General

Malware Config

Signatures

Files

• Spotify Premium.7z

  .7z
• Spotify Premium/DirectML.dll

  .dll windows:6 windows x64 arch:x64

  de90869f37e914fc01b99c913f65b5b5

  
  

  Code Sign

  33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  16-03-2023 18:43

  Not After

  14-03-2024 18:43

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6

  Signer

  Actual PE Digest

  8e:c2:0e:91:b0:b2:da:ff:23:0b:b8:11:5c:25:bc:77:30:e0:86:67:88:a5:b0:2e:23:e6:b7:eb:ef:67:54:a6

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  C:\__w\1\s\build\x64-win-redist-release\bin\DirectML.pdb

  Imports

  api-ms-win-core-debug-l1-1-0

  DebugBreak

  OutputDebugStringW

  IsDebuggerPresent

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-errorhandling-l1-1-0

  SetLastError

  GetLastError

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  RaiseException

  api-ms-win-core-heap-l1-1-0

  HeapAlloc

  HeapFree

  GetProcessHeap

  HeapSize

  HeapReAlloc

  api-ms-win-core-synch-l1-1-0

  WaitForSingleObject

  EnterCriticalSection

  LeaveCriticalSection

  InitializeCriticalSectionEx

  TryAcquireSRWLockExclusive

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  InitializeSRWLock

  DeleteCriticalSection

  ReleaseMutex

  ReleaseSemaphore

  WaitForSingleObjectEx

  InitializeCriticalSectionAndSpinCount

  CreateSemaphoreExW

  OpenSemaphoreW

  CreateMutexExW

  api-ms-win-core-processthreads-l1-1-0

  TlsSetValue

  TlsFree

  TlsGetValue

  TlsAlloc

  ExitProcess

  GetCurrentThreadId

  TerminateProcess

  GetCurrentProcessId

  GetStartupInfoW

  GetCurrentProcess

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleFileNameA

  GetModuleHandleExW

  GetModuleFileNameW

  LoadLibraryExW

  DisableThreadLibraryCalls

  LoadResource

  GetModuleHandleW

  LockResource

  GetProcAddress

  FreeLibrary

  api-ms-win-core-localization-l1-2-0

  GetOEMCP

  FormatMessageW

  GetLocaleInfoEx

  GetLocaleInfoW

  EnumSystemLocalesW

  GetUserDefaultLCID

  GetACP

  IsValidLocale

  LCMapStringW

  GetCPInfo

  LCMapStringEx

  IsValidCodePage

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceFrequency

  QueryPerformanceCounter

  api-ms-win-eventing-provider-l1-1-0

  EventWriteTransfer

  EventSetInformation

  EventUnregister

  EventRegister

  api-ms-win-core-libraryloader-l1-2-1

  FindResourceW

  LoadLibraryW

  api-ms-win-core-memory-l1-1-0

  VirtualFree

  VirtualAlloc

  d3d12

  D3D12SerializeVersionedRootSignature

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  CompareStringEx

  MultiByteToWideChar

  CompareStringW

  GetStringTypeW

  api-ms-win-core-util-l1-1-0

  EncodePointer

  DecodePointer

  api-ms-win-core-file-l1-1-0

  FindClose

  FindNextFileW

  CreateFileW

  SetFilePointerEx

  WriteFile

  FlushFileBuffers

  FindFirstFileExW

  GetFileType

  api-ms-win-core-fibers-l1-1-0

  FlsFree

  FlsSetValue

  FlsAlloc

  FlsGetValue

  api-ms-win-core-processthreads-l1-1-1

  IsProcessorFeaturePresent

  api-ms-win-core-sysinfo-l1-1-0

  GetSystemTimeAsFileTime

  api-ms-win-core-rtlsupport-l1-1-0

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlUnwindEx

  RtlPcToFileHeader

  RtlUnwind

  api-ms-win-core-interlocked-l1-1-0

  InterlockedFlushSList

  InitializeSListHead

  api-ms-win-core-processenvironment-l1-1-0

  SetEnvironmentVariableW

  GetCommandLineW

  GetCommandLineA

  GetEnvironmentStringsW

  GetStdHandle

  SetStdHandle

  FreeEnvironmentStringsW

  api-ms-win-core-datetime-l1-1-0

  GetDateFormatW

  GetTimeFormatW

  api-ms-win-core-console-l1-1-0

  GetConsoleMode

  GetConsoleOutputCP

  WriteConsoleW

  api-ms-win-core-timezone-l1-1-0

  GetTimeZoneInformation

  api-ms-win-appmodel-runtime-l1-1-0

  GetCurrentPackageFullName

  Exports

  Exports

  DMLCreateDevice

  DMLCreateDevice1

  Sections

  .text

  Size: 2.4MB - Virtual size: 2.4MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.7MB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 82KB - Virtual size: 97KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 114KB - Virtual size: 114KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 512B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 6.3MB - Virtual size: 6.3MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 35KB - Virtual size: 35KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/Installer.exe.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 4KB - Virtual size: 4KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/License.dll
• Spotify Premium/d3dcompiler_47.dll

