Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
827010e811feb0144844298570eef32c926446cf97e013583b192fbdd8af3d08.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
827010e811feb0144844298570eef32c926446cf97e013583b192fbdd8af3d08.dll
Resource
win10v2004-20230915-en
Target
827010e811feb0144844298570eef32c926446cf97e013583b192fbdd8af3d08
Size
943KB
MD5
f3a8e732de823df39a8233fa5f66db7f
SHA1
6ea19601480e0ae761a3f13b17d1674bba7a1947
SHA256
827010e811feb0144844298570eef32c926446cf97e013583b192fbdd8af3d08
SHA512
4dfb384b5fc81cb23c8004cabe3cb790947fc14db9a2823fb8bf50a33cde9171de07e734e2d7b99fa07a972405333cf1ac889b505f85eeca2cfb3f9726e5c6dd
SSDEEP
12288:o3Z2Wa4o2I9nbs3tn3c6eBd25KYc7D7qB+jxFdoo8wDNrBCofL6fY3Pvs/mTF8Wa:o3FklJ9LoYs/aFgQMX9h
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
DhcpRequestParams
ord20
ord21
ord36
ord40
ord49
ord13
ord6
ord9
ord11
ord10
ord47
ord3
ord44
ord35
ord37
?SetHintText@CHintEdit@@QAEXV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@@Z
?SetFont@CHintEdit@@QAEXPAVCFont@@H@Z
NsOpenHomePage
MLS_NsGetUserLanguage
?DoesFileExist@@YAHPBG@Z
??0CHintEdit@@QAE@XZ
?NsAlwaysShowActivation@@YAHII@Z
??0CRegistry@@QAE@XZ
??1CRegistry@@UAE@XZ
??1CHintEdit@@UAE@XZ
??1CBrowseFileEdit@@UAE@XZ
?AfxGetModulePath@@YAXAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBG@Z
?Open@CRegistry@@QAEHPAUHKEY__@@PBGHK@Z
?QueryValue@CRegistry@@QAEHPBGPAEPAK@Z
?SetValue@CRegistry@@QAEHPBGPBEK@Z
?GetValue@CRegistry@@QAE?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@PBGABV23@@Z
?Close@CRegistry@@QAEXXZ
?GetValue@CRegistry@@QAEKPBGK@Z
?SetValue@CRegistry@@QAEHPBG0@Z
?SetValue@CRegistry@@QAEHPBGK@Z
?DeleteValue@CRegistry@@QAEHPBG@Z
NsGetDecryptedString
?__WriteInfoAppLog@@YAXHPBGZZ
??0CFileOpenDlg@@QAE@PAVCWnd@@@Z
??1CFileOpenDlg@@UAE@XZ
?NsCheckActivationNeed@@YAHII@Z
?NsGetComputerName@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
?NsGetUserName@@YA?AV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@XZ
??1CFileSaveDlg@@UAE@XZ
??0CFileSaveDlg@@QAE@PAVCWnd@@@Z
?NsGetProgramCodeFromInstalled@@YAHXZ
?NSUTIL_GetMHIDString@@YAPBGXZ
?DecryptString@CUrlInfo@@SAHPBDAAV?$CStringT@GV?$StrTraitMFC_DLL@GV?$ChTraitsCRT@G@ATL@@@@@ATL@@W4MAC@1@W4ENC@1@@Z
?DoModal@CFileDlg@@UAEHXZ
??0CBrowseFileEdit@@QAE@PBGIH0@Z
ord11726
ord11725
ord5652
ord10288
ord10284
ord10286
ord10287
ord10285
ord14785
ord2760
ord8210
ord1513
ord7378
ord914
ord1408
ord6380
ord3797
ord3696
ord3697
ord7626
ord14507
ord4886
ord4092
ord5422
ord13544
ord4487
ord10472
ord4882
ord6559
ord3882
ord6566
ord2522
ord3957
ord14234
ord4477
ord2259
ord7969
ord11333
ord9375
ord5419
ord9210
ord10255
ord8219
ord5409
ord7712
ord7723
ord7722
ord5228
ord5411
ord5252
ord5790
ord3302
ord3305
ord9139
ord6218
ord3403
ord3404
ord11396
ord11021
ord9042
ord12131
ord8977
ord11235
ord10570
ord11169
ord11932
ord11933
ord11934
ord6309
ord7107
ord458
ord1111
ord7493
ord8773
ord11015
ord9040
ord11002
ord12172
ord1143
ord6225
ord4093
ord973
ord5525
ord9350
ord5760
ord5549
