Harbor_0[.]9[.]20_x64-setup[1][.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Harbor_0.9.20_x64-setup[1].exe
Size 266.5MB
Sample260708-d2dnkaaz5m
SHA256 1879c7df4283542cbe2bca025f89c472ee7d1f9bd65cfbb7f906869f773eada8
MD5 4999d453e4c286020d7ba3b8c7332df7
SHA1 0c06a5ffc091daf7c9b41a37dbc0d66e15c50b89
SHA512 38a63ee91b770568468807861edc7001adf2834eec5353ce4fde602e50b85af898744f83ac2aee2f885740d6a4029877fbddb59073749dfcaa23534f74234c9e
SSDEEP 6291456:t4UF257NvY0VhPOB5b4GPlL7Vcy9LYri8GLnxDTBDEWIDf:t4t5FBGbP190rijnxDTzIDf
TLSH
T192D8331508B64CE3C7542DBDAAEA9773FF91EC25436908CE322D93A179C6D820E558FC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
static1/unpack001/yt-dlp.exe	pyinstaller

Unsigned PE 13 IoCs

Checks for missing Authenticode signature.

resource
Harbor_0.9.20_x64-setup[1].exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/ffmpeg.exe
unpack001/ffprobe.exe
unpack001/harbor.exe
unpack001/libmpv-2.dll
unpack001/mpv.exe
unpack001/yt-dlp.exe

File Explorer

Harbor_0.9.20_x64-setup[1].exe

.exe 266.5MB
$PLUGINSDIR/NSISdl.dll

.dll 15KB
$PLUGINSDIR/StartMenu.dll

.dll 7KB
$PLUGINSDIR/System.dll

.dll 12KB
$PLUGINSDIR/modern-header.bmp

25KB
$PLUGINSDIR/modern-wizard.bmp

150KB
$PLUGINSDIR/nsDialogs.dll

.dll 9KB
$PLUGINSDIR/nsExec.dll

.dll 7KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
ffmpeg.exe

.exe 96.8MB
ffprobe.exe

.exe 96.6MB
fonts/LICENSE-OFL-NotoSansJP.txt

4KB
fonts/NotoSansJP-Bold.otf

4.4MB
fonts/NotoSansJP-Regular.otf

4.3MB
harbor.exe

.exe 152.9MB
libmpv-2.dll

.dll 112.5MB
mpv.exe

.exe 115.5MB
yt-dlp.exe

.exe 17.6MB
__main__.pyc

371B

Harbor_0.9.20_x64-setup[1].exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 1879c7df4283542cbe2bca025f89c472ee7d1f9bd65cfbb7f906869f773eada8
MD5 4999d453e4c286020d7ba3b8c7332df7
SHA1 0c06a5ffc091daf7c9b41a37dbc0d66e15c50b89
SHA512 38a63ee91b770568468807861edc7001adf2834eec5353ce4fde602e50b85af898744f83ac2aee2f885740d6a4029877fbddb59073749dfcaa23534f74234c9e
SSDEEP 6291456:t4UF257NvY0VhPOB5b4GPlL7Vcy9LYri8GLnxDTBDEWIDf:t4t5FBGbP190rijnxDTzIDf
TLSH
T192D8331508B64CE3C7542DBDAAEA9773FF91EC25436908CE322D93A179C6D820E558FC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/NSISdl.dll

IMPHASH db80d5e142e716e818b7f4614dcade3c
SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
MD5 8eabbe36e8b52e69322780d0f541fd19
SHA1 e5fa3eca8d2035e4fa006b7123c348348e4e6de4
SHA512 4189fabff409be4bc7a8e81be58fb18e32398e4ef4c01a70cf823d79e76f47c4681734808fd61db8728c73d2bcad890b09aa09d5a0f0b0c3ad581be1beaf9ce7
SSDEEP 384:jrSQMCOUILnCaSPy/yhJzmGSMRWyOUKie:jrSQMCOp0yamMRWysie
TLSH
T17B623C16B62084F5DBB2167034D73B3E6BB28F6A1A2848C34BF35C4E9E52307B675D85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9321

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsExec.dll

IMPHASH 68b7023f8923dd087549802f8fa631c3
SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
MD5 8fe362ffdfa66269b8a64e3a87f68e52
SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
TLSH
T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

ffmpeg.exe

IMPHASH 03e5a940aadc3564709d2236d1c5e1ad
SHA256 228d7a8556258de907fdb55f36850078ebc7680b84ec30d84ea02e99bec1d1eb
MD5 172eec3a545dc2c8319500edf9358c61
SHA1 b4d3840a24c8eb8b7603437b12066e357556498f
SHA512 cc3098fe46451fd751d37af80b280cc00eca696e117a7f4b2d5c52bf403e0119b526e6eff9b4f7d339326cec086bf114b71d72ca5aec2fa6e0ebbada762efb2e
SSDEEP 1572864:mnlCOyzPa0J2+z/YqAkMzfwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhc:mzcM
TLSH
T18D287D9EE1E3509CC22BD4B0437EFB73BA24746C11246A7A62D9DA306E63FC0571AF54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDestroyHash CryptGenRandom CryptGetHashParam CryptGetProvParam CryptReleaseContext CryptSetHashParam CryptSetProvParam CryptSignHashA DeregisterEventSource GetUserNameA InitializeSecurityDescriptor RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExA RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExA RegQueryValueExW RegisterEventSourceW ReportEventW SetSecurityDescriptorDacl SystemFunction036

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

CertCloseStore CertDeleteCertificateFromStore CertEnumCRLsInStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore CertOpenSystemStoreW PFXImportCertStore

gdi32

BitBlt CombineRgn CreateCompatibleBitmap CreateCompatibleDC CreateDIBSection CreateFontIndirectW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject EnumFontFamiliesW ExtCreateRegion ExtSelectClipRgn ExtTextOutW GdiFlush GetCharWidth32A GetClipBox GetClipRgn GetDIBColorTable GetDeviceCaps GetFontData GetFontUnicodeRanges GetGlyphIndicesW GetGlyphOutlineW GetGraphicsMode GetObjectA GetObjectW GetOutlineTextMetricsA GetStockObject GetTextFaceW GetTextMetricsA GetWorldTransform IntersectClipRect ModifyWorldTransform RestoreDC SaveDC SelectClipRgn SelectObject SetBkMode SetGraphicsMode SetMapMode SetTextAlign SetTextColor SetWorldTransform StretchDIBits

iphlpapi

GetAdaptersAddresses if_indextoname if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIoEx CloseHandle ConvertFiberToThread ConvertThreadToFiberEx CreateEventA CreateEventW CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateSemaphoreA CreateSemaphoreW CreateThread DebugBreak DeleteCriticalSection DeleteFiber DeleteFileW DuplicateHandle EnterCriticalSection EnumResourceLanguagesA EnumSystemLocalesA FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetThreadContext GetThreadLocale GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage K32GetProcessMemoryInfo LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA PeekNamedPipe QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleMode SetConsoleTextAttribute SetDllDirectoryA SetEvent SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadErrorMode SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiW

msimg32

AlphaBlend

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-convert-l1-1-0

atof atoi mbrtowc mbsrtowcs mbstowcs strtol strtoll strtoul strtoull strtoumax wcrtomb wcstombs wcstombs_s wcstoul