  .dll windows:10 windows x64 arch:x64

  dc71769f237c0a3ba38879380c54a4e6

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2d:f8:dd:06:41:e0:b2:af:59:69:78:fa:5a:2b:28:9b:e2:27:f3:64:44:dd:1d:c6:3e:05:f0:29:0b:70:4c:49

  Signer

  Actual PE Digest

  2d:f8:dd:06:41:e0:b2:af:59:69:78:fa:5a:2b:28:9b:e2:27:f3:64:44:dd:1d:c6:3e:05:f0:29:0b:70:4c:49

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  b2:6c:a5:09:07:91:84:ef:24:0b:cb:e1:8e:54:00:6f:11:78:bd:e2

  Signer

  Actual PE Digest

  b2:6c:a5:09:07:91:84:ef:24:0b:cb:e1:8e:54:00:6f:11:78:bd:e2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D3DCompiler_47.pdb

  Imports

  kernel32

  WriteFile

  FreeLibrary

  Sleep

  TlsAlloc

  TlsSetValue

  HeapDestroy

  TlsGetValue

  TlsFree

  GetFullPathNameW

  GetFullPathNameA

  GetEnvironmentVariableA

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetProcAddress

  LoadLibraryExW

  SetLastError

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentThreadId

  GetStdHandle

  GetFileType

  GetStartupInfoW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeCriticalSectionAndSpinCount

  GetSystemTimeAsFileTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  ExitProcess

  GetModuleHandleW

  GetModuleHandleExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetFilePointerEx

  GetStringTypeW

  SetStdHandle

  ReadFile

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  RaiseException

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  GetModuleFileNameW

  ReadConsoleW

  HeapSize

  HeapReAlloc

  WriteConsoleW

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  RtlUnwindEx

  InterlockedFlushSList

  EncodePointer

  InitializeCriticalSectionEx

  RtlPcToFileHeader

  LocalAlloc

  LocalFree

  GetFileSizeEx

  GetLastError

  CreateFileW

  HeapFree

  GetProcessHeap

  UnmapViewOfFile

  GetFileSize

  CreateFileMappingW

  MapViewOfFile

  GetFileAttributesW

  SetFileAttributesW

  DeleteFileW

  SetEndOfFile

  DeviceIoControl

  MapViewOfFileEx

  CreateFileMappingA

  ExpandEnvironmentStringsW

  HeapAlloc

  OutputDebugStringA

  CloseHandle

  LeaveCriticalSection

  EnterCriticalSection

  lstrcmpiA

  HeapCreate

  GetModuleFileNameA

  CreateFileA

  DeleteCriticalSection

  InitializeCriticalSection

  WideCharToMultiByte

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetCommandLineA

  GetCommandLineW

  GetDriveTypeW

  GetCurrentDirectoryW

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  MultiByteToWideChar

  GetEnvironmentStringsW

  DisableThreadLibraryCalls

  advapi32

  CryptDestroyHash

  CryptAcquireContextW

  RegQueryValueExA

  RegEnumKeyExA

  RegOpenKeyExA

  CryptGetHashParam

  CryptCreateHash

  CryptHashData

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  CryptReleaseContext

  rpcrt4

  UuidCreate

  Exports

  Exports

  D3DAssemble

  D3DCompile

  D3DCompile2

  D3DCompileFromFile

  D3DCompressShaders

  D3DCreateBlob

  D3DCreateFunctionLinkingGraph

  D3DCreateLinker

  D3DDecompressShaders

  D3DDisassemble

  D3DDisassemble10Effect

  D3DDisassemble11Trace

  D3DDisassembleRegion

  D3DGetBlobPart

  D3DGetDebugInfo

  D3DGetInputAndOutputSignatureBlob

  D3DGetInputSignatureBlob

  D3DGetOutputSignatureBlob

  D3DGetTraceInstructionOffsets

  D3DLoadModule

  D3DPreprocess

  D3DReadFileToBlob

  D3DReflect

  D3DReflectLibrary

  D3DReturnFailure1

  D3DSetBlobPart

  D3DStripShader

  D3DWriteBlobToFile

  DebugSetMute

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 912KB - Virtual size: 911KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 64KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 128KB - Virtual size: 127KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 36KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/installer.db
• Spotify Premium/libG1LESv2.dll
• Spotify Premium/locales/bn.pak
• Spotify Premium/locales/ca.pak
• Spotify Premium/locales/da.pak
• Spotify Premium/locales/de.pak

