Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
24d83f3d679775a6b7f364a0edb5f5264d046c71559b5a30804c5c10abfda591.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
24d83f3d679775a6b7f364a0edb5f5264d046c71559b5a30804c5c10abfda591.exe
Resource
win10v2004-20220812-en
Target
24d83f3d679775a6b7f364a0edb5f5264d046c71559b5a30804c5c10abfda591
Size
107KB
MD5
1ba5651c6afd6062da556d32c52313e0
SHA1
064debf6b974fa92016897d4e9a05a54ada8fea7
SHA256
24d83f3d679775a6b7f364a0edb5f5264d046c71559b5a30804c5c10abfda591
SHA512
9af3d2ec24e674008c06716a2efc8d585fefa9f4bbae9cd02578b2f9535274d6cfd82af9ea44b975b59deb7812b518c228f6b0783532ac6887604736f650d094
SSDEEP
1536:ql2GemE+XY63I+eRk5g9F2SdcJvs7YnCezmvldyxx4ogHWlOa/c5jACisKldd:OHeQXYmg9F2UpezmvlUxiXWlOagAf5
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?alert@AcDbHostApplicationServices@@UBEXPB_W@Z
?getSubstituteFont@AcDbHostApplicationServices@@UAEHPAPA_WPA_WHH@Z
?_entToWorldTransform@AcDbHostApplicationServices@@UAEHQANPAUflagmat@@@Z
?serializeOleItem@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@PAVCOleClientItem@@PAVCArchive@@@Z
?getNewOleClientItem@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPAVCOleClientItem@@@Z
?drawOleOwnerDrawItem@AcDbHostApplicationServices@@UAEXPAVCOleClientItem@@JJJJJ@Z
?launchBrowserDialog@AcDbHostApplicationServices@@UBEHPA_WPB_W111H@Z
?putRemoteFile@AcDbHostApplicationServices@@UBE?AW4ErrorStatus@Acad@@PB_W0@Z
?getRemoteFile@AcDbHostApplicationServices@@UBE?AW4ErrorStatus@Acad@@PB_WPA_WH@Z
?isRemoteFile@AcDbHostApplicationServices@@UBEHPB_WPA_W@Z
?auditPrintReport@AcDbHostApplicationServices@@UBEXPAVAcDbAuditInfo@@PB_WH@Z
?missingCryptoProviderMsg@AcDbHostApplicationServices@@UAEXXZ
?getRegistryProductLCID@AcDbHostApplicationServices@@UAEKXZ
?plotSettingsValidator@AcDbHostApplicationServices@@UBEPAVAcDbPlotSettingsValidator@@XZ
?layoutManager@AcDbHostApplicationServices@@UBEPAVAcDbLayoutManager@@XZ
?usedPasswordFromCacheMsg@AcDbHostApplicationServices@@UAEXPB_W@Z
?loadApp@AcDbHostApplicationServices@@UAE_NPB_WW4LoadReasons@AcadApp@@_N2@Z
?getDefaultPlotCfgInfo@AcDbHostApplicationServices@@UAEXPA_W0@Z
?signingComplete@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@W423@PB_WPA_N@Z
?getPassword@AcDbHostApplicationServices@@UAE_NPB_WW4PasswordOptions@1@PA_WI@Z
?getRegistryProductRootKey@AcDbHostApplicationServices@@UAEPB_WXZ
?versionString@AcDbHostApplicationServices@@UAEPB_WXZ
?releaseMinorVersion@AcDbHostApplicationServices@@UAEHXZ
?releaseMajorVersion@AcDbHostApplicationServices@@UAEHXZ
?releaseMajorMinorString@AcDbHostApplicationServices@@UAEPB_WXZ
?freeRawMem@AcHeapOperators@@CGXPAX@Z
??0AcDbDatabase@@QAE@_N0@Z
?isURL@AcDbHostApplicationServices@@UBEHPB_W@Z
?dxfIn@AcDbDatabase@@QAE?AW4ErrorStatus@Acad@@PB_W0@Z
?acdbReadDwgFile@@YG?AW4ErrorStatus@Acad@@PAVAcDbDatabase@@PB_WH1@Z
?acdbGetSummaryInfo@@YG?AW4ErrorStatus@Acad@@PAVAcDbDatabase@@AAPAVAcDbDatabaseSummaryInfo@@@Z
?acdbStripMTextFormatting@@YAPA_WPB_WVAcDbObjectId@@H@Z
?readDwgStringsStart@AcHsUtil@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAPAVAcFsByteReader@@AAPAV?$AcHsTrie@K@@AAPAV?$AcHsTrieIterator@K@@AAVAcHsObjStringNotifier@@@Z
?readDwgStringsChunk@AcHsUtil@@YA_NHPAVAcFsByteReader@@AAPAV?$AcHsTrieIterator@K@@AAVAcHsObjStringNotifier@@@Z
?readDwgStringsEnd@AcHsUtil@@YA_NAAPAVAcFsByteReader@@PAV?$AcHsTrie@K@@AAPAV?$AcHsTrieIterator@K@@@Z
??0AcDbFullSubentPath@@QAE@VAcDbObjectId@@VAcDbSubentId@@@Z
?acadInternalServices@AcDbHostApplicationServices@@UAEPAVAcadInternalServices@@XZ