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd _wgetenv getenv getenv_s

api-ms-win-crt-filesystem-l1-1-0

_access _chmod _findclose _findfirst64i32 _findnext64i32 _fstat64 _fstat64 _fstat64i32 _fullpath _lock_file _mkdir _rmdir _rmdir _mkdir _stat64 _stat64 _stat64i32 _stat64i32 _unlink _unlock_file _waccess _wchdir _unlink _wchmod _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wrename _wrmdir _wstat64 _wstat64i32 _wunlink rename

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _aligned_realloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen _fdopen _hypot acos acosf asin asinf asinhf atan atan2 atan2f atanf cbrt cbrtf ceil ceilf cos cosf cosh erf erff exp exp2 exp2f expf expm1 fabs floor floorf fmax fmaxf fmin fminf fmod frexp hypot llround log log10 log10f log1p log1pf log2 log2f logf lrint lrintf lround lroundf modf nextafter pow powf round roundf sin sinf sinh sinhf sqrt sqrtf tan tanf tanh tanhf

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _get_errno _initialize_narrow_environment _getpid _set_app_type _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_errno _set_invalid_parameter_handler _wassert abort exit perror raise signal strerror strerror_s

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _chsize_s _close _close _dup _dup2 _fileno _fileno _fseeki64 _fseeki64 _ftelli64 _ftelli64 _get_osfhandle _getmaxstdio _isatty _kbhit _isatty _locking _lseeki64 _lseeki64 _open _open _open_osfhandle _read _setmaxstdio _setmode _setmode _sopen _wfopen _wopen _write _write _wsopen fclose feof ferror fflush fgetc fgets fopen fopen_s fputc fputs fputwc fread fseek ftell fwrite getc getchar getwc putc putchar puts putwc rewind setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _strdup _stricmp _strnicmp _strnicmp _wcsdup _wcsdup _wcsnicmp isalnum isalpha isblank isdigit isprint isspace isupper iswctype isxdigit mbrlen memset strcat strcmp strcoll strcpy strcpy_s strcspn strlen strncat strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s strxfrm tolower toupper towlower towupper wcscat wcscmp wcscoll wcscpy wcscpy_s wcslen wcsncpy wcsnlen wcsxfrm wctype

api-ms-win-crt-time-l1-1-0

_ftime64 _gmtime64 _gmtime64_s _localtime64 _localtime64_s _mktime64 _time32 _time64 _wutime64 clock strftime wcsftime

api-ms-win-crt-utility-l1-1-0

bsearch div qsort rand rand_s srand

ncrypt

NCryptDecrypt NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

ole32

CLSIDFromString CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx OleLoadFromStream OleSaveToStream PropVariantClear StringFromCLSID StringFromGUID2

oleaut32

OleCreatePropertyFrame

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetSpecialFolderPathA

shlwapi

SHCreateStreamOnFileA

user32

AdjustWindowRectEx BeginPaint CopyIcon CreateWindowExA DefWindowProcA DestroyCursor DestroyWindow DispatchMessageA DrawIcon EndPaint EnumDisplayMonitors EnumWindows FillRect FindWindowW FrameRect GetClassNameW GetClientRect GetCursorInfo GetDC GetDesktopWindow GetForegroundWindow GetIconInfo GetMessageA GetProcessWindowStation GetSystemMetrics GetUserObjectInformationW GetWindowLongPtrA GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IsIconic IsWindowVisible LoadCursorA MapWindowPoints MessageBoxW MonitorFromWindow PeekMessageA PostThreadMessageA ReleaseDC SendMessageA SetWindowLongPtrA SetWindowRgn ShowWindow SystemParametersInfoA TranslateMessage

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutUnprepareHeader waveOutWrite

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_ntop inet_pton ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

FcPatternAdd FcPatternAddBool FcPatternAddCharSet FcPatternAddDouble FcPatternAddFTFace FcPatternAddInteger FcPatternAddLangSet FcPatternAddMatrix FcPatternAddRange FcPatternAddString FcPatternAddWeak FcPatternBuild FcPatternCreate FcPatternDel FcPatternDestroy FcPatternDuplicate FcPatternEqual FcPatternEqualSubset FcPatternFilter FcPatternFindIter FcPatternGet FcPatternGetBool FcPatternGetCharSet FcPatternGetDouble FcPatternGetFTFace FcPatternGetInteger FcPatternGetLangSet FcPatternGetMatrix FcPatternGetRange FcPatternGetString FcPatternGetWithBinding FcPatternHash FcPatternIterEqual FcPatternIterGetObject FcPatternIterGetValue FcPatternIterIsValid FcPatternIterNext FcPatternIterStart FcPatternIterValueCount FcPatternReference FcPatternRemove FcPatternVaBuild FcValueDestroy FcValueEqual FcValueSave _pixman_internal_only_get_implementation pixman_add_trapezoids pixman_add_traps pixman_add_triangles pixman_blt pixman_composite_glyphs pixman_composite_glyphs_no_mask pixman_composite_trapezoids pixman_composite_triangles pixman_compute_composite_region pixman_disable_out_of_bounds_workaround pixman_edge_init pixman_edge_step pixman_f_transform_bounds pixman_f_transform_from_pixman_transform pixman_f_transform_init_identity pixman_f_transform_init_rotate pixman_f_transform_init_scale pixman_f_transform_init_translate pixman_f_transform_invert pixman_f_transform_multiply pixman_f_transform_point pixman_f_transform_point_3d pixman_f_transform_rotate pixman_f_transform_scale pixman_f_transform_translate pixman_fill pixman_format_supported_destination pixman_format_supported_source pixman_glyph_cache_create pixman_glyph_cache_destroy pixman_glyph_cache_freeze pixman_glyph_cache_insert pixman_glyph_cache_lookup pixman_glyph_cache_remove pixman_glyph_cache_thaw pixman_glyph_get_extents pixman_glyph_get_mask_format pixman_image_composite pixman_image_composite32 pixman_image_composite64f pixman_image_create_bits pixman_image_create_bits_no_clear pixman_image_create_conical_gradient pixman_image_create_linear_gradient pixman_image_create_radial_gradient pixman_image_create_solid_fill pixman_image_fill_boxes pixman_image_fill_rectangles pixman_image_get_component_alpha pixman_image_get_data pixman_image_get_depth pixman_image_get_destroy_data pixman_image_get_format pixman_image_get_height pixman_image_get_stride pixman_image_get_width pixman_image_ref pixman_image_set_accessors pixman_image_set_alpha_map pixman_image_set_clip_region pixman_image_set_clip_region32 pixman_image_set_clip_region64f pixman_image_set_component_alpha pixman_image_set_destroy_function pixman_image_set_dither pixman_image_set_dither_offset pixman_image_set_filter pixman_image_set_has_client_clip pixman_image_set_indexed pixman_image_set_repeat pixman_image_set_source_clipping pixman_image_set_transform pixman_image_unref pixman_line_fixed_edge_init pixman_rasterize_edges pixman_rasterize_trapezoid pixman_region32_clear pixman_region32_contains_point pixman_region32_contains_pointf pixman_region32_contains_rectangle pixman_region32_copy pixman_region32_empty pixman_region32_equal pixman_region32_extents pixman_region32_fini pixman_region32_init pixman_region32_init_from_image pixman_region32_init_rect pixman_region32_init_rectf pixman_region32_init_rects pixman_region32_init_with_extents pixman_region32_intersect pixman_region32_intersect_rect pixman_region32_intersect_rectf pixman_region32_inverse pixman_region32_n_rects pixman_region32_not_empty pixman_region32_rectangles pixman_region32_reset pixman_region32_selfcheck pixman_region32_subtract pixman_region32_translate pixman_region32_translatef pixman_region32_union pixman_region32_union_rect pixman_region32_union_rectf pixman_region64f_clear pixman_region64f_contains_point pixman_region64f_contains_pointf pixman_region64f_contains_rectangle pixman_region64f_copy pixman_region64f_empty pixman_region64f_equal pixman_region64f_extents pixman_region64f_fini pixman_region64f_init pixman_region64f_init_from_image pixman_region64f_init_rect pixman_region64f_init_rectf pixman_region64f_init_rects pixman_region64f_init_with_extents pixman_region64f_intersect pixman_region64f_intersect_rect pixman_region64f_intersect_rectf pixman_region64f_inverse pixman_region64f_n_rects pixman_region64f_not_empty pixman_region64f_rectangles pixman_region64f_reset pixman_region64f_selfcheck pixman_region64f_subtract pixman_region64f_translate pixman_region64f_translatef pixman_region64f_union pixman_region64f_union_rect pixman_region64f_union_rectf pixman_region_clear pixman_region_contains_point pixman_region_contains_pointf pixman_region_contains_rectangle pixman_region_copy pixman_region_empty pixman_region_equal pixman_region_extents pixman_region_fini pixman_region_init pixman_region_init_from_image pixman_region_init_rect pixman_region_init_rectf pixman_region_init_rects pixman_region_init_with_extents pixman_region_intersect pixman_region_intersect_rect pixman_region_intersect_rectf pixman_region_inverse pixman_region_n_rects pixman_region_not_empty pixman_region_rectangles pixman_region_reset pixman_region_selfcheck pixman_region_set_static_pointers pixman_region_subtract pixman_region_translate pixman_region_translatef pixman_region_union pixman_region_union_rect pixman_region_union_rectf pixman_sample_ceil_y pixman_sample_floor_y pixman_transform_bounds pixman_transform_from_pixman_f_transform pixman_transform_init_identity pixman_transform_init_rotate pixman_transform_init_scale pixman_transform_init_translate pixman_transform_invert pixman_transform_is_identity pixman_transform_is_int_translate pixman_transform_is_inverse pixman_transform_is_scale pixman_transform_multiply pixman_transform_point pixman_transform_point_31_16 pixman_transform_point_31_16_3d pixman_transform_point_31_16_affine pixman_transform_point_3d pixman_transform_rotate pixman_transform_scale pixman_transform_translate pixman_version pixman_version_string