  .ps1
• Spotify Premium/locales/el.pak
• Spotify Premium/locales/en-GB.pak
• Spotify Premium/locales/en-US.pak
• Spotify Premium/locales/es-419.pak
• Spotify Premium/locales/es.pak
• Spotify Premium/locales/et.pak
• Spotify Premium/locales/fa.pak
• Spotify Premium/locales/fi.pak
• Spotify Premium/locales/fil.pak
• Spotify Premium/locales/fr.pak
• Spotify Premium/locales/gu.pak
• Spotify Premium/locales/he.pak
• Spotify Premium/locales/hi.pak
• Spotify Premium/locales/hr.pak
• Spotify Premium/main.cfg
• Spotify Premium/onnxruntime.dll

  .dll windows:6 windows x64 arch:x64

  39e1a29a795654c064e5e6ee1d09c320

  
  

  Code Sign

  33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  16-03-2023 18:43

  Not After

  14-03-2024 18:43

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  c6:c5:5b:e5:7b:f8:7b:45:cb:d8:d9:84:05:84:44:65:96:e9:58:cd:b4:7b:83:93:1e:94:56:6e:fb:19:4e:24

  Signer

  Actual PE Digest

  c6:c5:5b:e5:7b:f8:7b:45:cb:d8:d9:84:05:84:44:65:96:e9:58:cd:b4:7b:83:93:1e:94:56:6e:fb:19:4e:24

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\a\_work\1\b\RelWithDebInfo\RelWithDebInfo\onnxruntime.pdb

  Imports

  api-ms-win-core-file-l1-1-0

  RemoveDirectoryW

  GetFinalPathNameByHandleW

  GetFileAttributesW

  ReadFile

  FindNextFileW

  CreateDirectoryW

  GetFileAttributesA

  DeleteFileW

  GetFullPathNameW

  SetFilePointerEx

  CreateDirectoryA

  FindClose

  GetFileSizeEx

  FindFirstFileW

  api-ms-win-core-errorhandling-l1-1-0

  RaiseException

  UnhandledExceptionFilter

  SetLastError

  SetUnhandledExceptionFilter

  GetLastError

  api-ms-win-core-string-l1-1-0

  WideCharToMultiByte

  MultiByteToWideChar

  api-ms-win-core-processenvironment-l1-1-0

  GetEnvironmentVariableA

  msvcp140

  ??7ios_base@std@@QEBA_NXZ

  ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ

  ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@I@Z

  ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z

  ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ?_Throw_Cpp_error@std@@YAXH@Z

  ?_Xlength_error@std@@YAXPEBD@Z

  _Mtx_destroy_in_situ

  _Mtx_lock

  _Mtx_init_in_situ

  _Mtx_unlock

  ?eof@ios_base@std@@QEBA_NXZ

  ?good@ios_base@std@@QEBA_NXZ

  ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

  ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z

  ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ

  ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

  ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

  ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

  ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z

  ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

  ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z

  ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

  ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z

  ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ?_Xout_of_range@std@@YAXPEBD@Z

  ?uncaught_exception@std@@YA_NXZ

  ?_Xbad_function_call@std@@YAXXZ

  ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z

  ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ

  ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ

  ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z

  ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z

  ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

  ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ

  ??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z

  ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

  ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

  ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAAXXZ

  ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ

  ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAGXZ

  ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z

  ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z

  ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAPEAV12@PEA_W_J@Z

  ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAHXZ

  ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z

  ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

  ??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ

  _Mbrtowc

  ?_Xbad_alloc@std@@YAXXZ

  ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z

  ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

  ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

  ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

  ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

  ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z

  ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ

  ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

  ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z

  ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ

  ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z

  ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ

  ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ

  ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAF@Z

  ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z

  ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z

  ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z

  _Xtime_get_ticks

  _Query_perf_counter

  ?id@?$ctype@D@std@@2V0locale@2@A

  ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

  ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A

  ?_Xinvalid_argument@std@@YAXPEBD@Z

  ?id@?$ctype@_W@std@@2V0locale@2@A

  ?classic@locale@std@@SAAEBV12@XZ

  ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

  ??0_Lockit@std@@QEAA@H@Z

  ??1_Lockit@std@@QEAA@XZ

  _Query_perf_frequency

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z

  ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z

  ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z

  ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?widen@?$ctype@_W@std@@QEBA_WD@Z

  ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?always_noconv@codecvt_base@std@@QEBA_NXZ

  ??Bid@locale@std@@QEAA_KXZ

  ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z

  ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z

  ??0_Locinfo@std@@QEAA@PEBD@Z

  ??1_Locinfo@std@@QEAA@XZ

  ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ

  ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ

  ??0facet@locale@std@@IEAA@_K@Z

  ??1facet@locale@std@@MEAA@XZ

  ??Bios_base@std@@QEBA_NXZ

  ?imbue@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAA?AVlocale@2@AEBV32@@Z

  ?put@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@2@V32@AEAVios_base@2@_WPEBUtm@@PEB_W4@Z

  ?_Getcat@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

  ?id@?$numpunct@_W@std@@2V0locale@2@A

  ?id@?$time_put@_WV?$ostreambuf_iterator@_WU?$char_traits@_W@std@@@std@@@std@@2V0locale@2@A

  _Thrd_id

  ?wclog@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A

  ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z

  ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z

  ?_Syserror_map@std@@YAPEBDH@Z

  ?_Winerror_map@std@@YAHH@Z

  ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z

  ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z

  ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z

  ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A

  ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z

  ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ

  ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z

  ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z

  ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z

  ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z

  ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

  ?_Incref@facet@locale@std@@UEAAXXZ

  ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

  ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

  _Thrd_hardware_concurrency

  ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z

  vcruntime140_1

  __CxxFrameHandler4

  vcruntime140

  __C_specific_handler

  strchr

  __std_terminate

  __current_exception

  _purecall

  __std_exception_copy

  __std_exception_destroy

  __std_type_info_compare

  memcpy

  __std_type_info_name

  memchr

  __RTtypeid

  __std_type_info_destroy_list

  __current_exception_context

  memmove

  memset

  _CxxThrowException

  memcmp

  api-ms-win-crt-runtime-l1-1-0

  _register_onexit_function

  _initialize_onexit_table

  abort

  _initialize_narrow_environment

  _configure_narrow_argv

  _invalid_parameter_noinfo_noreturn

  __doserrno

  _beginthreadex

  _set_doserrno

  _errno

  strerror_s

  _seh_filter_dll

  _initterm_e

  _initterm

  strerror

  _invalid_parameter_noinfo

  _crt_atexit

  _get_errno

  terminate

  _cexit

  _execute_onexit_table

  _set_errno

  api-ms-win-crt-stdio-l1-1-0

  _wsopen_s

  fclose

  _write

  _close

  fputc

  __stdio_common_vswprintf

  _read

  __stdio_common_vsnprintf_s

  _get_stream_buffer_pointers

  _fseeki64

  fread

  fsetpos

  fgetc

  __stdio_common_vsprintf

  fwrite

  fflush

  __acrt_iob_func

  _sopen_s

  __stdio_common_vsprintf_s

  ungetc

  setvbuf

  fgetpos

  __stdio_common_vfprintf

  api-ms-win-crt-string-l1-1-0

  isalpha

  isalnum

  strncmp

  towlower

  iswspace

  toupper

  tolower

  _towlower_l

  _strnicmp

  strcmp

  isdigit

  isspace

  strnlen

  _towupper_l

  api-ms-win-crt-convert-l1-1-0

  strtoull

  strtod

  strtoll

  atoi

  strtol

  strtof

  _strtoi64

  api-ms-win-crt-filesystem-l1-1-0

  _lock_file

  _fstat64i32

  _wstat64

  _unlock_file

  api-ms-win-crt-heap-l1-1-0

  malloc

  _callnewh

  free

  _aligned_free

  calloc

  _aligned_malloc

  api-ms-win-core-synch-l1-2-0

  InitOnceBeginInitialize

  WakeConditionVariable

  InitOnceComplete

  Sleep

  WakeAllConditionVariable

  SleepConditionVariableSRW

  api-ms-win-core-synch-l1-1-0

  ReleaseSRWLockShared

  AcquireSRWLockShared

  AcquireSRWLockExclusive

  ReleaseSRWLockExclusive

  CreateSemaphoreExW

  ReleaseSemaphore

  CreateEventW

  CreateMutexExW

  OpenSemaphoreW

  WaitForSingleObjectEx

  ReleaseMutex

  WaitForSingleObject

  api-ms-win-core-rtlsupport-l1-1-0

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  RtlCaptureContext

  api-ms-win-core-processthreads-l1-1-0

  GetCurrentProcessId

  TerminateProcess

  GetCurrentThreadId

  GetCurrentThread

  GetCurrentProcess