??1AcDbFullSubentPath@@QAE@XZ
?prodcode@AcDbHostApplicationServices@@UAE?BW4ProdIdCode@@XZ
?companyName@AcDbHostApplicationServices@@UAEPB_WXZ
?product@AcDbHostApplicationServices@@UAEPB_WXZ
?program@AcDbHostApplicationServices@@UAEPB_WXZ
?createWorkingGlobals@AcDbHostApplicationServices@@UAEPAVAcDbGlobals@@XZ
?newClipBoundaryArray@AcDbHostApplicationServices@@UAEPAVClipBoundaryArray@@XZ
?newClipBoundaryPolygonal@AcDbHostApplicationServices@@UAEPAVAcDbAbstractClipBoundaryDefinition@@XZ
?newClipBoundaryRectangular@AcDbHostApplicationServices@@UAEPAVAcDbAbstractClipBoundaryDefinition@@XZ
?newProgressMeter@AcDbHostApplicationServices@@UAEPAVAcDbHostApplicationProgressMeter@@XZ
?getEnv@AcDbHostApplicationServices@@UAEPB_WPB_W@Z
?getTempPath@AcDbHostApplicationServices@@UAEIKPA_W@Z
?doFullCRCCheck@AcDbHostApplicationServices@@UAEHXZ
?enableMessageDisplay@AcDbHostApplicationServices@@UAEXH@Z
?readyToDisplayMessages@AcDbHostApplicationServices@@UAEHXZ
?displayString@AcDbHostApplicationServices@@UBEXPB_WH@Z
?displayChar@AcDbHostApplicationServices@@UBEX_W@Z
?userBreak@AcDbHostApplicationServices@@UBEH_N@Z
?getLocalRootFolder@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPB_W@Z
?getRoamableRootFolder@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPB_W@Z
?isA@AcDbHostApplicationServices@@UBEPAVAcRxClass@@XZ
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?clone@AcRxObject@@UBEPAV1@XZ
?done@AcDbObjectIterator@@QBE_NXZ
?newAcRxClass@@YAPAVAcRxClass@@PB_W0HP6APAVAcRxObject@@XZ00@Z
acrx_abort
?description@AcDbMlineStyle@@QBEPB_WXZ
?patternName@AcDbHatch@@QBEPB_WXZ
?rbChain@AcDbXrecord@@QBE?AW4ErrorStatus@Acad@@PAPAUresbuf@@PAVAcDbDatabase@@@Z
?objectId@AcDbObject@@QBE?AVAcDbObjectId@@XZ
?comments@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPB_W@Z
?getName@AcDbSymbolTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPB_W@Z
?textStyle@AcDbMText@@QBE?AVAcDbObjectId@@XZ
?contents@AcDbMText@@QBEPA_WXZ
?prompt@AcDbAttributeDefinition@@QBEPA_WXZ
?tag@AcDbAttributeDefinition@@QBEPA_WXZ
?desc@AcDbAttributeDefinition@@SAPAVAcRxClass@@XZ
?textString@AcDbText@@QBEPA_WXZ
?tag@AcDbAttribute@@QBEPA_WXZ
?desc@AcDbAttribute@@SAPAVAcRxClass@@XZ
?acdbGroupCodeToType@@YA?AW4DwgDataType@AcDb@@F@Z
acutRelRb
?isErased@AcDbObjectId@@QBE_NXZ
?extensionDictionary@AcDbObject@@QBE?AVAcDbObjectId@@XZ
acrxSysRegistry
?desc@AcRxDictionary@@SAPAVAcRxClass@@XZ
acdbCleanUp
acdbModelerEnd
?deleteAcRxClass@@YAXPAVAcRxClass@@@Z
??0AcRxObject@@IAE@XZ
?desc@AcDbXrecord@@SAPAVAcRxClass@@XZ
?desc@AcDbBlockReference@@SAPAVAcRxClass@@XZ
?desc@AcDbSymbolTableRecord@@SAPAVAcRxClass@@XZ
?desc@AcDbMText@@SAPAVAcRxClass@@XZ
?desc@AcDbText@@SAPAVAcRxClass@@XZ
?desc@AcDbObject@@SAPAVAcRxClass@@XZ
?acrxBuildClassHierarchy@@YAXXZ
?acrxRegisterService@@YAPAXPB_W@Z
acdbValidateSetup
?acdbSetHostApplicationServices@@YA?AW4ErrorStatus@Acad@@PAVAcDbHostApplicationServices@@@Z
??1AcDbHostApplicationServices@@UAE@XZ
??0AcDbHostApplicationServices@@QAE@H@Z
?desc@AcDbMlineStyle@@SAPAVAcRxClass@@XZ
?desc@AcDbHatch@@SAPAVAcRxClass@@XZ
?acutNewString@@YA?AW4ErrorStatus@Acad@@PB_WAAPA_W@Z
?objectId@AcDbObjectIterator@@QAE?AVAcDbObjectId@@XZ
?step@AcDbObjectIterator@@QAEX_N0@Z
?start@AcDbObjectIterator@@QAEX_N@Z
?attributeIterator@AcDbBlockReference@@QBEPAVAcDbObjectIterator@@XZ
?x@AcRxObject@@QBEPAV1@PBVAcRxClass@@@Z
?acutDelBuffer@@YAXAAPAX@Z
?setWorkingDatabase@AcDbHostApplicationServices@@QAEXPAVAcDbDatabase@@@Z
s_pServices
?desc@AcDbBlockTable@@SAPAVAcRxClass@@XZ
?desc@AcDbBlockTableRecord@@SAPAVAcRxClass@@XZ
