Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
f087bd504788217a226143d5c02f8fa4d4beb03928b10815ef10954b9fd53f72.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f087bd504788217a226143d5c02f8fa4d4beb03928b10815ef10954b9fd53f72.dll
Resource
win10v2004-20221111-en
Target
f087bd504788217a226143d5c02f8fa4d4beb03928b10815ef10954b9fd53f72
Size
193KB
MD5
e3a0580064b71f3327b9913e1d8c4a00
SHA1
e532874485fdf49761b0c7778a66dfcecd00780e
SHA256
f087bd504788217a226143d5c02f8fa4d4beb03928b10815ef10954b9fd53f72
SHA512
1b3a420a98780787b2712d62b154c05e09815615eca3e8fe03c57e0be9f2bdd4333a6b6a0e47990013abec8c0be65417c8afb0793500aecbe3360664caad5b33
SSDEEP
3072:OZtrSylrjABBWzxfIXoOifhCMe5JGxtHqSiaebLPp4VdbzGmMZB:OZYy9jABBaxfIXoOqCq7i5BydbimGB
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageContentCommitment
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
KeGetCurrentProcessorNumberEx
ExGetPreviousMode
KeInitializeEvent
InterlockedPushEntrySList
IoFreeIrp
ExAllocatePoolWithTag
FsRtlIsPagingFile
KeInitializeSemaphore
InterlockedPopEntrySList
IoGetLowerDeviceObject
ObfDereferenceObject
IoGetAttachedDeviceReference
IoReleaseVpbSpinLock
ObfReferenceObject
IoAcquireVpbSpinLock
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
RtlCopyUnicodeString
IoDeleteDevice
IoCreateDevice
IoGetDeviceAttachmentBaseRef
ExAcquireResourceSharedLite
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExReleaseResourceLite
IoDetachDevice
IoAttachDeviceToDeviceStackSafe
IoGetDiskDeviceObject
IoEnumerateDeviceObjectList
RtlEqualUnicodeString
RtlInitUnicodeString
ExReleaseRundownProtectionCacheAwareEx
ExAcquireRundownProtectionCacheAwareEx
ExfAcquirePushLockShared
ExWaitForRundownProtectionReleaseCacheAware
ExfReleasePushLockShared
ExAcquireCacheAwarePushLockExclusive
KeEnterGuardedRegion
KeLeaveGuardedRegion
ExReleaseCacheAwarePushLockExclusive
IoWithinStackLimits
IoReleaseCancelSpinLock
IoAcquireCancelSpinLock
IoCancelIrp
FsRtlCancellableWaitForSingleObject
ExfAcquirePushLockExclusive
ExfReleasePushLock
ExInitializePagedLookasideList
ExInitializeNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteNPagedLookasideList
ZwClose
TmReadOnlyEnlistment
ObReferenceObjectByHandle
TmCreateEnlistment
TmCommitComplete
TmRollbackComplete
KeQueryActiveProcessorCountEx
FsRtlAllocateExtraCreateParameterList
FsRtlAllocateExtraCreateParameter
FsRtlInitExtraCreateParameterLookasideList
FsRtlDeleteExtraCreateParameterLookasideList
FsRtlAllocateExtraCreateParameterFromLookasideList
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
FsRtlFreeExtraCreateParameterList
FsRtlFreeExtraCreateParameter
FsRtlGetEcpListFromIrp
FsRtlSetEcpListIntoIrp
FsRtlGetNextExtraCreateParameter
FsRtlAcknowledgeEcp
FsRtlIsEcpAcknowledged
FsRtlIsEcpFromUserMode
IoGetRelatedDeviceObject
IoFileObjectType
ZwCreateFile
memcpy
IoEnumerateRegisteredFiltersList
IoSetTopLevelIrp
FsRtlInsertPerFileContext
FsRtlInsertPerStreamContext
FsRtlLookupPerStreamContextInternal
FsRtlLookupPerFileContext