  api-ms-win-core-processthreads-l1-1-1

  GetCurrentProcessorNumber

  IsProcessorFeaturePresent

  api-ms-win-core-profile-l1-1-0

  QueryPerformanceCounter

  api-ms-win-core-sysinfo-l1-1-0

  GetLogicalProcessorInformationEx

  GetSystemTimeAsFileTime

  GetSystemInfo

  api-ms-win-core-interlocked-l1-1-0

  InitializeSListHead

  api-ms-win-core-debug-l1-1-0

  OutputDebugStringW

  DebugBreak

  IsDebuggerPresent

  api-ms-win-core-libraryloader-l1-2-0

  GetModuleFileNameA

  GetModuleHandleExW

  GetModuleHandleA

  GetModuleFileNameW

  LoadLibraryExA

  GetModuleHandleW

  LoadLibraryExW

  GetProcAddress

  FreeLibrary

  api-ms-win-core-heap-l1-1-0

  GetProcessHeap

  HeapFree

  HeapAlloc

  api-ms-win-core-localization-l1-2-0

  GetLocaleInfoEx

  FormatMessageA

  FormatMessageW

  api-ms-win-core-handle-l1-1-0

  CloseHandle

  api-ms-win-core-memory-l1-1-0

  UnmapViewOfFile

  VirtualAlloc

  MapViewOfFile

  VirtualQuery

  VirtualProtect

  CreateFileMappingW

  VirtualFree

  api-ms-win-core-file-l1-2-0

  CreateFile2

  api-ms-win-core-processtopology-l1-1-0

  SetThreadGroupAffinity

  api-ms-win-core-path-l1-1-0

  PathCchRemoveFileSpec

  PathCchRemoveBackslash

  api-ms-win-eventing-provider-l1-1-0

  EventRegister

  EventWriteTransfer

  EventUnregister

  EventSetInformation

  api-ms-win-core-sysinfo-l1-2-0

  GetSystemTimePreciseAsFileTime

  api-ms-win-crt-time-l1-1-0

  _difftime64

  _mktime64

  _gmtime64_s

  wcsftime

  _localtime64_s

  api-ms-win-crt-locale-l1-1-0

  localeconv

  _free_locale

  _create_locale

  api-ms-win-crt-math-l1-1-0

  acosf

  exp

  expf

  _ldclass

  _fdclass

  _dclass

  sin

  sinf

  floor

  floorf

  atanf

  sinhf

  fmod

  sqrt

  ceil

  sqrtf

  fmodf

  log

  log10

  asinf

  ceilf

  log2

  _ldsign

  llroundl

  _fdsign

  asinhf

  atanhf

  acoshf

  log1pf

  nearbyintf

  remainderf

  rintf

  rint

  cos

  tanhf

  logf

  cosf

  ilogbf

  scalbn

  ilogb

  scalbnf

  tanf

  ldexp

  fmax

  roundf

  pow

  powf

  tanh

  coshf

  _dsign

  api-ms-win-core-heap-l2-1-0

  LocalFree

  api-ms-win-core-libraryloader-l1-2-1

  LoadLibraryW

  Exports

  Exports

  OrtGetApiBase

  OrtGetWinMLAdapter

  OrtSessionOptionsAppendExecutionProviderEx_DML

  OrtSessionOptionsAppendExecutionProvider_CPU

  OrtSessionOptionsAppendExecutionProvider_DML

  Sections

  .text

  Size: 9.0MB - Virtual size: 9.0MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 2.8MB - Virtual size: 2.8MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 377KB - Virtual size: 391KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 293KB - Virtual size: 292KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .didat

  Size: 512B - Virtual size: 128B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  _RDATA

  Size: 3KB - Virtual size: 2KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 59KB - Virtual size: 58KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/onnxruntime.lib
• Spotify Premium/resources/LICENSES.chromium.html
• Spotify Premium/resources/app.asar
• Spotify Premium/resources/app.asar.unpacked/node_modules/btime/binding.node

  .dll windows:6 windows x64 arch:x64

  0242ceb286e744ddd6dd8e963da637ee

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\Projects\obsidian-stage\electron\btime\build\Release\binding.pdb

  Imports

  kernel32

  GetModuleHandleA

  SetFileTime

  CreateFileW

  MultiByteToWideChar

  GetLastError

  CloseHandle

  LoadLibraryExA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  InterlockedFlushSList

  SetLastError

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapFree

  HeapAlloc

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  LCMapStringW

  GetProcessHeap

  GetStdHandle

  GetFileType

  GetStringTypeW

  HeapSize

  HeapReAlloc

  SetStdHandle

  FlushFileBuffers

  WriteFile

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  WriteConsoleW

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  Exports

  Exports

  _register_binding_

  Sections

  .text

  Size: 64KB - Virtual size: 64KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/resources/app.asar.unpacked/node_modules/get-fonts/binding.node

  .dll windows:6 windows x64 arch:x64

  2a1b9a0a23b390c22659b30f7660d0da

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\Projects\obsidian-stage\electron\get-fonts\build\Release\binding.pdb