?desc@AcDbSymbolTable@@SAPAVAcRxClass@@XZ
?acdbOpenAcDbObject@@YG?AW4ErrorStatus@Acad@@AAPAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@PBVAcRxClass@@_N@Z
?newIterator@AcDbDictionary@@QBEPAVAcDbDictionaryIterator@@XZ
?done@AcDbSymbolTableIterator@@QBE_NXZ
?newIterator@AcDbBlockTable@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableIterator@@_N1@Z
?getRecordId@AcDbSymbolTableIterator@@QBE?AW4ErrorStatus@Acad@@AAVAcDbObjectId@@@Z
?step@AcDbSymbolTableIterator@@QAEX_N0@Z
?start@AcDbSymbolTableIterator@@QAEX_N0@Z
?newIterator@AcDbSymbolTable@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbSymbolTableIterator@@_N1@Z
?done@AcDbBlockTableRecordIterator@@QBE_NXZ
?namedObjectsDictionaryId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?isValid@AcDbObjectId@@QBE_NXZ
?viewportTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?regAppTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?UCSTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?viewTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?dimStyleTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?linetypeTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?textStyleTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?layerTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?blockTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?close@AcDbObject@@QAE?AW4ErrorStatus@Acad@@XZ
?desc@AcDbDictionary@@SAPAVAcRxClass@@XZ
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AAPAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?getEntityId@AcDbBlockTableRecordIterator@@QBE?AW4ErrorStatus@Acad@@AAVAcDbObjectId@@@Z
?step@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?start@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?newIterator@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableRecordIterator@@_N1@Z
?allocRawMem@AcHeapOperators@@CGPAXI@Z
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
GetModuleHandleW
RaiseException
SetEvent
GetCommandLineW
InitializeCriticalSection
DeleteCriticalSection
GetCurrentProcessId
GetLastError
CreateEventW
CreateThread
CloseHandle
WaitForSingleObject
SearchPathW
TerminateProcess
GetCurrentProcess
FormatMessageW
LocalFree
ExpandEnvironmentStringsW
CreateMutexW
WaitForMultipleObjects
ReleaseMutex
GetSystemTimeAsFileTime
GetCurrentThreadId
InterlockedDecrement
Sleep
GetModuleFileNameW
InterlockedIncrement
GetMessageW
CharNextW
DispatchMessageW
TranslateMessage
CharUpperW
PostThreadMessageW
UnregisterClassA
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
CoRevokeClassObject
StringFromGUID2
CoUninitialize
CoInitialize
CoRegisterClassObject
CoCreateInstance
SysFreeString
LoadTypeLi
SysAllocString
UnRegisterTypeLi
SysStringLen
RegisterTypeLi
SysAllocStringLen
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
_wcslwr
wcsstr
wcsncpy
_wcsicmp
??3@YAXPAX@Z
free
??2@YAPAXI@Z
_invalid_parameter_noinfo
wcsncmp
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
_purecall
wcsncpy_s
wcscat_s
wcscpy_s
??_V@YAXPAX@Z
wcscspn
wcscoll
_wcsnicmp
_vswprintf
_wcsicoll
iswalpha
_wcsncoll
_wcsrev
iswalnum
_wcsupr
_wcsnicoll
wcsrchr
_wcsdup
iswdigit
memset
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
memcpy
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
__CxxFrameHandler3
_CxxThrowException
??0exception@std@@QAE@XZ
?getDwgVersion@AcadVersionInfo@@YG?AW4MaintenanceReleaseVersion@AcDb@@PAW4AcDbDwgVersion@3@@Z
?releaseMinorVersion@AcadVersionInfo@@YAHXZ
respSdjhU3_x16
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE