Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
MetroLL.exe
Resource
win10v2004-20230915-en
Target
MetroLL.exe
Size
14.6MB
MD5
3a058908a3c3b2a62dad35b16f5d0455
SHA1
44d0c964806ceda43dac41b0addd2046b5f34d03
SHA256
708fc4e207a05862b1147ca455022167e51e58f83d769e61a3630d9f3d4c14ee
SHA512
181f2868008a12e561bac5994c5e468f63ceafbfc6c75e0622018c27e39e95385da568fc337e6198f5fcd1872535539f178d21f6f4adfa45d4c6010210d24878
SSDEEP
393216:Mq0wjIOZ4W6b+/f1CYh5f5f5f5f5f5f5f5f5f5f5GC:gi4i9Vh5f5f5f5f5f5f5f5f5f5f5X
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
InterlockedExchangeAdd
Sleep
GetCommandLineA
ReleaseMutex
GetLastError
CreateMutexW
LoadLibraryW
CreateThread
OutputDebugStringA
WaitForMultipleObjects
IsDebuggerPresent
UnhandledExceptionFilter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
DecodePointer
EncodePointer
GetStartupInfoW
HeapSetInformation
InterlockedCompareExchange
InterlockedExchange
GetCurrentThread
SetThreadPriority
InterlockedDecrement
InterlockedIncrement
GetVersion
SetThreadExecutionState
GlobalUnlock
GlobalLock
TerminateProcess
GetProcAddress
FreeLibrary
LoadLibraryA
GetModuleHandleA
WideCharToMultiByte
LocalFree
FormatMessageA
MultiByteToWideChar
GetFileAttributesW
DeleteFileW
WriteFile
CreateFileW
CreateDirectoryW
GetThreadContext
OpenThread
SetUnhandledExceptionFilter
RaiseException
CreateFileMappingA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
UnmapViewOfFile
QueryPerformanceCounter
MapViewOfFile
GetCurrentThreadId
QueryPerformanceFrequency
SetPriorityClass
GetSystemInfo
GetComputerNameA
HeapFree
HeapAlloc
SwitchToThread
SetEvent
CreateEventA
WaitForSingleObject
ReleaseSemaphore
CloseHandle
CreateSemaphoreA
TryEnterCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetCurrentProcess
SetProcessWorkingSetSize
GetProcessHeap
HeapCompact
LoadKeyboardLayoutA
GetKeyboardLayout
ActivateKeyboardLayout
MessageBoxA
GetAsyncKeyState
ChangeDisplaySettingsA
EnumDisplaySettingsA
GetCursorPos
SetCursorPos
DefWindowProcA
PostQuitMessage
ShowCursor
SetWindowLongA
GetWindowLongA
CreateWindowExA
AdjustWindowRect
SetRect
RegisterClassA
LoadIconA
ShowWindow
GetDoubleClickTime
SystemParametersInfoA
CloseClipboard
GetClipboardData
OpenClipboard
EndPaint
GetClientRect
BeginPaint
DestroyWindow
SetWindowPos
GetWindowRect
CreateDialogParamA
LoadBitmapA
EndDialog
DispatchMessageA
TranslateMessage
PeekMessageA
UnhookWindowsHookEx
SetWindowsHookExA
CallNextHookEx
ClientToScreen
RegQueryValueExA
RegDeleteValueA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
GetUserNameA
RegFlushKey
GetUserNameW
RegSetValueExA
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1_Locimp@locale@std@@MAE@XZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
?_Raise_handler@std@@3P6AXABVexception@stdext@@@ZA
?_Init@locale@std@@CAPAV_Locimp@12@XZ
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?_Xruntime_error@std@@YAXPBD@Z
??0_Locimp@locale@std@@AAE@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??1_Container_base12@std@@QAE@XZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
NxGetUtilLib
NxCreatePhysicsSDK
NxReleasePhysicsSDK
NxGetPhysicsSDK
NxGetPhysicsSDKAllocator
_unlink
modf
floor
_itow
__libm_sse2_acosf
__libm_sse2_log
__libm_sse2_sin
__libm_sse2_cos
__libm_sse2_tanf
__libm_sse2_powf
_CIpow
__libm_sse2_sinf
__libm_sse2_cosf
memset
__libm_sse2_atan2
memcpy
realloc
_fpclass
fflush
fprintf_s
fclose
fopen
ceil
atof
wcsncpy
strncmp
_itoa
_itoa_s
_localtime64
tolower
isprint
swprintf_s
atoi
malloc
free
wcsncpy_s
wcsstr
memchr
__libm_sse2_expf
_mkdir
_findclose
_findfirst64i32
_purecall
strrchr
_vsnprintf_s_l
_vsnprintf
_stricmp
sscanf
_time64
_filelength
vsprintf
_control87
_controlfp
strcpy_s
strcat_s
strchr
strncpy_s
_beginthread
_heapmin
_chdir
wctob
qsort
ldexp
fseek
_errno
calloc
cos
sin
memcmp
memmove
_tell
_write
_close
_read
_lseek
_open
__libm_sse2_logf
sprintf_s
printf
_msize
_expand
isspace
isdigit
btowc
fopen_s
fwrite
sprintf
strncpy
__iob_func
fprintf
__libm_sse2_tan
abort
perror
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_chdrive
strstr
wcscat_s
wcscpy_s
strtol
strtoul
strtod
_ltoa
__libm_sse2_exp
__libm_sse2_atan
__libm_sse2_pow
__libm_sse2_atanf
_CIsinh
__libm_sse2_log10f
_CIfmod
_except_handler3
_CxxThrowException
__libm_sse2_acos
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
__CxxFrameHandler3
_vsnprintf_s
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
ftell
fread
_fseeki64
WSAStartup
ntohl
ioctlsocket
inet_ntoa
inet_addr
select
WSARecvFrom
ntohs
setsockopt
WSASetLastError
htons
htonl
WSASendTo
gethostbyname
closesocket
__WSAFDIsSet
socket
bind
WSACleanup
WSAGetLastError
timeBeginPeriod
timeGetTime
D3DXMatrixInverse
D3DXMatrixTranspose
D3DXPlaneTransform
D3DXCreateEffect
D3DXCreateEffectCompiler
D3DXDisassembleEffect
D3DXCreateEffectPool
D3DXCreateCubeTexture
D3DXCreateTexture
D3DXCreateVolumeTexture
D3DXGetDeclVertexSize
SteamAPI_SetMiniDumpComment
SteamAPI_Init
SteamAPI_WriteMiniDump
SteamUtils
SteamFriends
SteamAPI_RunCallbacks
SteamUserStats
SteamAPI_Shutdown
SteamUser
SteamAPI_RegisterCallResult
SteamApps
SteamAPI_RegisterCallback
SteamAPI_UnregisterCallback
SteamAPI_UnregisterCallResult
SteamClient
SteamRemoteStorage
DeleteDC
GetStockObject
DeleteObject
SelectObject
CreateCompatibleDC
GetObjectA
BitBlt
SHGetSpecialFolderPathW
CoTaskMemAlloc
CoInitializeEx
CoTaskMemFree
CoCreateInstance
DirectInput8Create
ord3
ord2
??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