  Imports

  kernel32

  LoadLibraryExA

  WideCharToMultiByte

  GetUserDefaultLocaleName

  GetModuleHandleA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  GetModuleHandleW

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  InterlockedFlushSList

  GetLastError

  SetLastError

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  GetProcAddress

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  LCMapStringW

  GetProcessHeap

  GetStdHandle

  GetFileType

  GetStringTypeW

  HeapSize

  HeapReAlloc

  SetStdHandle

  FlushFileBuffers

  WriteFile

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  CreateFileW

  CloseHandle

  WriteConsoleW

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  dwrite

  DWriteCreateFactory

  Exports

  Exports

  _register_binding_

  Sections

  .text

  Size: 69KB - Virtual size: 69KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/resources/app.asar.unpacked/node_modules/vibrancy-win/binding.node

  .dll windows:6 windows x64 arch:x64

  56e83fb6e818a708f7895cf9d6058c3a

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D:\Projects\obsidian-stage\electron\vibrancy-win\build\Release\binding.pdb

  Imports

  kernel32

  GetModuleHandleA

  GetProcAddress

  GetModuleHandleW

  LoadLibraryExA

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  QueryPerformanceCounter

  GetCurrentProcessId

  GetCurrentThreadId

  GetSystemTimeAsFileTime

  InitializeSListHead

  IsDebuggerPresent

  GetStartupInfoW

  RtlUnwindEx

  RtlPcToFileHeader

  RaiseException

  InterlockedFlushSList

  GetLastError

  SetLastError

  EncodePointer

  EnterCriticalSection

  LeaveCriticalSection

  DeleteCriticalSection

  InitializeCriticalSectionAndSpinCount

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  FreeLibrary

  LoadLibraryExW

  ExitProcess

  GetModuleHandleExW

  GetModuleFileNameW

  HeapAlloc

  HeapFree

  FindClose

  FindFirstFileExW

  FindNextFileW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  MultiByteToWideChar

  WideCharToMultiByte

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  LCMapStringW

  GetProcessHeap

  GetStdHandle

  GetFileType

  GetStringTypeW

  HeapSize

  HeapReAlloc

  SetStdHandle

  FlushFileBuffers

  WriteFile

  GetConsoleOutputCP

  GetConsoleMode

  SetFilePointerEx

  CreateFileW

  CloseHandle

  WriteConsoleW

  GetSystemInfo

  VirtualProtect

  VirtualQuery

  Exports

  Exports

  _register_binding_

  Sections

  .text

  Size: 64KB - Virtual size: 63KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 41KB - Virtual size: 41KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 3KB - Virtual size: 7KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 5KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  _RDATA

  Size: 512B - Virtual size: 148B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 512B - Virtual size: 480B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/resources/d3dcompiler_47.dll

  .dll windows:10 windows x64 arch:x64

  dc71769f237c0a3ba38879380c54a4e6

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  2d:f8:dd:06:41:e0:b2:af:59:69:78:fa:5a:2b:28:9b:e2:27:f3:64:44:dd:1d:c6:3e:05:f0:29:0b:70:4c:49

  Signer

  Actual PE Digest

  2d:f8:dd:06:41:e0:b2:af:59:69:78:fa:5a:2b:28:9b:e2:27:f3:64:44:dd:1d:c6:3e:05:f0:29:0b:70:4c:49

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  b2:6c:a5:09:07:91:84:ef:24:0b:cb:e1:8e:54:00:6f:11:78:bd:e2