Name

.text

Size

79.9MB

Virtual Size

79.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12.7MB

Virtual Size

12.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

986KB

Virtual Size

986KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

295KB

Virtual Size

294KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ffprobe.exe

IMPHASH 70bac94e19bf7b1add5ce835dd3a7f56
SHA256 0fde260f5abd35c9cafd96f594cc76365a780c1b73a90e35b6a3409ea1db1bf0
MD5 5c8e505edcaf9007a9d9b2865f1d10a6
SHA1 c37fb6a2828f09faadddbd17ae5bb5c00cc8c1ca
SHA512 3983bf745b1c2a0530265da1249e91134c1544fc7079473f46eb0ccad3a2ab441ac14c7e252cac60249f27a23237ac68115bc26ba1d28bc4b23a80a720da0ceb
SSDEEP 1572864:7FLUsZQz1i1yZo5M3Wy+KjwdcYS/aEHBt6w5Hnflkg+rkVRJsZRw+cJfagAoCFhX:u8Fy+
TLSH
T10D287D9EE1E3509CC22BD4B0437EFB73BA24746C11246A7A62D9DA306E63FC0571AF54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

bcrypt

BCryptCloseAlgorithmProvider BCryptGenRandom BCryptOpenAlgorithmProvider

crypt32

gdi32

iphlpapi

GetAdaptersAddresses if_indextoname if_nametoindex

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIoEx CloseHandle ConvertFiberToThread ConvertThreadToFiberEx CreateEventA CreateEventW CreateFiberEx CreateFileA CreateFileMappingA CreateFileW CreateHardLinkW CreateMutexA CreateSemaphoreA CreateSemaphoreW CreateThread DebugBreak DeleteCriticalSection DeleteFiber DeleteFileW DuplicateHandle EnterCriticalSection EnumResourceLanguagesA EnumSystemLocalesA FileTimeToSystemTime FindClose FindFirstFileA FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageA FormatMessageW FreeLibrary GetACP GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleScreenBufferInfo GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleA GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetProcAddress GetProcessAffinityMask GetProcessHeap GetProcessTimes GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetThreadContext GetThreadLocale GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetVersion GetVersionExA GetWindowsDirectoryA HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MultiByteToWideChar OpenFileMappingA OpenProcess OutputDebugStringA PeekNamedPipe QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore RemoveDirectoryW ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleMode SetConsoleTextAttribute SetDllDirectoryA SetEvent SetHandleInformation SetLastError SetProcessAffinityMask SetSystemTime SetThreadContext SetThreadErrorMode SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SignalObjectAndWait Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpiW

msimg32

AlphaBlend

api-ms-win-crt-convert-l1-1-0

atof atoi mbrtowc mbsrtowcs mbstowcs strtol strtoll strtoul strtoull strtoumax wcrtomb wcstombs wcstombs_s wcstoul

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetcwd _wgetenv getenv getenv_s

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _aligned_realloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale localeconv setlocale

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr wcsrchr wcsstr

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _chsize_s _close _close _dup _dup2 _fileno _fileno _fseeki64 _fseeki64 _ftelli64 _ftelli64 _get_osfhandle _getmaxstdio _isatty _isatty _locking _lseeki64 _lseeki64 _open _open _open_osfhandle _read _setmaxstdio _setmode _setmode _sopen _wfopen _wopen _write _write _wsopen fclose feof ferror fflush fgetc fgets fopen fopen_s fputc fputs fputwc fread fseek ftell fwrite getc getchar getwc putc putchar puts putwc rewind setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

_ftime64 _gmtime64 _gmtime64_s _localtime64 _localtime64_s _mktime64 _time32 _time64 _wutime64 clock strftime wcsftime

api-ms-win-crt-utility-l1-1-0

bsearch div qsort rand rand_s srand

ncrypt

NCryptDecrypt NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

ole32

oleaut32

OleCreatePropertyFrame

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetSpecialFolderPathA

shlwapi

SHCreateStreamOnFileA

user32

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

ws2_32

Name

.text

Size

79.8MB

Virtual Size

79.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

197KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12.6MB

Virtual Size

12.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

984KB

Virtual Size

983KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11.6MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

294KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

harbor.exe

IMPHASH d21f7a834c0efb263009a38816762dcb
SHA256 215df8249c89a02810c0f1c310e5d5023c7cba7e06ee44c89702de4b907f0422
MD5 f93f1b9f7d1f6dbc3090e09111385e11
SHA1 86ea343e8488889557daab2f7122820fe0640667
SHA512 e6856ea049917b06f03dc82738d1bc6891a0d1b47c2a82be360c1b00ec3f8b1afb77a77415e51b44aa9a8c2614ab12bbb9c3ecca0ee727ec93f3815be2a50ced
SSDEEP 3145728:ZoRegSLipBaK4MvzT20TPDkqsd3dV7Je60azE:ucipBXzC0LDDYKJ
TLSH
T10178F0257A9A996DC05AC47083474A724A7170CF0B39BAFF44D496383F79BF82F38259
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24761120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

harbor.pdb

kernel32

TerminateProcess GetModuleHandleW ReleaseMutex K32GetProcessMemoryInfo GetCurrentProcessId GlobalMemoryStatusEx CreateToolhelp32Snapshot Process32FirstW Process32NextW GetModuleHandleA GetCurrentThreadId Sleep GetProcAddress GetUserDefaultUILanguage LCIDToLocaleName FormatMessageW LoadLibraryExA GetLastError WakeAllConditionVariable lstrlenW OutputDebugStringA OutputDebugStringW GetModuleFileNameW LoadLibraryExW LoadLibraryW FreeLibrary UnregisterWaitEx RegisterWaitForSingleObject GetSystemInfo SleepConditionVariableSRW UnmapViewOfFile MapViewOfFile GetSystemTimeAsFileTime VirtualProtect RtlPcToFileHeader RaiseException DuplicateHandle FlushViewOfFile OpenProcess WaitForSingleObject CreateMutexW CreateFileW SetNamedPipeHandleState MoveFileExW CloseHandle SetLastError InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared GetFileAttributesW CreateFileMappingW FlushFileBuffers CreateEventA CreateEventW InitOnceExecuteOnce TlsAlloc TlsGetValue FlsAlloc CreatePipe GetFileInformationByHandle GetQueuedCompletionStatusEx SetFileCompletionNotificationModes CreateIoCompletionPort CancelIoEx FlsGetValue WriteFile FlsSetValue FlsFree EncodePointer HeapFree ReadFile PostQueuedCompletionStatus GetOverlappedResult HeapAlloc GetProcessHeap TlsSetValue WideCharToMultiByte GetCurrentProcess LoadLibraryA GetConsoleMode SetHandleInformation GetStdHandle GetExitCodeProcess GetSystemTimePreciseAsFileTime WriteFileEx CreateProcessW InitializeCriticalSectionEx GetWindowsDirectoryW GetProcessId GetSystemDirectoryW RtlUnwindEx CompareStringOrdinal SetUnhandledExceptionFilter InitializeSListHead FreeEnvironmentStringsW CreateThread SetWaitableTimer CreateWaitableTimerExW RtlCaptureContext RtlLookupFunctionEntry FindNextFileW DeleteCriticalSection GetEnvironmentVariableW QueryPerformanceCounter QueryPerformanceFrequency GetConsoleOutputCP RtlVirtualUnwind HeapReAlloc WaitForSingleObjectEx CreateMutexA SetFilePointerEx SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentStringsW GetCommandLineW RemoveDirectoryW CopyFileExW CreateDirectoryW CreateSymbolicLinkW DeviceIoControl GetFileInformationByHandleEx SwitchToThread DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW FindClose SetEnvironmentVariableW GetFullPathNameW GetTempPathW ExitProcess WaitForMultipleObjects WriteConsoleW ReadFileEx SleepEx CancelIo MultiByteToWideChar

advapi32

SystemFunction036 RegCloseKey RegSetValueExW RegQueryValueExW RegDeleteTreeW RegOpenKeyExW RegOpenKeyTransactedW RegCreateKeyExW RegCreateKeyTransactedW RegGetValueW EventRegister EventSetInformation EventWriteTransfer EventUnregister

oleaut32

SysStringLen SetErrorInfo GetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

ntdll

NtCreateNamedPipeFile NtDeviceIoControlFile NtCreateFile NtWriteFile RtlNtStatusToDosError NtOpenFile NtReadFile RtlGetVersion NtCancelIoFileEx

comctl32

TaskDialogIndirect SetWindowSubclass RemoveWindowSubclass DefSubclassProc

user32

RemoveMenu SetWindowLongPtrW GetWindowLongPtrW SetMenuItemInfoW DrawIconEx DestroyMenu SetWindowTextW SetWindowDisplayAffinity CreateMenu CheckMenuItem GetWindowTextLengthW SendInput CreatePopupMenu GetForegroundWindow SetForegroundWindow MsgWaitForMultipleObjectsEx AppendMenuW InsertMenuW RegisterTouchWindow IsWindow AdjustWindowRectEx FlashWindowEx RegisterWindowMessageA MonitorFromPoint SetCapture IsWindowEnabled EnumDisplayMonitors SetPropW SetParent SystemParametersInfoA MapWindowPoints GetRawInputData GetWindow ShowCursor SetFocus ShowWindow ReleaseDC IsProcessDPIAware ReleaseCapture GetDC GetParent FindWindowExW GetClipCursor ClipCursor GetSystemMenu RegisterRawInputDevices CreateIcon GetKeyboardLayout EnableWindow IsWindowVisible GetMenu GetKeyState ToUnicodeEx MapVirtualKeyExW GetKeyboardState GetActiveWindow UpdateWindow InvalidateRect SetCursorPos MonitorFromWindow LoadCursorW InvalidateRgn GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW GetUpdateRect MapVirtualKeyW ValidateRect GetCursorPos SetCursor GetSystemMetrics CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent SystemParametersInfoW PostQuitMessage FillRect CreateAcceleratorTableW MonitorFromRect ClientToScreen ScreenToClient GetMonitorInfoW PostThreadMessageW PeekMessageW DispatchMessageW GetMessageW IsIconic DestroyAcceleratorTable DrawTextW DestroyWindow AdjustWindowRect GetWindowDC RedrawWindow OffsetRect GetWindowRect GetClassNameW DestroyIcon SendMessageW FindWindowW PostMessageW SetWindowLongW GetWindowLongW GetMenuBarInfo DrawMenuBar SetMenu GetMenuItemInfoW SetTimer TrackPopupMenu KillTimer DefWindowProcW CreateWindowExW RegisterClassExW ChangeWindowMessageFilterEx DispatchMessageA TranslateMessage GetMessageA RegisterClassW EnableMenuItem GetWindowThreadProcessId GetWindowTextW EnumChildWindows GetClientRect SetWindowRgn GetAsyncKeyState SetWindowPos TranslateAcceleratorW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

gdi32

CombineRgn CreateDIBSection GetDeviceCaps BitBlt CreateRoundRectRgn CreateCompatibleDC SelectObject SetBkMode SetTextColor DeleteDC CreateRectRgn DeleteObject CreateSolidBrush

shell32

Shell_NotifyIconGetRect SHAppBarMessage DragQueryFileW SHCreateItemFromParsingName ILFree ILCreateFromPathW Shell_NotifyIconW DragFinish SHGetKnownFolderPath SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW

dxgi

CreateDXGIFactory1

ole32

CoInitializeEx RevokeDragDrop CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemAlloc OleInitialize CoInitialize RegisterDragDrop CoTaskMemFree CoUninitialize PropVariantClear

