Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
setuphost.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setuphost.exe
Resource
win10v2004-20230220-en
Target
setuphost.exe
Size
837KB
MD5
68d56a87d80504a10742c27c6cc6ce11
SHA1
3987094613671830169bb5e5529350200616da06
SHA256
89f35a098ba0e164970c0f862e7225c197ed4c548589964480ef0eb87452f2cf
SHA512
b70c661c5e22e26c2411096dce97462b10c67d4c5f5a652b212e90bf5e39744b11ba38a510797ef79364f272f495be41da9fef2fa697c8d3156eb4a16583a612
SSDEEP
12288:ed9keSfRPQzroLML9SjrcgmtWtJQycfCLEhXDbNllRagA:ebnWmtL9SjrTm06Xdfwl
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP
IMAGE_FILE_NET_RUN_FROM_SWAP
GetTokenInformation
RegQueryValueExW
OpenThreadToken
AddAccessAllowedAce
InitiateSystemShutdownExW
GetLengthSid
EventUnregister
RegOpenKeyExW
InitializeAcl
InitializeSecurityDescriptor
FreeSid
OpenProcessToken
RegSetValueExW
CopySid
RegCreateKeyExW
AllocateAndInitializeSid
EventRegister
EventWriteTransfer
RegCloseKey
SetSecurityDescriptorDacl
ImpersonateLoggedOnUser
RegGetValueW
RevertToSelf
EqualSid
AdjustTokenPrivileges
CheckTokenMembership
RegEnumKeyExW
RegDeleteTreeW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
LoadLibraryW
CreateThread
HeapAlloc
GetProcessPreferredUILanguages
SetCurrentDirectoryW
GetProcAddress
LocalFree
DeleteCriticalSection
ExitProcess
GetCurrentProcessId
GetProcessHeap
FreeLibrary
CopyFileW
WideCharToMultiByte
SystemTimeToTzSpecificLocalTime
GetSystemTime
DebugBreak
GetSystemWindowsDirectoryW
AllocConsole
GetDriveTypeW
LoadLibraryExW
IsDebuggerPresent
GetNativeSystemInfo
HeapSize
GetCurrentThread
SetEvent
AttachConsole
GetLastError
PowerCreateRequest
OutputDebugStringW
WTSGetActiveConsoleSessionId
OutputDebugStringA
GetExitCodeProcess
GlobalUnlock
GlobalMemoryStatus
GetFileType
CreateProcessA
CreateProcessW
MoveFileExW
GlobalLock
HeapDestroy
GetTimeZoneInformation
GlobalAlloc
GlobalSize
HeapValidate
HeapWalk
GetComputerNameExW
GetLocaleInfoW
VirtualAlloc
GetShortPathNameW
VirtualFree
PowerClearRequest
GetLogicalDrives
CreateFileMappingA
DeleteFileA
CreateFileA
GetVersion
CreateMutexA
VirtualQuery
GetTempFileNameW
GetLocalTime
GetWindowsDirectoryA
RaiseException
GetModuleFileNameA
GetDiskFreeSpaceExW
GetVersionExA
GetVolumePathNamesForVolumeNameW
GetWindowsDirectoryW
TlsSetValue
TlsGetValue
TlsFree
TlsAlloc
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetSystemDirectoryW
RemoveDirectoryW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
WaitForMultipleObjects
UnlockFileEx
LockFileEx
GetVolumeInformationW
WaitForMultipleObjectsEx
ReleaseSemaphore
InitializeCriticalSection
GetOverlappedResult
SetEndOfFile
SetFilePointerEx
GetFileSizeEx
GetHandleInformation
OpenProcess
SetFilePointer
ReleaseMutex
WriteFile
LocalAlloc
FreeConsole
SetProcessPreferredUILanguages
CloseHandle
HeapCreate
GetFileSize
HeapReAlloc
ReadFile
ResetEvent
FormatMessageW
ProcessIdToSessionId
MultiByteToWideChar
CreateEventW
GetLogicalDriveStringsW
GetVolumeNameForVolumeMountPointW
DuplicateHandle
OpenEventW
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetProductInfo
GetUserDefaultUILanguage
SetEnvironmentVariableW
GetModuleFileNameW
GetSystemDefaultUILanguage
ExpandEnvironmentStringsW
GetModuleHandleExW
