Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
WpcMon.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
WpcMon.exe
Resource
win10v2004-20230221-en
Target
WpcMon.exe
Size
1.1MB
MD5
0470bffc6eeb6011b97179a6b59fa994
SHA1
fd4c72f3dcd80ac74fb05e237d672a3e3d093ba2
SHA256
4dc7233b7221ad90131d4640aeb2af9b7972c41fa6952b863f534dee3782f966
SHA512
609e6ef0d91761ca184bbde51439cd3df3d007616ba26b044960b5f310e29ef1143b177e273218398d91d1b31e48a6f2274138cd3bde6285c851bc4e41d42227
SSDEEP
24576:MJ6CtVN0aYT2l2faWZObPJn9Bb7GoPHFYHHIEIZz:MlBluaiO9n9RtPHasx
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
EventActivityIdControl
QueryServiceStatusEx
GetLengthSid
OpenServiceW
EventUnregister
UnregisterTraceGuids
RegisterTraceGuidsW
StartServiceW
GetTraceEnableLevel
IsValidSid
GetTraceEnableFlags
GetTraceLoggerHandle
EventSetInformation
TraceMessage
OpenSCManagerW
EventRegister
CloseServiceHandle
EventWriteTransfer
RegCreateKeyExW
RegOpenKeyExW
RegCloseKey
RegGetValueW
RegEnumKeyExW
RegEnumValueW
RegDeleteTreeW
RegDeleteValueW
RegSetValueExW
RegQueryValueExW
DuplicateTokenEx
SetTokenInformation
OpenProcessToken
OpenThreadToken
GetTokenInformation
GetSidLengthRequired
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
ConvertSidToStringSidW
ConvertStringSidToSidW
LookupAccountNameW
CreateWellKnownSid
CreateProcessAsUserW
IsTextUnicode
DebugBreak
GetTickCount
RegisterApplicationRestart
GetModuleHandleW
GetFileTime
SleepEx
IsDebuggerPresent
WriteFile
GetFileSizeEx
SetFilePointerEx
ReadFile
CreateFileW
GetComputerNameW
CreateMutexW
IsWow64Process
GetCurrentThread
CreateEventExW
InitOnceInitialize
InitOnceExecuteOnce
GetCurrentProcessId
GetPackagesByPackageFamily
GetPackagePath
PackageIdFromFullName
FindFirstChangeNotificationW
FindCloseChangeNotification
FindNextChangeNotification
GetFileAttributesW
CreateDirectoryW
GetFileAttributesExW
LocaleNameToLCID
FileTimeToLocalFileTime
LocalFileTimeToFileTime
GetDynamicTimeZoneInformation
GetDateFormatEx
GetTimeFormatEx
GetTimeFormatW
GetDateFormatW
CompareFileTime
FileTimeToSystemTime
GetLocaleInfoEx
OpenEventW
IsThreadpoolTimerSet
CloseThreadpoolWait
WaitForThreadpoolWaitCallbacks
CallbackMayRunLong
SetThreadpoolWait
CreateThreadpoolWait
TrySubmitThreadpoolCallback
CloseThreadpool
SetThreadpoolThreadMaximum
SetThreadpoolThreadMinimum
CreateThreadpool
SleepConditionVariableSRW
WakeAllConditionVariable
InitializeConditionVariable
WaitForMultipleObjectsEx
ConvertFiberToThread
QueueUserAPC
OpenThread
MultiByteToWideChar
WideCharToMultiByte
LocalFree
CreateMutexExW
GetProcAddress
GetErrorMode
HeapAlloc
HeapSetInformation
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
InitOnceComplete
OutputDebugStringW
ReleaseSRWLockExclusive
UpdateProcThreadAttribute
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
SetErrorMode
SetProcessShutdownParameters
InitializeProcThreadAttributeList
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
SetHandleInformation
InitOnceBeginInitialize
GetModuleFileNameA
GetProcessHeap
GetThreadPreferredUILanguages
MoveFileW
ResolveDelayLoadedAPI
DelayLoadFailureHook
DeleteFileW
??1_Lockit@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@G@std@@2V0locale@2@A
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@G@std@@QEBAGG@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xbad_alloc@std@@YAXXZ
?id@?$collate@G@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@G@std@@QEBAPEBGPEAGPEBG@Z
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAXXZ
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAAGG@Z
?sputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEAA_JPEBG_J@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QEBAGD@Z
?put@?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV12@G@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??1_Locinfo@std@@QEAA@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?is@?$ctype@G@std@@QEBA_NFG@Z
?_Getcat@?$ctype@G@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Incref@facet@locale@std@@UEAAXXZ
_Wcscoll
_Wcsxfrm
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Schedule_chore@details@Concurrency@@YAHPEAU_Threadpool_chore@12@@Z
_Cnd_destroy_in_situ
_Cnd_broadcast
_Mtx_unlock
_Cnd_wait
_Mtx_init_in_situ
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
_Mtx_destroy_in_situ
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
_Cnd_init_in_situ
?__ExceptionPtrCreate@@YAXPEAX@Z
??0task_continuation_context@Concurrency@@AEAA@XZ