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shlwapi

SHCreateMemStream

propsys

PropVariantToStringAlloc

ws2_32

connect getsockopt getpeername WSAIoctl getsockname send sendto ioctlsocket recv WSARecv WSASocketW setsockopt listen shutdown WSASend WSACleanup WSAStartup freeaddrinfo getaddrinfo recvfrom socket WSAGetLastError closesocket bind accept

crypt32

CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateStore CertDuplicateCertificateContext CertDuplicateCertificateChain CertOpenStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertSetCertificateContextProperty CertAddEncodedCertificateToStore CertCloseStore CertFreeCertificateContext CertFreeCertificateChainEngine CertFreeCertificateChain CertCreateCertificateChainEngine

secur32

InitializeSecurityContextW DecryptMessage AcquireCredentialsHandleA DeleteSecurityContext QueryContextAttributesW FreeCredentialsHandle EncryptMessage ApplyControlToken FreeContextBuffer AcceptSecurityContext

bcrypt

BCryptGenRandom

iphlpapi

ConvertLengthToIpv4Mask ConvertInterfaceLuidToIndex GetAdaptersAddresses

libmpv-2

mpv_set_property mpv_free mpv_client_api_version mpv_create mpv_initialize mpv_terminate_destroy mpv_command mpv_request_log_messages mpv_wait_event mpv_observe_property mpv_free_node_contents mpv_command_string mpv_get_property

api-ms-win-crt-math-l1-1-0

pow roundf floor round __setusermatherr trunc

api-ms-win-crt-string-l1-1-0

_wcsicmp wcslen wcscmp strcpy_s strlen strcmp

api-ms-win-crt-convert-l1-1-0

_wtoi strtol wcstol _ultow_s

api-ms-win-crt-heap-l1-1-0

malloc free realloc _callnewh _set_new_mode calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc abort _errno terminate _seh_filter_exe _set_app_type _wassert _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_setmode fwrite ftell fseek fread fopen fgets __p__commode ferror feof fclose _set_fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf __acrt_iob_func _fileno fflush

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

24.0MB

Virtual Size

24.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

127.3MB

Virtual Size

127.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

26KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

113KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

libmpv-2.dll

IMPHASH 0164a2e8d8b4bf7e6748650b6df77be7
SHA256 e9c87d19055bc5a82771b2b48e9fbae047bd5180603f5a1aaae10c90ca690467
MD5 59b009841994d3816ad901961168bebb
SHA1 8f1643480f6de0b90a4b2e15421851e0919b8ee1
SHA512 db2c44c2c7e66229e6ae643524f0434f548714a488f4674436b97ffad3c2b85ac1d999eeca57dcbadbf7efc71dcd1613db19419bd4ae211b53e46378ac36819e
SSDEEP 786432:rskHyZKfp5r7rAD33Gkd2wfbtTp/xrCeVfAA0Zv/UHs6:rkKfpp781L34vK
TLSH
T1F8489E4BF197909CD41BC5B443AAB723FA34785D43245AEB22D996343E76BC06B3AF04
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

/__w/mpv-winbuild/mpv-winbuild/mpv-winbuild-cmake/build64/packages/mpv-prefix/src/mpv-build/libmpv-2.pdb

gdi32

BitBlt ChoosePixelFormat CombineRgn CreateBitmap CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateICW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject DescribePixelFormat EnumFontFamiliesExW EnumFontFamiliesW GetDIBColorTable GetDIBits GetDeviceCaps GetDeviceGammaRamp GetICMProfileW GetObjectA GetPixelFormat GetStockObject GetTextExtentPoint32A GetTextFaceW GetTextMetricsW SelectObject SetDeviceGammaRamp SetPixelFormat SwapBuffers

ole32

CLSIDFromString CoCreateFreeThreadedMarshaler CoCreateInstance CoGetMalloc CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CreateBindCtx GetErrorInfo OleInitialize OleLoadFromStream OleSaveToStream OleUninitialize PropVariantClear RegisterDragDrop ReleaseStgMedium RevokeDragDrop SetErrorInfo StringFromCLSID StringFromGUID2

user32

AdjustWindowRectEx AdjustWindowRectExForDpi AttachThreadInput BeginPaint BringWindowToTop CallNextHookEx CallWindowProcW ChangeDisplaySettingsExW ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CopyIcon CopyImage CreateIconFromResource CreateIconIndirect CreatePopupMenu CreateWindowExA CreateWindowExW DefWindowProcA DefWindowProcW DeleteMenu DestroyCursor DestroyIcon DestroyMenu DestroyWindow DialogBoxIndirectParamW DispatchMessageA DispatchMessageW DisplayConfigGetDeviceInfo DrawIcon DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsW EnumWindows EqualRect FillRect FindWindowExW FindWindowW FlashWindowEx FrameRect GetAsyncKeyState GetClassInfoExW GetClassNameW GetClientRect GetClipCursor GetClipboardData GetClipboardSequenceNumber GetCursorInfo GetCursorPos GetDC GetDesktopWindow GetDisplayConfigBufferSizes GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardState GetMenu GetMenuItemCount GetMenuItemInfoW GetMessageA GetMessageExtraInfo GetMessageTime GetMessageW GetMonitorInfoW GetParent GetProcessWindowStation GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetShellWindow GetSystemMenu GetSystemMetrics GetSystemMetricsForDpi GetTouchInputInfo GetUpdateRect GetUserObjectInformationW GetWindowLongPtrA GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InflateRect InsertMenuItemW IntersectRect InvalidateRect IsClipboardFormatAvailable IsIconic IsWindowVisible IsZoomed KillTimer LoadCursorA LoadCursorW LoadIconW MapVirtualKeyW MapWindowPoints MessageBoxA MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageW PostQuitMessage PostThreadMessageA PostThreadMessageW PtInRect QueryDisplayConfig RegisterClassExA RegisterClassExW RegisterClassW RegisterClipboardFormatW RegisterDeviceNotificationW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA RegisterWindowMessageW ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendMessageA SendMessageTimeoutW SendMessageW SendNotifyMessageW SetActiveWindow SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetLayeredWindowAttributes SetPropW SetRect SetTimer SetWinEventHook SetWindowDisplayAffinity SetWindowLongPtrA SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicode TrackMouseEvent TrackPopupMenuEx TranslateMessage UnhookWinEvent UnhookWindowsHookEx UnregisterClassA UnregisterClassW UnregisterDeviceNotification UnregisterTouchWindow ValidateRect wsprintfA

version

GetFileVersionInfoA GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA VerQueryValueW

advapi32

AllocateAndInitializeSid CheckTokenMembership ConvertSidToStringSidA ConvertStringSecurityDescriptorToSecurityDescriptorA CryptAcquireContextW CryptGenRandom CryptReleaseContext DeregisterEventSource FreeSid GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameA OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyValueW RegDeleteTreeW RegEnumKeyExW RegEnumValueA RegEnumValueW RegGetValueW RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

shell32

DragAcceptFiles DragFinish DragQueryFileW SHGetFolderPathA SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderPathA ShellExecuteW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI CancelIo CancelIoEx CloseHandle CompareStringA ConnectNamedPipe ConvertFiberToThread ConvertThreadToFiberEx CreateDirectoryW CreateEventA CreateEventW CreateFiberEx CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DebugBreak DeleteCriticalSection DeleteFiber DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection EnumResourceNamesW ExitProcess FillConsoleOutputCharacterW FindClose FindFirstFileExA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentConsoleFont GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileTime GetFileType GetFullPathNameA GetFullPathNameW GetLastError GetLocaleInfoA GetLogicalDrives GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetNumberOfConsoleInputEvents GetOEMCP GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetThreadContext GetThreadGroupAffinity GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetUserDefaultLocaleName GetUserPreferredUILanguages GetVersion GetWindowsDirectoryA GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsValidCodePage IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW MoveFileExA MoveFileExW MulDiv MultiByteToWideChar OpenFileMappingA OpenProcess OpenThread OutputDebugStringA OutputDebugStringW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleA ReadConsoleInputW ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetDllDirectoryW SetEnvironmentVariableA SetErrorMode SetEvent SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetThreadAffinityMask SetThreadContext SetThreadDescription SetThreadErrorMode SetThreadExecutionState SetThreadGroupAffinity SetThreadPriority SetWaitableTimer SignalObjectAndWait SizeofResource Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile lstrcmpiW lstrcpyA lstrcpynA

oleaut32

OleCreatePropertyFrame SysFreeString SysStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ntdll

