Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
rollback.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rollback.exe
Resource
win10v2004-20230220-en
Target
rollback.exe
Size
118KB
MD5
e41f346cc09caea85bc456f4f81a8b49
SHA1
9eef5fc7a15cff0005db98556e657a421c95805a
SHA256
a916f13914fe94a6b65636ab7eaf4937577157fa594fbbd0693bb628b9d7d765
SHA512
90931758392544c8b7ef5e84765fc48faad1ffd960f3b052c0218041d56f6fe379bef9e3ea09a659b64512430328fd427428a2e6be993a30c7474c5905788dbc
SSDEEP
3072:2jW3ZQHz+rM8o0Fnr1VrvkXaVxxKoNRDuUlbs1:2jQQCrTqXaQojDuUlC
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegDeleteKeyW
AdjustTokenPrivileges
OpenProcessToken
RegCreateKeyExW
GlobalFree
GlobalAlloc
DelayLoadFailureHook
LoadLibraryExA
ReadFile
ReleaseMutex
GetFileInformationByHandle
GetDiskFreeSpaceW
GetCurrentDirectoryW
GetCurrentThreadId
SetFileAttributesW
FindClose
DeviceIoControl
FindNextFileW
CompareStringW
FindFirstFileW
LoadLibraryExW
HeapAlloc
ExpandEnvironmentStringsW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
CreateThread
GetLastError
GetModuleFileNameW
GetFileAttributesW
CopyFileW
HeapFree
GetProcessHeap
CreateProcessW
CloseHandle
LoadLibraryW
GetModuleHandleW
CreateDirectoryW
GetWindowsDirectoryW
CreateFileW
WriteFile
CreateMutexW
SetLastError
GetProcAddress
FreeLibrary
WaitForSingleObject
GetTickCount
GetFullPathNameW
SetCurrentDirectoryW
SetBrushOrgEx
CreateFontIndirectW
SetTextAlign
GetStockObject
DeleteObject
CreateCompatibleDC
SelectObject
GetObjectW
SetStretchBltMode
SetBkMode
StretchBlt
DeleteDC
SetTextColor
GetTextAlign
DrawTextW
LoadImageW
DefWindowProcW
PostQuitMessage
DestroyWindow
KillTimer
UnregisterHotKey
EndPaint
BeginPaint
SetWindowPos
InvalidateRect
SetTimer
GetClientRect
DispatchMessageW
GetMessageW
PostThreadMessageW
UpdateWindow
RegisterHotKey
LoadCursorW
LoadStringW
MessageBoxW
FindWindowW
ShowWindow
UnregisterClassW
GetSystemMetrics
CreateWindowExW
RegisterClassW
LoadCursorFromFileW
PeekMessageW
WaitMessage
SendMessageW
_vscwprintf
_wcsnicmp
memset
__CxxFrameHandler3
_CxxThrowException
memcpy
free
??1type_info@@UEAA@XZ
_wcsicmp
__C_specific_handler
wcsrchr
_vsnwprintf
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcschr
wcsstr
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlAllocateHeap
RtlFreeHeap
NtSetInformationFile
RtlNtStatusToDosError
ord17
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
WdsInitialize
WdsTerminate
WdsCreateBlackboard
WdsDestroyBlackboard
WdsSetupLogMessageW
ConstructPartialMsgVW
CurrentIP
WdsSetBlackboardValue
WdsFreeData
WdsGetBlackboardValue
WdsInitializeDataUInt32
??0Object@UnBCL@@QEAA@XZ
?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ
?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ
?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z
?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z
?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z
??3Object@UnBCL@@SAXPEAX@Z
??2Object@UnBCL@@SAPEAX_K@Z
?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z
?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ
??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z
?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z
?set_HResult@Exception@UnBCL@@MEAAXJ@Z
?get_HResult@Exception@UnBCL@@UEBAJXZ
?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ
?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z
?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ
?Clone@Object@UnBCL@@UEBAPEAV12@XZ
?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z
?GetObjectID@Object@UnBCL@@UEBAIXZ
?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ
?GetHashCode@Object@UnBCL@@UEBAHXZ
?Equals@Object@UnBCL@@UEBAHPEBV12@@Z
??1ArgumentNullException@UnBCL@@UEAA@XZ
?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ
?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z
?ToString@String@UnBCL@@UEBAPEAV12@XZ
?GetHashCode@String@UnBCL@@UEBAHXZ
?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z
??0ArgumentException@UnBCL@@QEAA@PEBG@Z
??1ArgumentException@UnBCL@@UEAA@XZ
?get_IsEmpty@String@UnBCL@@QEBAHXZ
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ
?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ
?DecRef@Object@UnBCL@@QEAAHXZ
?AddRef@Object@UnBCL@@QEAAXXZ
?Format@String@UnBCL@@SAPEAV12@PEBGZZ
?Compare@String@UnBCL@@SAHPEBG0H@Z
??0Win32Exception@UnBCL@@QEAA@KPEBG@Z
??1Win32Exception@UnBCL@@UEAA@XZ
??0?$Array@E@UnBCL@@QEAA@HH@Z
??_D?$Array@E@UnBCL@@QEAAXXZ
?GetBuffer@?$Array@E@UnBCL@@UEAAPEAEH@Z
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ
??1Object@UnBCL@@UEAA@XZ
?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ
?get_CString@String@UnBCL@@QEBAPEBGXZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ
??1String@UnBCL@@UEAA@XZ
??0String@UnBCL@@QEAA@PEBG@Z
?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