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAAAEAV01@K@Z
?_Gndec@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?_CallInContext@_ContextCallback@details@Concurrency@@QEBAXV?$function@$$A6AXXZ@std@@_N@Z
?_Reset@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Assign@_ContextCallback@details@Concurrency@@AEAAXPEAX@Z
?_IsCurrentOriginSTA@_ContextCallback@details@Concurrency@@CA_NXZ
?_Capture@_ContextCallback@details@Concurrency@@AEAAXXZ
?_Release_chore@details@Concurrency@@YAXPEAU_Threadpool_chore@12@@Z
?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QEAAX_N@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
??0?$basic_ostream@GU?$char_traits@G@std@@@std@@QEAA@PEAV?$basic_streambuf@GU?$char_traits@G@std@@@1@_N@Z
?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??0?$basic_ios@GU?$char_traits@G@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAXXZ
?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?getloc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QEBA?AVlocale@2@XZ
?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QEAAXXZ
??1?$basic_ios@GU?$char_traits@G@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEBG_J@Z
?xsgetn@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JPEAG_J@Z
?in@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAG3AEAPEAG@Z
?_Pninc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAAPEAGXZ
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
??1?$basic_streambuf@GU?$char_traits@G@std@@@std@@UEAA@XZ
??1?$basic_ostream@GU?$char_traits@G@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?unshift@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBGHH@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Getcat@?$codecvt@GDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?showmanyc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MEAA_JXZ
?swap@?$basic_ostream@GU?$char_traits@G@std@@@std@@IEAAXAEAV12@@Z
??0?$basic_streambuf@GU?$char_traits@G@std@@@std@@IEAA@XZ
_Mtx_lock
_register_thread_local_exe_atexit_callback
_c_exit
_initterm_e
_initterm
_o__get_wide_winmain_command_line
_o__i64tow_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__itoa_s
_o__lock_file
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__ui64tow_s
_o__unlock_file
_o__wcsicmp
_o__wcstoi64
_o__wcstoui64
_o_abort
_o_ceilf
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswascii
_o_iswdigit
_o_iswlower
_o_iswspace
_o_iswxdigit
_o_malloc
_o_realloc
_o_setvbuf
_o_terminate
_o_towlower
_o_ungetc
_o_ungetwc
_o_wcscpy_s
_o_wcsncpy_s
_o_wcstol
__C_specific_handler
__current_exception
__current_exception_context
_CxxThrowException
__CxxFrameHandler3
wcschr
_o__exit
_o__errno
_o__fseeki64
strchr
__std_type_info_compare
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_type_info_name
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__std_terminate
__CxxFrameHandler4
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
memcmp
memcpy
memmove
memset
strncmp
SHStrDupW
PathRemoveFileSpecW
SHCreateStreamOnFileEx
UrlEscapeW
PathCombineW
PropVariantClear
CoInitializeEx
CoWaitForMultipleHandles
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoTaskMemFree
InitializeCriticalSectionEx
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
CreateEventW
InitializeCriticalSection
ReleaseSRWLockShared
InitializeSRWLock
AcquireSRWLockShared
EnterCriticalSection
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
TerminateProcess
GetStartupInfoW
CreateThread
GetCurrentProcess
TlsGetValue
TlsSetValue
TlsFree
TlsAlloc
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetSystemTime
InitializeSListHead
RoOriginateError
SetRestrictedErrorInfo
WindowsDeleteString
WindowsGetStringRawBuffer
WindowsCreateStringReference
RoUninitialize
RoInitialize
RoGetActivationFactory
RoActivateInstance
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
Sleep
SystemTimeToFileTime
RoGetMatchingRestrictedErrorInfo
FreeLibrary
LoadLibraryExW
ExpandEnvironmentStringsW
EtwTraceMessage
RtlGetDeviceFamilyInfoEnum
RtlUnsubscribeWnfNotificationWaitForCompletion
NtQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
GetDpiForShellUIComponent
SHGetKnownFolderPath
ShellExecuteW
Shell_NotifyIconW
ShellExecuteExW
CommandLineToArgvW
SHGetFolderPathW
UuidCreate
IdnToAscii
CreateEnvironmentBlock
DestroyEnvironmentBlock
LookupAccountSidW
NetUserGetInfo
ImmDisableLegacyIME
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