FsRtlRemovePerFileContext
FsRtlRemovePerStreamContext
ExAcquireResourceExclusiveLite
FsRtlInitializeFileLock
FsRtlUninitializeFileLock
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlAllocateFileLock
FsRtlFreeFileLock
FsRtlPrivateLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
KeSetEvent
IofCompleteRequest
IoIsOperationSynchronous
ExInitializeResourceLite
IofCallDriver
ZwQueryValueKey
ZwOpenKey
MmGetSystemRoutineAddress
RtlImageNtHeader
ExAllocateCacheAwarePushLock
ExQueueWorkItem
EtwWrite
RtlSystemTimeToLocalTime
RtlSecondsSince1970ToTime
FsRtlLookupPerFileObjectContext
KeClearEvent
EtwUnregister
IoRegisterDriverReinitialization
FsRtlRegisterFileSystemFilterCallbacks
IoDeleteSymbolicLink
IoCreateSymbolicLink
KeGetRecommendedSharedDataAlignment
EtwRegister
FsRtlRegisterFltMgrCalls
FsRtlInitializeOplock
FsRtlUninitializeOplock
FsRtlOplockIsFastIoPossible
ExFreePoolWithTag
FsRtlCheckOplockEx
FsRtlCurrentOplock
FsRtlCurrentOplockH
FsRtlOplockBreakH
FsRtlOplockBreakToNoneEx
FsRtlOplockIsSharedRequest
FsRtlOplockFsctrlEx
FsRtlCheckOplock
FsRtlOplockBreakToNone
KeSetTimerEx
IoGetDeviceObjectPointer
_wcsicmp
ExDeleteResourceLite
MmIsThisAnNtAsSystem
MmQuerySystemSize
KeInitializeDpc
KeInitializeTimer
RtlCompareAltitudes
IoRegisterFsRegistrationChangeMountAware
RtlCreateUnicodeString
ExFreeCacheAwareRundownProtection
ExRundownCompleted
ExAllocateCacheAwareRundownProtection
ExInitializeRundownProtection
ZwEnumerateKey
IoReuseIrp
IoSetIoPriorityHint
IoRetrievePriorityInfo
IoApplyPriorityInfoThread
IoSetIoPriorityHintIntoFileObject
IoSetIoPriorityHintIntoThread
IoAdjustStackSizeForRedirection
IoCreateFileEx
RtlCompareMemory
IoFreeMdl
MmProbeAndLockPages
IoAllocateMdl
ExRaiseStatus
MmIsNonPagedSystemAddressValid
MmHighestUserAddress
IoGetBaseFileSystemDeviceObject
IoGetTransactionParameterBlock
ZwUnloadDriver
ZwLoadDriver
ExWaitForRundownProtectionRelease
KeQueryInterruptTime
ExReleaseRundownProtection
ExAcquireRundownProtection
ProbeForWrite
ProbeForRead
IoCsqInsertIrpEx
IoCsqRemoveNextIrp
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
ObInsertObject
ObCreateObject
MmUnlockPages
MmMapLockedPagesSpecifyCache
MmProbeAndLockProcessPages
IoGetRequestorProcess
FsRtlCancellableWaitForMultipleObjects
ObMakeTemporaryObject
ObCreateObjectType
IoCsqInitializeEx
ObReferenceObjectByName
KeTickCount
KeAreAllApcsDisabled
IoGetTopLevelIrp
memmove
ObQueryNameString
IoGetStackLimits
ZwQueryDirectoryFile
RtlIsNameLegalDOS8Dot3
IoGetAttachedDevice
PsRevertToSelf
PsImpersonateClient
PsDereferencePrimaryToken
PsReferencePrimaryToken
IoGetCurrentProcess
PsReferenceImpersonationToken
ObIsKernelHandle
IoThreadToProcess
MmBuildMdlForNonPagedPool
IoCsqRemoveIrp
RtlAddAccessAllowedAceEx
RtlSetOwnerSecurityDescriptor
RtlLengthSid
FsRtlInsertPerFileObjectContext
FsRtlRemovePerFileObjectContext
TmEnableCallbacks
ZwCreateResourceManager
ExUuidCreate
ZwCreateTransactionManager
TmPrePrepareComplete
TmPrepareComplete
TmRollbackEnlistment