ord5249
ord1449
ord2899
ord12168
ord3941
ord11935
ord265
ord4817
ord266
ord5112
ord12124
ord2682
ord5935
ord13703
ord11717
ord6877
ord14596
ord7923
ord14590
ord3055
ord4494
ord13752
ord9693
ord4502
ord4988
ord4927
ord4912
ord4997
ord5013
ord4948
ord5003
ord1777
ord1756
ord1770
ord1744
ord1722
ord13878
ord3266
ord9256
ord11000
ord6978
ord12216
ord8965
ord14588
ord11936
ord3838
ord316
ord924
ord8360
ord3145
ord8464
ord5110
ord306
ord2996
ord290
ord12559
ord5117
ord8757
ord12089
ord1526
ord5109
ord4664
ord285
ord5921
ord3009
ord14678
ord6316
ord1692
ord1689
ord12429
ord11972
ord501
ord4323
ord3164
ord12262
ord12258
ord4936
ord4966
ord4960
ord4954
ord4942
ord5019
ord4974
ord3372
ord3371
ord3265
ord7820
ord2304
ord14137
ord1523
ord4815
ord296
ord3677
ord3816
ord1525
ord286
ord1045
ord280
ord2594
ord3238
ord12217
ord9253
ord3054
ord9225
ord13225
ord10498
ord7627
ord1928
ord1411
ord7379
ord310
ord4108
ord2374
ord485
ord1511
ord2268
ord12173
ord9235
ord9365
ord4485
ord2303
ord7495
ord1113
ord6489
ord462
ord7109
ord1066
ord1002
ord6490
ord9209
ord6129
ord12220
ord9126
ord2761
ord13756
ord6220
ord4219
ord1046
LocalAlloc
GetSystemDirectoryA
OutputDebugStringW
LocalFree
InitializeSListHead
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryW
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
WaitNamedPipeA
SleepEx
SetNamedPipeHandleState
WriteFile
ReadFile
GetSystemTimeAsFileTime
GetVolumeInformationA
GetDriveTypeA
VirtualFree
VirtualAlloc
CreateEventA
ResetEvent
SetEvent
GetCurrentProcess
GetProcessTimes
FindNextFileW
FindFirstFileW
GetModuleHandleA
GetTimeZoneInformation
FormatMessageA
WideCharToMultiByte
GetEnvironmentVariableW
GetEnvironmentVariableA
Sleep
GetTickCount
DeviceIoControl
CloseHandle
CreateFileA
MultiByteToWideChar
SetErrorMode
LoadLibraryA
GetProcAddress
FreeLibrary
GetWindowsDirectoryA
lstrlenA
GetVersionExA
FreeEnvironmentStringsA
GetEnvironmentStrings
FindNextFileA
FindFirstFileA
FindClose
GetVersion
GetCurrentProcessId
CreateMutexA
ReleaseMutex
InitializeCriticalSection
SetLastError
DeleteCriticalSection
GetLastError
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetComputerNameW
lstrcmpiW
GlobalFree
GlobalUnlock
lstrcpyW
GlobalLock
GlobalAlloc
GetLocalTime
GetExitCodeProcess
WaitForSingleObject
GetModuleFileNameW
lstrlenW
CreateThread
DeleteFileW
GetTempPathW
GetDlgItem
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindowRect
SetCapture
GetActiveWindow
MessageBoxA
SendMessageA
ShowWindow
GetCapture
SetPropW
SetDlgItemTextA
GetDlgItemTextA
GetDlgItemTextW
SetFocus
GetFocus
SetWindowTextA
MessageBeep
ScreenToClient
GetWindowLongA
GetSystemMetrics
CreateDialogIndirectParamA
DialogBoxIndirectParamA
wsprintfA
GetWindowLongW
SetCursor
LoadCursorW
ReleaseCapture
PtInRect
EndDialog
ClientToScreen
RemovePropW
SetWindowLongW
InvalidateRect
CallWindowProcW
GetPropW
EnableWindow
SendMessageW
GetClientRect
PostMessageW
GetParent
MoveWindow
wsprintfW
CreateFontIndirectW
SetTextColor
DeleteObject
GetObjectW
