreA CreateSemaphoreW CreateThread DebugBreak DeleteCriticalSection DeleteFiber DeleteFileW DuplicateHandle EnterCriticalSection EnumResourceLanguagesA EnumSystemLocalesA FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCPInfo GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetThreadContext GetThreadLocale GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA PeekNamedPipe QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetDllDirectoryA SetEndOfFile SetEvent SetFilePointer SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadErrorMode SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiW

msimg32

AlphaBlend

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _access _access _aligned_free _aligned_malloc _aligned_realloc _amsg_exit _assert _beginthreadex _cexit _chmod _close _close _commode _dup _dup2 _endthreadex _environ _errno _exit _fdopen _fdopen _filelengthi64 _fileno _fileno _findclose _findfirst _findnext _fmode _fstat64 _fstat64 _fstat _ftime64 _fullpath _get_osfhandle _getch _getmaxstdio _getpid _gmtime64 _hypot _initterm _isatty _isctype _isatty _localtime64 _kbhit _lock _locking _lseeki64 _lseeki64 _mbsrchr _mkdir _mkdir _mktime64 _nextafter _open _open _open_osfhandle _read _rmdir _rmdir _setjmp _setmaxstdio _setmode _setmode _sopen _stat _stat64 _strdup _stricmp _stricmp _strnicmp _strnicmp _strdup _strtoi64 _strtoui64 _strtoui64 _telli64 _time32 _time64 _unlink _unlink _unlock _vscprintf _vsnprintf _vsnwprintf _waccess _wchdir _wchmod _wcsdup _wcsdup _wcsnicmp _wfindfirst _wfopen _wfullpath _wgetcwd _wgetenv _wfindnext _wmkdir _wopen _wrename _write _wrmdir _write _wsopen _wstat _wstat64 _wunlink _wutime64 abort acos asin atan atexit atof atoi bsearch calloc clock cosh div exit fclose feof ferror fflush fgetc fgetpos fgets fopen fopen_s fprintf fputc fputs fputwc fread free fseek fwprintf fsetpos ftell fwrite getc getchar getenv getwc isalnum isalpha isdigit isleadbyte isprint isspace isupper iswctype isxdigit localeconv log10 longjmp malloc mbstowcs memchr memcmp memcpy memmove memset perror putc putchar puts putwc qsort raise rand realloc rename rewind setlocale setvbuf signal sinh sprintf srand strcat strchr strcmp strcoll strcpy strcpy_s strcspn strerror strftime strlen strncat strncmp strncpy strncpy_s strpbrk strrchr strspn strstr strtok strtok_s strtol strtoul strxfrm tan tanh tolower toupper towlower ungetwc towupper ungetc vfprintf wcscat wcscmp wcscoll wcscpy wcscpy_s wcsftime wcslen wcsncpy wcsrchr wcsstr wcstombs wcstombs_s wcstoul wcsxfrm

ncrypt

NCryptDecrypt NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

ole32

CLSIDFromString CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleLoadFromStream OleSaveToStream PropVariantClear StringFromCLSID StringFromGUID2

oleaut32

OleCreatePropertyFrame

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetSpecialFolderPathA

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx BeginPaint CopyIcon CreateWindowExA DefWindowProcA DestroyCursor DestroyWindow DispatchMessageA DrawIcon EndPaint EnumDisplayMonitors EnumWindows FillRect FindWindowW FrameRect GetClassNameW GetClientRect GetCursorInfo GetDC GetDesktopWindow GetForegroundWindow GetIconInfo GetMessageA GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW GetWindowLongPtrA GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IsIconic IsWindowVisible LoadCursorA MapWindowPoints MessageBoxW MonitorFromWindow PeekMessageA PostThreadMessageA ReleaseDC SendMessageA SetWindowLongPtrA SetWindowRgn ShowWindow SystemParametersInfoA TranslateMessage