  Signer

  Actual PE Digest

  b2:6c:a5:09:07:91:84:ef:24:0b:cb:e1:8e:54:00:6f:11:78:bd:e2

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  D3DCompiler_47.pdb

  Imports

  kernel32

  WriteFile

  FreeLibrary

  Sleep

  TlsAlloc

  TlsSetValue

  HeapDestroy

  TlsGetValue

  TlsFree

  GetFullPathNameW

  GetFullPathNameA

  GetEnvironmentVariableA

  VirtualFree

  VirtualAlloc

  GetSystemInfo

  GetProcAddress

  LoadLibraryExW

  SetLastError

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlVirtualUnwind

  IsDebuggerPresent

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  GetCurrentProcess

  TerminateProcess

  IsProcessorFeaturePresent

  GetCurrentThreadId

  GetStdHandle

  GetFileType

  GetStartupInfoW

  FlsAlloc

  FlsGetValue

  FlsSetValue

  FlsFree

  InitializeCriticalSectionAndSpinCount

  GetSystemTimeAsFileTime

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  EnumSystemLocalesW

  ExitProcess

  GetModuleHandleW

  GetModuleHandleExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetCPInfo

  SetFilePointerEx

  GetStringTypeW

  SetStdHandle

  ReadFile

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  RaiseException

  FlushFileBuffers

  GetConsoleOutputCP

  GetConsoleMode

  GetModuleFileNameW

  ReadConsoleW

  HeapSize

  HeapReAlloc

  WriteConsoleW

  QueryPerformanceCounter

  GetCurrentProcessId

  InitializeSListHead

  RtlUnwindEx

  InterlockedFlushSList

  EncodePointer

  InitializeCriticalSectionEx

  RtlPcToFileHeader

  LocalAlloc

  LocalFree

  GetFileSizeEx

  GetLastError

  CreateFileW

  HeapFree

  GetProcessHeap

  UnmapViewOfFile

  GetFileSize

  CreateFileMappingW

  MapViewOfFile

  GetFileAttributesW

  SetFileAttributesW

  DeleteFileW

  SetEndOfFile

  DeviceIoControl

  MapViewOfFileEx

  CreateFileMappingA

  ExpandEnvironmentStringsW

  HeapAlloc

  OutputDebugStringA

  CloseHandle

  LeaveCriticalSection

  EnterCriticalSection

  lstrcmpiA

  HeapCreate

  GetModuleFileNameA

  CreateFileA

  DeleteCriticalSection

  InitializeCriticalSection

  WideCharToMultiByte

  FindClose

  FindFirstFileExW

  FindNextFileW

  GetCommandLineA

  GetCommandLineW

  GetDriveTypeW

  GetCurrentDirectoryW

  SetEvent

  ResetEvent

  WaitForSingleObjectEx

  CreateEventW

  MultiByteToWideChar

  GetEnvironmentStringsW

  DisableThreadLibraryCalls

  advapi32

  CryptDestroyHash

  CryptAcquireContextW

  RegQueryValueExA

  RegEnumKeyExA

  RegOpenKeyExA

  CryptGetHashParam

  CryptCreateHash

  CryptHashData

  RegQueryValueExW

  RegOpenKeyExW

  RegCloseKey

  CryptReleaseContext

  rpcrt4

  UuidCreate

  Exports

  Exports

  D3DAssemble

  D3DCompile

  D3DCompile2

  D3DCompileFromFile

  D3DCompressShaders

  D3DCreateBlob

  D3DCreateFunctionLinkingGraph

  D3DCreateLinker

  D3DDecompressShaders

  D3DDisassemble

  D3DDisassemble10Effect

  D3DDisassemble11Trace

  D3DDisassembleRegion

  D3DGetBlobPart

  D3DGetDebugInfo

  D3DGetInputAndOutputSignatureBlob

  D3DGetInputSignatureBlob

  D3DGetOutputSignatureBlob

  D3DGetTraceInstructionOffsets

  D3DLoadModule

  D3DPreprocess

  D3DReadFileToBlob

  D3DReflect

  D3DReflectLibrary

  D3DReturnFailure1

  D3DSetBlobPart

  D3DStripShader

  D3DWriteBlobToFile

  DebugSetMute

  Sections

  .text

  Size: 3.5MB - Virtual size: 3.5MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 912KB - Virtual size: 911KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 64KB - Virtual size: 100KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 128KB - Virtual size: 127KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 4KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 36KB - Virtual size: 34KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/resources/ffmpeg.dll

  .dll windows:5 windows x64 arch:x64

  14338d2168d869b1b53d66354179e8c5

  
  

  Code Sign

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

  Certificate

  Issuer

  CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

  Not Before

  25-05-2021 00:00

  Not After

  31-12-2028 23:59

  Subject

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9c:90:57:dc:1e:df:33:b0:32:69:ff:6e:54:dc:f1:57

  Certificate

  Issuer

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Not Before

  15-10-2021 00:00

  Not After

  14-10-2024 23:59

  Subject

  CN=Dynalist Inc,O=Dynalist Inc,ST=Ontario,C=CA

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a

  Certificate

  Issuer

  CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

  Not Before

  22-03-2021 00:00

  Not After

  21-03-2036 23:59

  Subject

  CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  21-09-2022 00:00

  Not After

  21-11-2033 23:59

  Subject

  CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  93:ff:ec:ac:52:29:4a:93:b7:ec:c5:f8:9b:5f:2e:c7:01:cc:e8:fd:76:d1:9c:39:b3:9c:a6:4b:a5:a4:1d:1e

  Signer

  Actual PE Digest

  93:ff:ec:ac:52:29:4a:93:b7:ec:c5:f8:9b:5f:2e:c7:01:cc:e8:fd:76:d1:9c:39:b3:9c:a6:4b:a5:a4:1d:1e

