Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
font_service_admin.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
font_service_admin.exe
Resource
win10v2004-20230703-en
Target
font_service_admin.exe
Size
917KB
MD5
6cead4a8e20f1b68d93a3efd2ee0a374
SHA1
b6a5759cd4cb44a8d29cd665d209f562a233327f
SHA256
aacb55d6da1d14e7d9729633ed9fffc20f621efb3c2d9c49c242afc840c86ed0
SHA512
0a98987f3f12412a6f284a1d3c9d80019e7f14de95390e3dad076c0e8d700e7939f97a3ccf9aa34b38ccfd94d2f7bf4959a16ca11902634c120200c76288fc82
SSDEEP
24576:2ApBCrcnblyk09N/n9mRIG8OUNUQ0sGc1UOoI2k3EUsgUtcCblaJ8Is8YtkWtI8h:XfJxJoRFp+u7n+wnN3Wj
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
ntohl
?setclosecb@@YAXP6AXHH@Z@Z
?setreadcb@@YAXP6AXHPADH@Z@Z
?iostop@@YAXXZ
?iosev@@YAXH_N@Z
?setconnnectcb@@YAXP6AXH@Z@Z
?iosendmsg@@YAHHPBD0H@Z
?initVolSerial@DeviceCommUtils@@SAX_N@Z
??0LogMessage@google@@QAE@PBDH@Z
?stream@LogMessage@google@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
??1LogMessage@google@@QAE@XZ
?FLAGS_colorlogtostderr@fLB@@3_NA
?FLAGS_stop_logging_if_full_disk@fLB@@3_NA
?FLAGS_logbufsecs@fLI@@3HA
?FLAGS_max_log_size@fLI@@3HA
?InitGoogleLogging@google@@YAXPBD@Z
?SetStderrLogging@google@@YAXH@Z
?SetLogDestination@google@@YAXHPBD@Z
??0LogMessage@google@@QAE@PBDHH@Z
sqlite3_busy_timeout
sqlite3_free_table
sqlite3_open
sqlite3_exec
sqlite3_close
sqlite3_get_table
GetCurrentProcessId
DeleteCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
EnterCriticalSection
InitializeCriticalSection
Sleep
FreeLibrary
DeleteFileW
GetFileTime
FindNextFileW
FindClose
lstrcmpW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindFirstFileW
DeleteFileA
SetUnhandledExceptionFilter
GetCurrentProcess
LoadLibraryW
CreateFileW
GetProcAddress
GetCurrentThreadId
CloseHandle
WriteProcessMemory
TerminateProcess
CreateDirectoryA
WaitForSingleObject
GetVersionExW
GetModuleFileNameW
wsprintfW
SHGetSpecialFolderPathA
SHGetSpecialFolderPathW
ShellExecuteExW
_Inf
_Nan
_FInf
_FNan
?_Stat@sys@tr2@std@@YA?AW4file_type@123@PB_WAAH@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
_Mtx_init
_Mtx_destroy
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??_7facet@locale@std@@6B@
??_7_Facet_base@std@@6B@
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_BADOFF@std@@3_JB
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@_J@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Throw_C_error@std@@YAXH@Z
?_Release@_Pad@std@@QAEXXZ
?_Launch@_Pad@std@@QAEXPAU_Thrd_imp_t@@@Z
??1_Pad@std@@QAE@XZ
??0_Pad@std@@QAE@XZ
_Xtime_get_ticks
_Thrd_detach
_Thrd_sleep
_Xtime_diff_to_millis2
xtime_get
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@_WDH@std@@2V0locale@2@A
?_Xruntime_error@std@@YAXPBD@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??_7?$codecvt@_WDH@std@@6B@
??_7codecvt_base@std@@6B@
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
?do_encoding@?$codecvt@_WDH@std@@MBEHXZ
?do_max_length@?$codecvt@_WDH@std@@MBEHXZ
?do_always_noconv@?$codecvt@_WDH@std@@MBE_NXZ
?do_length@?$codecvt@_WDH@std@@MBEHAAHPBD1I@Z
?do_unshift@?$codecvt@_WDH@std@@MBEHAAHPAD1AAPAD@Z
?do_out@?$codecvt@_WDH@std@@MBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?do_in@?$codecvt@_WDH@std@@MBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?_Getcat@?$codecvt@_WDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??0?$codecvt@_WDH@std@@QAE@ABV_Locinfo@1@I@Z
??0?$codecvt@_WDH@std@@QAE@I@Z
?out@?$codecvt@_WDH@std@@QBEHAAHPB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDH@std@@QBEHAAHPBD1AAPBDPA_W3AAPA_W@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
??0_Locinfo@std@@QAE@HPBD@Z
?_Make_dir@sys@tr2@std@@YAHPB_W@Z
?_Xbad_function_call@std@@YAXXZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
strtoul
_CxxThrowException
__CxxFrameHandler3
memcpy
memset
__iob_func
fprintf
_snprintf
??0exception@std@@QAE@XZ
__RTDynamicCast
_errno
strtod
sprintf
_vacopy
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
exit
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
__winitenv
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_vsnprintf
_except1
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@PBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
sprintf_s
memmove
rewind
strchr
memchr
system
printf
fopen
fread
_purecall
??3@YAXPAX@Z
ftell
fseek
fclose
_time64
??2@YAPAXI@Z
??_V@YAXPAX@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
_access
?terminate@@YAXXZ
?wait@Concurrency@@YAXI@Z
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
fflush
wcsrchr
_waccess
atoi
wcscat_s
_strtoi64
_strtoui64
ldiv
strtol
MiniDumpWriteDump
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