NtQueryTimerResolution NtSetTimerResolution NtWriteFile RtlNtStatusToDosError

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

dwmapi

DwmEnableBlurBehindWindow DwmEnableMMCSS DwmFlush DwmGetCompositionTimingInfo DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

imm32

ImmAssociateContext ImmGetCandidateListW ImmGetCompositionStringW ImmGetContext ImmGetConversionStatus ImmGetIMEFileNameA ImmNotifyIME ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionStringW ImmSetCompositionWindow ImmSetConversionStatus

api-ms-win-core-path-l1-1-0

PathAllocCombine PathCchCanonicalizeEx PathCchRemoveFileSpec

shcore

GetDpiForMonitor

uxtheme

SetWindowTheme

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

opengl32

wglCreateContext wglDeleteContext wglGetProcAddress wglMakeCurrent

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__fmode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf _chsize_s _close _dup _fileno _fseeki64 _ftelli64 _get_osfhandle _isatty _lseeki64 _open _open_osfhandle _pclose _popen _read _setmode _sopen _wfopen _wopen _write _wsopen clearerr fclose feof ferror fflush fgetc fgets fgetwc fopen fopen_s fputc fputs fputwc fread fseek ftell fwrite getc putchar puts rewind setbuf setvbuf tmpfile tmpnam ungetc ungetwc

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv _wgetenv getenv getenv_s

api-ms-win-crt-runtime-l1-1-0

_assert __sys_nerr _beginthreadex _endthreadex _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _wassert abort exit perror raise signal strerror strerror_s system

api-ms-win-crt-filesystem-l1-1-0

_access _chmod _findclose _findfirst64i32 _findnext64i32 _fstat64 _fstat64i32 _lock_file _mkdir _rmdir _stat64 _stat64i32 _unlink _unlock_file _waccess _wfindfirst64i32 _wfindnext64i32 _wfullpath _wmkdir _wremove _wrename _wrmdir _wstat64 _wstat64i32 _wunlink remove rename

api-ms-win-crt-string-l1-1-0

_isdigit_l _isxdigit_l _strdup _stricmp _strlwr _strnicmp _strrev _strupr _wcsdup _wcsicmp _wcsnicmp isalnum isalpha isblank iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswspace isxdigit mbrlen memcpy_s memset strcat strcmp strcpy strcspn strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s tolower toupper towupper wcscat wcscmp wcscoll wcscpy wcscpy_s wcslen wcsncmp wcsncpy wcsncpy_s wcsnlen

api-ms-win-crt-private-l1-1-0

__DestructExceptionObject __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr wcschr wcsrchr wcsstr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_difftime64 _ftime64 _ftime64_s _gmtime64 _gmtime64_s _localtime64 _localtime64_s _mkgmtime64 _mktime64 _strftime_l _time32 _time64 _utime64 clock strftime

api-ms-win-crt-convert-l1-1-0

_i64toa _itoa _itoa_s _ltoa _strtod_l _strtoi64_l _strtoui64_l _ui64toa _ultoa atof atoi mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull strtoumax wcrtomb wcrtomb_s wcstol wcstombs wcstombs_s wcstoul

api-ms-win-crt-utility-l1-1-0

bsearch div ldiv lldiv qsort rand rand_s srand

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _aligned_realloc calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

_fdopen _hypot _j1 acos acosf asin asinf asinhf atan atan2 atan2f atanf cbrt cbrtf ceil ceilf cos cosf cosh erf erff exp exp2 exp2f expf expm1 fabs floor floorf fmod fmodf frexp hypot llrint llroundf log log10 log10f log1p log1pf log2 log2f logf lrint lrintf lround lroundf modf modff nextafter pow powf remainder rint rintf round roundf sin sinf sinh sinhf sqrt sqrtf tan tanf tanh tanhf trunc truncf

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr _mbtowc_l

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDeriveKeyPBKDF2 BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

shlwapi

PathRemoveFileSpecW SHCreateStreamOnFileA

dwrite

DWriteCreateFactory

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa inet_ntop ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

timeBeginPeriod timeEndPeriod waveInAddBuffer waveInClose waveInGetDevCapsW waveInGetNumDevs waveInOpen waveInPrepareHeader waveInReset waveInStart waveInStop waveInUnprepareHeader waveOutClose waveOutGetDevCapsW waveOutGetErrorTextW waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

cfgmgr32

CM_Get_Child CM_Get_DevNode_Registry_PropertyW CM_Get_DevNode_Status CM_Get_Device_IDA CM_Get_Device_IDW CM_Get_Device_ID_ListW CM_Get_Device_ID_List_SizeW CM_Get_Parent CM_Get_Sibling CM_Locate_DevNodeA CM_Locate_DevNodeW CM_Open_DevNode_Key