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  d7:f3:d1:71:d3:a4:7e:1d:40:93:13:69:a4:d4:9d:5f:be:4a:bd:5c

  Signer

  Actual PE Digest

  d7:f3:d1:71:d3:a4:7e:1d:40:93:13:69:a4:d4:9d:5f:be:4a:bd:5c

  Digest Algorithm

  sha1

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_DLL

  PDB Paths

  ffmpeg.dll.pdb

  Imports

  kernel32

  AcquireSRWLockExclusive

  CloseHandle

  CompareStringW

  CreateEventW

  CreateFileW

  CreateThread

  DeleteCriticalSection

  EncodePointer

  EnterCriticalSection

  EnumSystemLocalesW

  ExitProcess

  ExitThread

  FindClose

  FindFirstFileExW

  FindNextFileW

  FlsAlloc

  FlsFree

  FlsGetValue

  FlsSetValue

  FlushFileBuffers

  FreeEnvironmentStringsW

  FreeLibrary

  FreeLibraryAndExitThread

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThreadId

  GetDateFormatW

  GetEnvironmentStringsW

  GetFileSizeEx

  GetFileType

  GetLastError

  GetLocaleInfoW

  GetModuleFileNameW

  GetModuleHandleExW

  GetModuleHandleW

  GetOEMCP

  GetProcAddress

  GetProcessAffinityMask

  GetProcessHeap

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemTimeAsFileTime

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  HeapAlloc

  HeapFree

  HeapQueryInformation

  HeapReAlloc

  HeapSize

  InitOnceBeginInitialize

  InitOnceComplete

  InitializeConditionVariable

  InitializeCriticalSectionAndSpinCount

  InitializeSListHead

  InitializeSRWLock

  InterlockedFlushSList

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExW

  MultiByteToWideChar

  QueryPerformanceCounter

  QueryPerformanceFrequency

  RaiseException

  ReadConsoleW

  ReadFile

  ReleaseSRWLockExclusive

  ResetEvent

  RtlCaptureContext

  RtlLookupFunctionEntry

  RtlPcToFileHeader

  RtlUnwind

  RtlUnwindEx

  RtlVirtualUnwind

  SetEnvironmentVariableW

  SetEvent

  SetFilePointerEx

  SetLastError

  SetStdHandle

  SetUnhandledExceptionFilter

  Sleep

  SleepConditionVariableSRW

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UnhandledExceptionFilter

  WaitForSingleObjectEx

  WakeAllConditionVariable

  WakeConditionVariable

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  Exports

  Exports

  av_buffer_create

  av_buffer_get_opaque

  av_dict_count

  av_dict_free

  av_dict_get

  av_dict_set

  av_force_cpu_flags

  av_frame_alloc

  av_frame_clone

  av_frame_free

  av_frame_unref

  av_free

  av_get_bytes_per_sample

  av_get_cpu_flags

  av_image_check_size

  av_init_packet

  av_log_set_level

  av_malloc

  av_max_alloc

  av_new_packet

  av_packet_alloc

  av_packet_copy_props

  av_packet_free

  av_packet_get_side_data

  av_packet_unref

  av_rdft_calc

  av_rdft_end

  av_rdft_init

  av_read_frame

  av_rescale_q

  av_samples_get_buffer_size

  av_seek_frame

  av_stream_get_first_dts

  av_stream_get_side_data

  av_strerror

  avcodec_align_dimensions

  avcodec_alloc_context3

  avcodec_descriptor_get

  avcodec_descriptor_next

  avcodec_find_decoder

  avcodec_flush_buffers

  avcodec_free_context

  avcodec_get_name

  avcodec_open2

  avcodec_parameters_to_context

  avcodec_receive_frame

  avcodec_send_packet

  avformat_alloc_context

  avformat_close_input

  avformat_find_stream_info

  avformat_free_context

  avformat_open_input

  avio_alloc_context

  avio_close

  Sections

  .text

  Size: 2.1MB - Virtual size: 2.1MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 459KB - Virtual size: 459KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 8KB - Virtual size: 1.4MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .pdata

  Size: 43KB - Virtual size: 42KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .00cfg

  Size: 512B - Virtual size: 40B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .gxfg

  Size: 11KB - Virtual size: 10KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .retplne

  Size: 512B - Virtual size: 92B

  .tls

  Size: 512B - Virtual size: 9B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .voltbl

  Size: 512B - Virtual size: 56B

  _RDATA

  Size: 512B - Virtual size: 244B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 12KB - Virtual size: 11KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• Spotify Premium/resources/resources.pak
• Spotify Premium/resources/sadasdads.bin
• Spotify Premium/ssl/cacert.pem