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

FcPatternAdd FcPatternAddBool FcPatternAddCharSet FcPatternAddDouble FcPatternAddFTFace FcPatternAddInteger FcPatternAddLangSet FcPatternAddMatrix FcPatternAddRange FcPatternAddString FcPatternAddWeak FcPatternBuild FcPatternCreate FcPatternDel FcPatternDestroy FcPatternDuplicate FcPatternEqual FcPatternEqualSubset FcPatternFilter FcPatternFindIter FcPatternGet FcPatternGetBool FcPatternGetCharSet FcPatternGetDouble FcPatternGetFTFace FcPatternGetInteger FcPatternGetLangSet FcPatternGetMatrix FcPatternGetRange FcPatternGetString FcPatternGetWithBinding FcPatternHash FcPatternIterEqual FcPatternIterGetObject FcPatternIterGetValue FcPatternIterIsValid FcPatternIterNext FcPatternIterStart FcPatternIterValueCount FcPatternReference FcPatternRemove FcPatternVaBuild FcValueDestroy FcValueEqual FcValueSave _pixman_internal_only_get_implementation pixman_add_trapezoids pixman_add_traps pixman_add_triangles pixman_blt pixman_composite_glyphs pixman_composite_glyphs_no_mask pixman_composite_trapezoids pixman_composite_triangles pixman_compute_composite_region pixman_disable_out_of_bounds_workaround pixman_edge_init pixman_edge_step pixman_f_transform_bounds pixman_f_transform_from_pixman_transform pixman_f_transform_init_identity pixman_f_transform_init_rotate pixman_f_transform_init_scale pixman_f_transform_init_translate pixman_f_transform_invert pixman_f_transform_multiply pixman_f_transform_point pixman_f_transform_point_3d pixman_f_transform_rotate pixman_f_transform_scale pixman_f_transform_translate pixman_fill pixman_format_supported_destination pixman_format_supported_source pixman_glyph_cache_create pixman_glyph_cache_destroy pixman_glyph_cache_freeze pixman_glyph_cache_insert pixman_glyph_cache_lookup pixman_glyph_cache_remove pixman_glyph_cache_thaw pixman_glyph_get_extents pixman_glyph_get_mask_format pixman_image_composite pixman_image_composite32 pixman_image_composite64f pixman_image_create_bits pixman_image_create_bits_no_clear pixman_image_create_conical_gradient pixman_image_create_linear_gradient pixman_image_create_radial_gradient pixman_image_create_solid_fill pixman_image_fill_boxes pixman_image_fill_rectangles pixman_image_get_component_alpha pixman_image_get_data pixman_image_get_depth pixman_image_get_destroy_data pixman_image_get_format pixman_image_get_height pixman_image_get_stride pixman_image_get_width pixman_image_ref pixman_image_set_accessors pixman_image_set_alpha_map pixman_image_set_clip_region pixman_image_set_clip_region32 pixman_image_set_clip_region64f pixman_image_set_component_alpha pixman_image_set_destroy_function pixman_image_set_dither pixman_image_set_dither_offset pixman_image_set_filter pixman_image_set_has_client_clip pixman_image_set_indexed pixman_image_set_repeat pixman_image_set_source_clipping pixman_image_set_transform pixman_image_unref pixman_line_fixed_edge_init pixman_rasterize_edges pixman_rasterize_trapezoid pixman_region32_clear pixman_region32_contains_point pixman_region32_contains_pointf pixman_region32_contains_rectangle pixman_region32_copy pixman_region32_empty pixman_region32_equal pixman_region32_extents pixman_region32_fini pixman_region32_init pixman_region32_init_from_image pixman_region32_init_rect pixman_region32_init_rectf pixman_region32_init_rects pixman_region32_init_with_extents pixman_region32_intersect pixman_region32_intersect_rect pixman_region32_intersect_rectf pixman_region32_inverse pixman_region32_n_rects pixman_region32_not_empty pixman_region32_rectangles pixman_region32_reset pixman_region32_selfcheck pixman_region32_subtract pixman_region32_translate pixman_region32_translatef pixman_region32_union pixman_region32_union_rect pixman_region32_union_rectf pixman_region64f_clear pixman_region64f_contains_point pixman_region64f_contains_pointf pixman_region64f_contains_rectangle pixman_region64f_copy pixman_region64f_empty pixman_region64f_equal pixman_region64f_extents pixman_region64f_fini pixman_region64f_init pixman_region64f_init_from_image pixman_region64f_init_rect pixman_region64f_init_rectf pixman_region64f_init_rects pixman_region64f_init_with_extents pixman_region64f_intersect pixman_region64f_intersect_rect pixman_region64f_intersect_rectf pixman_region64f_inverse pixman_region64f_n_rects pixman_region64f_not_empty pixman_region64f_rectangles pixman_region64f_reset pixman_region64f_selfcheck pixman_region64f_subtract pixman_region64f_translate pixman_region64f_translatef pixman_region64f_union pixman_region64f_union_rect pixman_region64f_union_rectf pixman_region_clear pixman_region_contains_point pixman_region_contains_pointf pixman_region_contains_rectangle pixman_region_copy pixman_region_empty pixman_region_equal pixman_region_extents pixman_region_fini pixman_region_init pixman_region_init_from_image pixman_region_init_rect pixman_region_init_rectf pixman_region_init_rects pixman_region_init_with_extents pixman_region_intersect pixman_region_intersect_rect pixman_region_intersect_rectf pixman_region_inverse pixman_region_n_rects pixman_region_not_empty pixman_region_rectangles pixman_region_reset pixman_region_selfcheck pixman_region_set_static_pointers pixman_region_subtract pixman_region_translate pixman_region_translatef pixman_region_union pixman_region_union_rect pixman_region_union_rectf pixman_sample_ceil_y pixman_sample_floor_y pixman_transform_bounds pixman_transform_from_pixman_f_transform pixman_transform_init_identity pixman_transform_init_rotate pixman_transform_init_scale pixman_transform_init_translate pixman_transform_invert pixman_transform_is_identity pixman_transform_is_int_translate pixman_transform_is_inverse pixman_transform_is_scale pixman_transform_multiply pixman_transform_point pixman_transform_point_31_16 pixman_transform_point_31_16_3d pixman_transform_point_31_16_affine pixman_transform_point_3d pixman_transform_rotate pixman_transform_scale pixman_transform_translate pixman_version pixman_version_string

Name

.text

Size

79.6MB

Virtual Size

79.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12.8MB

Virtual Size

12.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

985KB

Virtual Size

985KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11.9MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

294KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

AutoSubs-windows-x86_64.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

autosubs.exe

kernel32

bcryptprimitives

advapi32

oleaut32

ntdll

ws2_32

user32

comctl32

ole32

gdi32

api-ms-win-core-synch-l1-2-0

dwmapi

shlwapi

secur32

dbghelp

api-ms-win-core-path-l1-1-0

shell32

crypt32

bcrypt

dxgi

d3d12

directml

vulkan-1

setupapi

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0