iphlpapi

if_nametoindex

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenSystemStoreW

d2d1

D2D1CreateFactory

Java_java_awt_BDFontMetrics_charWidthN Java_java_awt_BDFontMetrics_charsWidthN Java_java_awt_BDFontMetrics_destroyFontN Java_java_awt_BDFontMetrics_destroyN Java_java_awt_BDFontMetrics_getFontFamilyAndStyleN Java_java_awt_BDFontMetrics_initN Java_java_awt_BDFontMetrics_loadFontN Java_java_awt_BDFontMetrics_resolveFontN Java_java_awt_BDFontMetrics_stringWidthN Java_java_awt_BDFontMetrics_unloadFontConfigN Java_java_awt_BDGraphics_drawStringN Java_org_videolan_Libbluray_cacheBdRomFileN Java_org_videolan_Libbluray_getAacsDataN Java_org_videolan_Libbluray_getBdjoN Java_org_videolan_Libbluray_getPlaylistInfoN Java_org_videolan_Libbluray_getTitleInfosN Java_org_videolan_Libbluray_getUOMaskN Java_org_videolan_Libbluray_listBdFilesN Java_org_videolan_Libbluray_readRegN Java_org_videolan_Libbluray_seekN Java_org_videolan_Libbluray_selectAngleN Java_org_videolan_Libbluray_selectPlaylistN Java_org_videolan_Libbluray_selectRateN Java_org_videolan_Libbluray_selectTitleN Java_org_videolan_Libbluray_setKeyInterestN Java_org_videolan_Libbluray_setUOMaskN Java_org_videolan_Libbluray_setVirtualPackageN Java_org_videolan_Libbluray_soundEffectN Java_org_videolan_Libbluray_tellTimeN Java_org_videolan_Libbluray_updateGraphicN Java_org_videolan_Libbluray_writeRegN Java_org_videolan_Logger_logN mpv_abort_async_command mpv_client_api_version mpv_client_id mpv_client_name mpv_command mpv_command_async mpv_command_node mpv_command_node_async mpv_command_ret mpv_command_string mpv_create mpv_create_client mpv_create_weak_client mpv_del_property mpv_destroy mpv_error_string mpv_event_name mpv_event_to_node mpv_free mpv_free_node_contents mpv_get_property mpv_get_property_async mpv_get_property_osd_string mpv_get_property_string mpv_get_time_ns mpv_get_time_us mpv_get_wakeup_pipe mpv_hook_add mpv_hook_continue mpv_initialize mpv_load_config_file mpv_observe_property mpv_render_context_create mpv_render_context_free mpv_render_context_get_info mpv_render_context_render mpv_render_context_report_swap mpv_render_context_set_parameter mpv_render_context_set_update_callback mpv_render_context_update mpv_request_event mpv_request_log_messages mpv_set_option mpv_set_option_string mpv_set_property mpv_set_property_async mpv_set_property_string mpv_set_wakeup_callback mpv_stream_cb_add_ro mpv_terminate_destroy mpv_unobserve_property mpv_wait_async_requests mpv_wait_event mpv_wakeup opus_decode opus_decode24 opus_decode_float opus_decoder_create opus_decoder_ctl opus_decoder_destroy opus_decoder_dred_decode opus_decoder_dred_decode24 opus_decoder_dred_decode_float opus_decoder_get_nb_samples opus_decoder_get_size opus_decoder_init opus_dred_alloc opus_dred_decoder_create opus_dred_decoder_ctl opus_dred_decoder_destroy opus_dred_decoder_get_size opus_dred_decoder_init opus_dred_free opus_dred_get_size opus_dred_parse opus_dred_process opus_encode opus_encode24 opus_encode_float opus_encoder_create opus_encoder_ctl opus_encoder_destroy opus_encoder_get_size opus_encoder_init opus_get_version_string opus_multistream_decode opus_multistream_decode24 opus_multistream_decode_float opus_multistream_decoder_create opus_multistream_decoder_ctl opus_multistream_decoder_destroy opus_multistream_decoder_get_size opus_multistream_decoder_init opus_multistream_encode opus_multistream_encode24 opus_multistream_encode_float opus_multistream_encoder_create opus_multistream_encoder_ctl opus_multistream_encoder_destroy opus_multistream_encoder_get_size opus_multistream_encoder_init opus_multistream_packet_pad opus_multistream_packet_unpad opus_multistream_surround_encoder_create opus_multistream_surround_encoder_get_size opus_multistream_surround_encoder_init opus_packet_get_bandwidth opus_packet_get_nb_channels opus_packet_get_nb_frames opus_packet_get_nb_samples opus_packet_get_samples_per_frame opus_packet_has_lbrr opus_packet_pad opus_packet_parse opus_packet_unpad opus_pcm_soft_clip opus_repacketizer_cat opus_repacketizer_create opus_repacketizer_destroy opus_repacketizer_get_nb_frames opus_repacketizer_get_size opus_repacketizer_init opus_repacketizer_out opus_repacketizer_out_range opus_strerror sixel_allocator_calloc sixel_allocator_free sixel_allocator_malloc sixel_allocator_new sixel_allocator_realloc sixel_allocator_ref sixel_allocator_tests_main sixel_allocator_unref sixel_dither_apply_palette sixel_dither_create sixel_dither_destroy sixel_dither_get sixel_dither_get_num_of_histgram_colors sixel_dither_get_num_of_histogram_colors sixel_dither_get_num_of_palette_colors sixel_dither_get_palette sixel_dither_initialize sixel_dither_new sixel_dither_ref sixel_dither_set_body_only sixel_dither_set_complexion_score sixel_dither_set_diffusion_type sixel_dither_set_optimize_palette sixel_dither_set_palette sixel_dither_set_pixelformat sixel_dither_set_transparent sixel_dither_tests_main sixel_dither_unref sixel_encode sixel_helper_compute_depth sixel_helper_format_error sixel_helper_get_additional_message sixel_helper_normalize_pixelformat sixel_helper_set_additional_message sixel_output_create sixel_output_destroy sixel_output_get_8bit_availability sixel_output_new sixel_output_ref sixel_output_set_8bit_availability sixel_output_set_encode_policy sixel_output_set_gri_arg_limit sixel_output_set_palette_type sixel_output_set_penetrate_multiplexer sixel_output_set_skip_dcs_envelope sixel_output_unref sixel_pixelformat_tests_main sixel_quant_tests_main sixel_status_tests_main

Name

.text

Size

91.7MB

Virtual Size

91.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

18.9MB

Virtual Size

18.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

157B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

428KB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

758KB

Virtual Size

758KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

305KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mpv.exe

IMPHASH 79851961fb23e86fe52a4d0249f8c654
SHA256 df5c50556c10450101eecd76c5c77a1ae256eaaec83b496596bb3495d459a23c
MD5 2cc565490f7744ccc2959e9576ced46c
SHA1 23d1b430a2b8fafc96a9a5dfb9440ea7754212c9
SHA512 701c07c88192df2340c06ed8aa9cdeba1b9993945b241ee9438b4399f260362e56030d65846af2ede968e0c5766ada5cc0df255efa307c91e9c59fae4d566888
SSDEEP 786432:wXaw1uFpHP3iiWzpUf/2QljYDyFBl0tmivXwng30vbtwzyYCU/6K7rpNOs8Nv/8k:6tziIDok+kO1vp
TLSH
T17D48AE97E2D35098D41AC5B5839AF722B9347C5987206AF722D887303F76BD06B7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/__w/mpv-winbuild-cmake/mpv-winbuild-cmake/build_x86_64_v3/packages/mpv-prefix/src/mpv-build/mpv.pdb

gdi32

ole32

user32

version

GetFileVersionInfoA GetFileVersionInfoSizeA GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueA VerQueryValueW

advapi32

shell32

CommandLineToArgvW DragAcceptFiles DragFinish DragQueryFileW SHGetFolderPathA SHGetFolderPathW SHGetKnownFolderPath SHGetSpecialFolderPathA ShellExecuteW

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI AttachConsole CancelIo CancelIoEx CloseHandle CompareStringA ConnectNamedPipe ConvertFiberToThread ConvertThreadToFiberEx CreateDirectoryW CreateEventA CreateEventW CreateFiberEx CreateFile2 CreateFileA CreateFileMappingA CreateFileW CreateMutexA CreateNamedPipeA CreateNamedPipeW CreateProcessW CreateSemaphoreA CreateSemaphoreW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DebugBreak DeleteCriticalSection DeleteFiber DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EnterCriticalSection EnumResourceNamesW ExitProcess FillConsoleOutputCharacterW FindClose FindFirstFileExA FindFirstFileExW FindFirstFileW FindNextFileA FindNextFileW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetActiveProcessorCount GetCommandLineW GetConsoleCP GetConsoleCursorInfo GetConsoleMode GetConsoleOutputCP GetConsoleScreenBufferInfo GetCurrentConsoleFont GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetEnvironmentStringsW GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileTime GetFileType GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocaleInfoA GetLogicalDrives GetLongPathNameA GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNumaHighestNodeNumber GetNumaNodeProcessorMaskEx GetNumberOfConsoleInputEvents GetOEMCP GetOverlappedResult GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetThreadContext GetThreadGroupAffinity GetThreadId GetThreadPriority GetThreadTimes GetTickCount GetTimeZoneInformation GetUserDefaultLocaleName GetUserPreferredUILanguages GetVersion GetWindowsDirectoryA GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSetInformation InitOnceBeginInitialize InitOnceComplete InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSRWLock InterlockedPushEntrySList IsDBCSLeadByte IsDebuggerPresent IsValidCodePage IsWow64Process LeaveCriticalSection LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile Module32FirstW Module32NextW MoveFileExA MoveFileExW MulDiv MultiByteToWideChar OpenFileMappingA OpenProcess OpenThread OutputDebugStringA OutputDebugStringW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleA ReadConsoleInputW ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCursorInfo SetConsoleCursorPosition SetConsoleMode SetConsoleOutputCP SetConsoleTextAttribute SetConsoleTitleW SetDllDirectoryW SetEnvironmentVariableA SetEnvironmentVariableW SetErrorMode SetEvent SetFileInformationByHandle SetFilePointer SetFilePointerEx SetLastError SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetSearchPathMode SetThreadAffinityMask SetThreadContext SetThreadErrorMode SetThreadExecutionState SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer SignalObjectAndWait SizeofResource Sleep SleepConditionVariableCS SleepConditionVariableSRW SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnmapViewOfFile UnregisterWait UpdateProcThreadAttribute VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleA WriteConsoleW WriteFile __C_specific_handler lstrcmpiW lstrcpyA lstrcpynA