GetOpenFileNameA
RegSetValueExW
RegDeleteValueW
GetUserNameW
RegCloseKey
RegDeleteValueA
RegEnumValueA
RegOpenKeyExA
RegCreateKeyExA
GetUserNameA
RegQueryValueExA
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExA
RegEnumKeyExA
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CloseServiceHandle
RegQueryInfoKeyA
RegEnumValueW
ShellExecuteExW
ord680
ShellExecuteW
SHGetSpecialFolderPathW
ord17
PathRemoveBackslashW
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoUninitialize
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SafeArrayGetUBound
VariantInit
SysFreeString
SysAllocStringLen
SysAllocString
VariantClear
SafeArrayDestroy
WSAStartup
WSACleanup
setsockopt
send
select
recv
WSAGetLastError
connect
closesocket
__WSAFDIsSet
getnameinfo
inet_ntoa
inet_addr
getsockopt
freeaddrinfo
getaddrinfo
ioctlsocket
htonl
socket
memcpy
__CxxFrameHandler3
memcmp
strrchr
strstr
wcsstr
_except_handler4_common
__std_type_info_destroy_list
strchr
memset
tolower
strtok
strncpy
_strdup
_stricmp
strcpy
strncpy_s
strcpy_s
isspace
toupper
strcat
wcstok_s
strlen
isupper
isalpha
islower
isdigit
isxdigit
_strnicmp
strcspn
strncmp
_mktime64
_localtime64
_time64
atof
atoi
strtoul
strtol
strtod
_findfirst64i32
_findclose
_stat64i32
_wstat64i32
_findnext64i32
_wsplitpath_s
__stdio_common_vfprintf
__stdio_common_vswprintf
ungetc
fseek
fgets
fgetc
__stdio_common_vsnprintf_s
ftell
clearerr
__stdio_common_vsprintf
__stdio_common_vswscanf
_getcwd
__acrt_iob_func
fclose
fopen
fread
fflush
__stdio_common_vsscanf
_wfopen
free
calloc
malloc
realloc
_initterm
_configure_narrow_argv
_endthread
_initterm_e
_crt_atexit
_cexit
_getpid
_initialize_narrow_environment
_errno
_seh_filter_dll
_exit
_execute_onexit_table
_register_onexit_function
_beginthread
__sys_errlist
_initialize_onexit_table
__sys_nerr
_wgetenv
getenv
rand_s
srand
qsort
rand
bsearch
Netbios
WinVerifyTrust
CryptMsgClose
CryptQueryObject
CertCloseStore
CertFindCertificateInStore
CertFreeCertificateContext
CertGetNameStringA
CryptMsgGetParam
NSACTIVATE_ActivateLicense
NSACTIVATE_CheckCheckoutErrorMessageSkip
NSACTIVATE_CheckOffline
NSACTIVATE_ClearLocalServerAddress
NSACTIVATE_GetActivateMethod
NSACTIVATE_GetCheckoutData
NSACTIVATE_GetConcurrentLocalServerInfo
NSACTIVATE_GetFulfillmentID
NSACTIVATE_GetLocalServerCheckoutFeature
NSACTIVATE_GetProductBorrowInterval
NSACTIVATE_GetProductBorrowPeriod
NSACTIVATE_GetProductLocalServerAddress
NSACTIVATE_IsActivationSkipDaysExpired
NSACTIVATE_IsForceShowActivate
NSACTIVATE_IsLocalServerOnlyPackage
NSACTIVATE_IsPredefinedProductKey
NSACTIVATE_IsProductUseConcurrent
NSACTIVATE_ManualReturnFulfillmentID
NSACTIVATE_NSCCheckout
NSACTIVATE_RegisterLicense
NSACTIVATE_ReturnAllFullfilment
NSACTIVATE_ReturnBorrowedLicense
NSACTIVATE_ReturnLicense
NSACTIVATE_SetActivateMethod
NSACTIVATE_SetCheckoutErrorMessageTime
NSACTIVATE_SetFulfillmentID
NSACTIVATE_SetLocalServerAddress
NSACTIVATE_ShortCodeActivate
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