RtlDelete
RtlDeleteNoSplay
RtlImageDirectoryEntryToData
SeSinglePrivilegeCheck
IoBuildDeviceIoControlRequest
ZwQueryVolumeInformationFile
ZwSetVolumeInformationFile
_vsnprintf
MmAddVerifierThunks
MmIsVerifierEnabled
DbgPrintEx
MmUnlockPagableImageSection
RtlGetCallersAddress
DbgPrompt
MmLockPagableDataSection
MmIsDriverVerifying
PsGetProcessId
PsGetProcessSessionIdEx
FsRtlNotifyFilterChangeDirectory
RtlUnwind
KeBugCheckEx
KeReleaseSemaphore
memset
KeWaitForSingleObject
KeGetCurrentThread
IoAllocateIrp
FsRtlCurrentBatchOplock
KeDelayExecutionThread
KfReleaseSpinLock
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfAcquireSpinLock
FltAcknowledgeEcp
FltAcquirePushLockExclusive
FltAcquirePushLockShared
FltAcquireResourceExclusive
FltAcquireResourceShared
FltAdjustDeviceStackSizeForIoRedirection
FltAllocateCallbackData
FltAllocateCallbackDataEx
FltAllocateContext
FltAllocateDeferredIoWorkItem
FltAllocateExtraCreateParameter
FltAllocateExtraCreateParameterFromLookasideList
FltAllocateExtraCreateParameterList
FltAllocateFileLock
FltAllocateGenericWorkItem
FltAllocatePoolAlignedWithTag
FltApplyPriorityInfoThread
FltAttachVolume
FltAttachVolumeAtAltitude
FltBuildDefaultSecurityDescriptor
FltCancelFileOpen
FltCancelIo
FltCancellableWaitForMultipleObjects
FltCancellableWaitForSingleObject
FltCbdqDisable
FltCbdqEnable
FltCbdqInitialize
FltCbdqInsertIo
FltCbdqRemoveIo
FltCbdqRemoveNextIo
FltCheckAndGrowNameControl
FltCheckLockForReadAccess
FltCheckLockForWriteAccess
FltCheckOplock
FltCheckOplockEx
FltClearCallbackDataDirty
FltClearCancelCompletion
FltClose
FltCloseClientPort
FltCloseCommunicationPort
FltCommitComplete
FltCommitFinalizeComplete
FltCompareInstanceAltitudes
FltCompletePendedPostOperation
FltCompletePendedPreOperation
FltCreateCommunicationPort
FltCreateFile
FltCreateFileEx
FltCreateFileEx2
FltCreateSystemVolumeInformationFolder
FltCurrentBatchOplock
FltCurrentOplock
FltCurrentOplockH
FltDecodeParameters
FltDeleteContext
FltDeleteExtraCreateParameterLookasideList
FltDeleteFileContext
FltDeleteInstanceContext
FltDeletePushLock
FltDeleteStreamContext
FltDeleteStreamHandleContext
FltDeleteTransactionContext
FltDeleteVolumeContext
FltDetachVolume
FltDeviceIoControlFile
FltDoCompletionProcessingWhenSafe
FltEnlistInTransaction
FltEnumerateFilterInformation
FltEnumerateFilters
FltEnumerateInstanceInformationByFilter
FltEnumerateInstanceInformationByVolume
FltEnumerateInstances
FltEnumerateVolumeInformation
FltEnumerateVolumes
FltFindExtraCreateParameter
FltFlushBuffers
FltFreeCallbackData
FltFreeDeferredIoWorkItem
FltFreeExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeFileLock
FltFreeGenericWorkItem
FltFreePoolAlignedWithTag
FltFreeSecurityDescriptor
FltFsControlFile
FltGetBottomInstance
FltGetContexts
FltGetDestinationFileNameInformation
FltGetDeviceObject
FltGetDiskDeviceObject
FltGetEcpListFromCallbackData
FltGetFileContext
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltGetFileSystemType
FltGetFilterFromInstance
FltGetFilterFromName
FltGetFilterInformation
FltGetInstanceContext
FltGetInstanceInformation
FltGetIoPriorityHint
FltGetIoPriorityHintFromCallbackData
FltGetIoPriorityHintFromFileObject
FltGetIoPriorityHintFromThread
FltGetIrpName
FltGetLowerInstance
FltGetNewSystemBufferAddress
FltGetNextExtraCreateParameter
FltGetRequestorProcess
FltGetRequestorProcessId
FltGetRequestorProcessIdEx
FltGetRequestorSessionId
FltGetRoutineAddress
FltGetStreamContext
FltGetStreamHandleContext
FltGetSwappedBufferMdlAddress
FltGetTopInstance
FltGetTransactionContext
FltGetTunneledName
FltGetUpperInstance
FltGetVolumeContext
FltGetVolumeFromDeviceObject
FltGetVolumeFromFileObject
FltGetVolumeFromInstance
FltGetVolumeFromName
FltGetVolumeGuidName
FltGetVolumeInformation
FltGetVolumeInstanceFromName
FltGetVolumeName
FltGetVolumeProperties
FltInitExtraCreateParameterLookasideList
FltInitializeFileLock
FltInitializeOplock
FltInitializePushLock
FltInsertExtraCreateParameter
FltIs32bitProcess
FltIsCallbackDataDirty
FltIsDirectory
FltIsEcpAcknowledged
FltIsEcpFromUserMode
FltIsFltMgrVolumeDeviceObject
FltIsIoCanceled
FltIsIoRedirectionAllowed
FltIsIoRedirectionAllowedForOperation
FltIsOperationSynchronous
FltIsVolumeSnapshot
FltIsVolumeWritable
FltLoadFilter
FltLockUserBuffer
FltNotifyFilterChangeDirectory
FltObjectDereference
FltObjectReference
FltOpenVolume
FltOplockBreakH
FltOplockBreakToNone
FltOplockBreakToNoneEx
FltOplockFsctrl
FltOplockIsFastIoPossible
FltOplockIsSharedRequest
FltParseFileName
FltParseFileNameInformation
FltPerformAsynchronousIo
FltPerformSynchronousIo
FltPrePrepareComplete
FltPrepareComplete
FltProcessFileLock
FltPurgeFileNameInformationCache
FltQueryDirectoryFile
FltQueryEaFile
FltQueryInformationFile
FltQuerySecurityObject
FltQueryVolumeInformation
FltQueryVolumeInformationFile
FltQueueDeferredIoWorkItem
FltQueueGenericWorkItem
FltReadFile
FltReferenceContext
FltReferenceFileNameInformation
FltRegisterFilter
FltReissueSynchronousIo
FltReleaseContext
FltReleaseContexts
FltReleaseFileNameInformation
FltReleasePushLock
FltReleaseResource
FltRemoveExtraCreateParameter
FltRequestOperationStatusCallback
FltRetainSwappedBufferMdlAddress
FltRetrieveIoPriorityInfo
FltReuseCallbackData
FltRollbackComplete
FltRollbackEnlistment
FltSendMessage
FltSetCallbackDataDirty
FltSetCancelCompletion
FltSetEaFile
FltSetEcpListIntoCallbackData
FltSetFileContext
FltSetInformationFile
FltSetInstanceContext
FltSetIoPriorityHintIntoCallbackData
FltSetIoPriorityHintIntoFileObject
FltSetIoPriorityHintIntoThread
FltSetSecurityObject
FltSetStreamContext
FltSetStreamHandleContext
FltSetTransactionContext
FltSetVolumeContext
FltSetVolumeInformation
FltStartFiltering
FltSupportsFileContexts
FltSupportsFileContextsEx
FltSupportsStreamContexts
FltSupportsStreamHandleContexts
FltTagFile
FltUninitializeFileLock
FltUninitializeOplock
FltUnloadFilter
FltUnregisterFilter
FltUntagFile
FltWriteFile
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