oleaut32

OleCreatePropertyFrame SysFreeString SysStringLen

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

ntdll

NtQueryTimerResolution NtSetTimerResolution NtWriteFile RtlNtStatusToDosError

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsW

dwmapi

DwmEnableBlurBehindWindow DwmEnableMMCSS DwmFlush DwmGetCompositionTimingInfo DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

imm32

api-ms-win-core-path-l1-1-0

PathAllocCombine PathCchCanonicalizeEx PathCchRemoveFileSpec

shcore

GetDpiForMonitor

uxtheme

SetWindowTheme

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

opengl32

wglCreateContext wglDeleteContext wglGetProcAddress wglMakeCurrent

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vswprintf _chsize_s _close _dup _dup2 _fileno _fseeki64 _ftelli64 _get_osfhandle _isatty _lseeki64 _open _open_osfhandle _pclose _popen _read _setmode _sopen _wfopen _wopen _write _wsopen clearerr fclose feof ferror fflush fgetc fgets fgetwc fopen fopen_s fputc fputs fputwc fread freopen fseek ftell fwrite getc putchar puts rewind setbuf setvbuf tmpfile tmpnam ungetc ungetwc

api-ms-win-crt-environment-l1-1-0

__p__environ _putenv _wgetenv getenv getenv_s

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __p__acmdln __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_app_type _set_invalid_parameter_handler _wassert abort exit perror raise signal strerror strerror_s system

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

_isctype_l _strdup _stricmp _strlwr _strnicmp _strrev _strupr _wcsdup _wcsicmp _wcsnicmp isalnum isalpha isblank iscntrl isdigit isgraph islower isprint ispunct isspace isupper iswspace isxdigit mbrlen memcpy_s memset strcat strcmp strcpy strcspn strlen strncat strncat_s strncmp strncpy strncpy_s strnlen strpbrk strspn strtok strtok_s tolower toupper towupper wcscat wcscmp wcscoll wcscpy wcscpy_s wcslen wcsncmp wcsncpy wcsncpy_s wcsnlen

api-ms-win-crt-private-l1-1-0

__DestructExceptionObject __intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr strrchr strstr wcschr wcsrchr wcsstr

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_difftime64 _ftime64 _ftime64_s _gmtime64 _gmtime64_s _localtime64 _localtime64_s _mkgmtime64 _mktime64 _strftime_l _time64 _utime64 clock strftime

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

bsearch div ldiv lldiv qsort rand rand_s srand

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _aligned_realloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen _hypot _j1 acos acosf asin asinf asinhf atan atan2 atan2f atanf cbrt cbrtf ceilf cos cosf cosh erf erff exp exp2 exp2f expf expm1 fabs floor fmod fmodf frexp hypot llrint llroundf log log10 log10f log1p log1pf log2 log2f logf lrint lrintf lround lroundf modf modff nextafter pow powf remainder roundf sin sinf sinh sinhf sqrt sqrtf tan tanf tanh tanhf

api-ms-win-crt-multibyte-l1-1-0

_mbsrchr _mbtowc_l

bcrypt

shlwapi

PathRemoveFileSpecW SHCreateStreamOnFileA

dwrite

DWriteCreateFactory

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASendTo WSASetLastError WSASocketA WSAStartup WSAStringToAddressA __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname gethostname getnameinfo getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohl ntohs recv recvfrom select send sendto setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

avicap32

capCreateCaptureWindowA capGetDriverDescriptionA

winmm

setupapi

SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiEnumDeviceInterfaces SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiGetDeviceRegistryPropertyA

cfgmgr32

iphlpapi

if_nametoindex

crypt32

CertCloseStore CertFindCertificateInStore CertFreeCertificateContext CertOpenSystemStoreW

d2d1

D2D1CreateFactory

Name

.text

Size

94.2MB

Virtual Size

94.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19.4MB

Virtual Size

19.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

427KB

Virtual Size

13.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

755KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

176KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

268KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

yt-dlp.exe

IMPHASH b5fd7faade21e7a4651e8d3ddea32051
SHA256 3db811b366b2da47337d2fcfdfe5bbd9a258dad3f350c54974f005df115a1545
MD5 b20877630fd113c96d579e2488e2f3a5
SHA1 957fadcae18597e09d981fbd49e5ac9debe69178
SHA512 2ba9017431052ff5396598ce5e6c8b3984df816c5d858fd3aa8cd59a814f3b791c145cb4420153911ccb8ff40e8f0ad6a82aba08b7979d5fde22629aaaa07ad0
SSDEEP 393216:EpwtSd5gzULMYTzDtDfDgrc6paxi4JV1qsXxcjtjRvoivsG:Ep4S3Y4Dtb0IWaxJ1qsXxijhoK
TLSH
T10807334EBAC1A895C8FAD972146BCA30A172FC519309EE4ECF6C77872F875946137E10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation OpenProcessToken

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateProcessW CreateSymbolicLinkW DeleteCriticalSection DeleteFileW EnterCriticalSection ExpandEnvironmentStringsW FindClose FindFirstFileExW FindFirstFileW FindNextFileW FormatMessageW FreeLibrary GetCPInfo GetCommandLineW GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetDriveTypeW GetEnvironmentVariableW GetExitCodeProcess GetFinalPathNameByHandleW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetStartupInfoW GetTempPathW InitializeCriticalSection K32EnumProcessModules K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RemoveDirectoryW SetConsoleCtrlHandler SetDllDirectoryW SetErrorMode SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fileno _fmode _get_osfhandle _getpid _initterm _lock _snwprintf _stricmp _strnicmp _strdup _unlock _vsnwprintf _wcsdup _wcsdup _wcserror _wcsnicmp _wfopen _wfullpath _wputenv_s _wtempnam _wstat atexit abort calloc clearerr exit fclose feof ferror fflush fprintf fputc fputwc free fread fseek fwprintf fwrite iswctype ftell localeconv malloc mbstowcs memcmp memcpy realloc setbuf setvbuf signal strchr strcmp strcpy strerror strlen strncat strncmp strncpy strtol strtoul vfprintf wcscat wcschr wcscmp wcslen wcsncmp

user32

CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetMessageW GetWindowLongPtrW GetWindowThreadProcessId MsgWaitForMultipleObjects PeekMessageW RegisterClassW SetWindowLongPtrW ShowWindow ShutdownBlockReasonCreate TranslateMessage

Name

.text

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

43KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

188B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Harbor_0.9.20_x64-setup[1].exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

wsock32

user32

kernel32

generic

$PLUGINSDIR/StartMenu.dll

kernel32

user32

gdi32

shell32

ole32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/nsExec.dll

advapi32

user32

kernel32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

ffmpeg.exe

advapi32

avrt

bcrypt

crypt32

gdi32

iphlpapi

kernel32

msimg32

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ncrypt

ole32

oleaut32

shell32