GetStdHandle
GetCurrentProcess
GetFullPathNameW
GetCommandLineW
EnterCriticalSection
HeapFree
CompareStringW
SetConsoleCtrlHandler
PowerSetRequest
CreateDirectoryW
GlobalFree
HeapCompact
Sleep
GetStartupInfoW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
GetModuleHandleW
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
FindFirstFileW
SetLastError
FindNextFileW
GetDiskFreeSpaceW
DeviceIoControl
GetTempPathW
FindClose
SetFileAttributesW
GetFileInformationByHandle
CopyFileExW
FlushFileBuffers
GetVersionExW
GetSystemInfo
GetVolumePathNameW
GetCurrentDirectoryW
GetPrivateProfileSectionW
GetPrivateProfileStringW
DeleteFileW
SetErrorMode
GetEnvironmentVariableW
SetWindowTextW
CreateWindowExW
GetWindowLongPtrW
ShowWindow
DispatchMessageW
SetWindowLongPtrW
UnregisterClassA
DestroyWindow
LoadImageW
UpdateWindow
ShutdownBlockReasonDestroy
PostQuitMessage
IsCharAlphaW
LoadCursorW
ChangeWindowMessageFilterEx
DefWindowProcW
CharNextW
TranslateMessage
ShutdownBlockReasonCreate
MessageBoxTimeoutW
RegisterClassW
SetTimer
GetMessageW
SendMessageW
_purecall
_set_errno
_errno
wcschr
strtol
setvbuf
strchr
_wtol
__iob_func
_wcsicmp
wcscpy_s
_wcsnicmp
wcsrchr
_vsnprintf
_vscwprintf
towupper
iswspace
swscanf_s
wcsncmp
qsort
towlower
memmove_s
free
iswctype
_wtoi
fclose
wcstok_s
_wfopen
fgetws
feof
_wtof
strrchr
_open_osfhandle
sprintf_s
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_wcmdln
_fmode
_commode
?terminate@@YAXXZ
_lock
_unlock
__dllonexit
_onexit
??1type_info@@UEAA@XZ
bsearch
memcmp
memcpy
memmove
memset
wcstoul
_fdopen
strncpy_s
memcpy_s
_vsnwprintf
wprintf
__CxxFrameHandler3
wcscmp
NtQueryLicenseValue
RtlDeleteResource
RtlReleaseResource
RtlAcquireResourceShared
RtlAcquireResourceExclusive
RtlInitializeResource
NtQueryInformationProcess
NtQueryInformationFile
RtlReAllocateHeap
DbgPrintEx
NtYieldExecution
RtlRaiseStatus
NtCreateFile
RtlInitializeCriticalSection
NtClose
RtlDeleteCriticalSection
RtlFreeHeap
RtlNtStatusToDosError
NtSetInformationFile
RtlAllocateHeap
RtlDosPathNameToNtPathName_U
NtPowerInformation
RtlAdjustPrivilege
RtlGetVersion
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
CoTaskMemFree
CoInitializeSecurity
CoInitializeEx
CoCreateInstance
CoUninitialize
SysFreeString
SysAllocString
SystemTimeToVariantTime
VariantTimeToSystemTime
UuidFromStringW
I_RpcMapWin32Status
UuidToStringW
RpcStringFreeW
UuidCreate
GetFileVersionInfoW
GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeW
ord22
ord20
ord23
Shell_NotifyIconW
CommandLineToArgvW
WTSEnumerateSessionsW
WTSQueryUserToken
WTSRegisterSessionNotification
WTSUnRegisterSessionNotification
WTSFreeMemory
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptGetProperty
WinHttpGetDefaultProxyConfiguration
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetProxyForUrl
WinHttpSendRequest
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpSetOption
??0?$CDynamicArray@EPEAE@@QEAA@_K@Z
??0?$CDynamicArray@EPEAUSKey@@@@QEAA@_K@Z
??0?$CDynamicArray@EPEAUSValue@@@@QEAA@_K@Z
??0?$CDynamicArray@GPEAG@@QEAA@_K@Z
??0?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAA@_K@Z
??0?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAA@_K@Z
??0?$CDynamicArray@_KPEA_K@@QEAA@_K@Z
??1?$CDynamicArray@EPEAE@@QEAA@XZ
??1?$CDynamicArray@EPEAUSKey@@@@QEAA@XZ
??1?$CDynamicArray@EPEAUSValue@@@@QEAA@XZ
??1?$CDynamicArray@GPEAG@@QEAA@XZ
??1?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAA@XZ
??1?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAA@XZ
??1?$CDynamicArray@_KPEA_K@@QEAA@XZ
??4?$CDynamicArray@EPEAE@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@EPEAUSKey@@@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@EPEAUSValue@@@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@GPEAG@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAAEAV0@AEBV0@@Z
??4?$CDynamicArray@_KPEA_K@@QEAAAEAV0@AEBV0@@Z
??A?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAAEAPEAUSEnumBinContext@@_K@Z
??A?$CDynamicArray@_KPEA_K@@QEAAAEA_K_K@Z
??B?$CDynamicArray@EPEAUSKey@@@@QEBAPEAUSKey@@XZ
??B?$CDynamicArray@EPEAUSValue@@@@QEBAPEAUSValue@@XZ
??B?$CDynamicArray@GPEAG@@QEBAPEAGXZ
??C?$CDynamicArray@EPEAUSKey@@@@QEBAPEAUSKey@@XZ
??C?$CDynamicArray@EPEAUSValue@@@@QEBAPEAUSValue@@XZ
??_F?$CDynamicArray@EPEAE@@QEAAXXZ
??_F?$CDynamicArray@EPEAUSKey@@@@QEAAXXZ
??_F?$CDynamicArray@EPEAUSValue@@@@QEAAXXZ
??_F?$CDynamicArray@GPEAG@@QEAAXXZ
??_F?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAXXZ
??_F?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAXXZ
??_F?$CDynamicArray@_KPEA_K@@QEAAXXZ
?Add@?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAHAEAPEAUSEnumBinContext@@@Z
?Add@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAHAEAUSKeeperEntry@CBlackboardFactory@@@Z
?Add@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAHAEAUSKeeperEntry@CBlackboardFactory@@AEA_K@Z
?Add@?$CDynamicArray@_KPEA_K@@QEAAHAEA_K@Z
?ElementAt@?$CDynamicArray@GPEAG@@QEAAAEAG_K@Z
?ElementAt@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAAEAUSKeeperEntry@CBlackboardFactory@@_K@Z
?GetBuffer@?$CDynamicArray@EPEAE@@QEAAPEAE_K@Z
?GetBuffer@?$CDynamicArray@EPEAUSValue@@@@QEAAPEAUSValue@@_K@Z
?GetBuffer@?$CDynamicArray@GPEAG@@QEAAPEAG_K@Z
?GetSize@?$CDynamicArray@EPEAE@@QEBA_KXZ
?GetSize@?$CDynamicArray@GPEAG@@QEBA_KXZ
?GetSize@?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEBA_KXZ
?GetSize@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEBA_KXZ
?GetSize@?$CDynamicArray@_KPEA_K@@QEBA_KXZ
?Init@?$CDynamicArray@EPEAE@@IEAAX_K@Z
?Init@?$CDynamicArray@EPEAUSKey@@@@IEAAX_K@Z
?Init@?$CDynamicArray@EPEAUSValue@@@@IEAAX_K@Z
?Init@?$CDynamicArray@GPEAG@@IEAAX_K@Z
?Init@?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@IEAAX_K@Z
?Init@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@IEAAX_K@Z
?Init@?$CDynamicArray@_KPEA_K@@IEAAX_K@Z
?RemoveAll@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAXXZ
?RemoveAll@?$CDynamicArray@_KPEA_K@@QEAAXXZ
?RemoveItemFromTail@?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAXXZ
?SetSize@?$CDynamicArray@EPEAE@@QEAAH_K@Z
?SetSize@?$CDynamicArray@EPEAUSKey@@@@QEAAH_K@Z
?SetSize@?$CDynamicArray@EPEAUSValue@@@@QEAAH_K@Z
?SetSize@?$CDynamicArray@GPEAG@@QEAAH_K@Z
?SetSize@?$CDynamicArray@PEAUSEnumBinContext@@PEAPEAU1@@@QEAAH_K@Z
?SetSize@?$CDynamicArray@USKeeperEntry@CBlackboardFactory@@PEAU12@@@QEAAH_K@Z
?SetSize@?$CDynamicArray@_KPEA_K@@QEAAH_K@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