Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
changepk.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
changepk.exe
Resource
win10v2004-20231023-en
Target
changepk.exe
Size
57KB
MD5
410263744bbc5538eab0b3a065f97f3a
SHA1
acfa549940045f5dd4056c5973f55254beb24c95
SHA256
70ff5a0b20fca4226451174c3c079bef1cf9f35bdd776e20e846c08519d5671e
SHA512
7b1f60bba9162f972274ac107445425311564f83d071d58cdcb9b52231c6af38e4668b91fa794848c7cff19ad237b6709a8ed55295e9fe5a3eab8ac8d8c5a547
SSDEEP
1536:Na8cHHHHHHHHHHHHHHHANOHHCHHH0sav0pb5vTYjMS2nksl7Rz2MPxT5QR:qZv0nM+ksl7VJT5C
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
EventRegister
EventUnregister
EventWrite
GetFileAttributesW
ExpandEnvironmentStringsW
LoadLibraryExW
FreeLibrary
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemDirectoryW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
GetTickCount64
GetCurrentThreadId
QueueUserWorkItem
CreateEventW
SetEvent
OpenEventW
CreateMutexW
RegisterWaitForSingleObject
OpenProcess
UnregisterWaitEx
CloseHandle
VirtualQuery
FindResourceExW
LoadResource
LockResource
LocalFree
CompareStringW
GetLastError
HeapAlloc
HeapFree
GetModuleHandleExW
GetProcessHeap
GetProcAddress
GetSystemTimeAsFileTime
GetWindowThreadProcessId
GetSystemMetrics
CharUpperBuffW
CharUpperW
PostQuitMessage
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharNextW
wcschr
__dllonexit
floorf
memcpy
_onexit
__CxxFrameHandler3
?terminate@@YAXXZ
_unlock
_lock
wcscmp
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
wcsstr
_wcsicmp
_vsnwprintf
memmove
towlower
_purecall
memset
_commode
CommandLineToArgvW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
WinSqmSetDWORD
CoTaskMemFree
CoCreateInstance
CoGetObject
StringFromGUID2
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
SysAllocStringLen
SysAllocString
SafeArrayDestroy
SysFreeString
RoUninitialize
RoInitialize
SetGadgetFlags
AddLayeredRef
SLActivateProduct
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?Release@Value@DirectUI@@QEAAXXZ
?GetRoot@Element@DirectUI@@QEAAPEAV12@XZ
?Paste@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?ClearButtonClicked@TouchEdit2@DirectUI@@SA?AVUID@@XZ
?UserTextChanged@TouchEditBase@DirectUI@@SA?AVUID@@XZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?CreateString@Value@DirectUI@@SAPEAV12@PEBGPEAUHINSTANCE__@@@Z
DuiCreateObject
?SetInputScope@TouchEdit2@DirectUI@@QEAAJW4__MIDL___MIDL_itf_inputscope_0000_0000_0001@@@Z
?GetSelection@TouchEdit2@DirectUI@@QEAAJPEAJ0@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?Create@DUIXmlParser@DirectUI@@SAJPEAPEAV12@P6APEAVValue@2@PEBGPEAX@Z2P6AX11H2@Z2@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QEAAJIPEAUHINSTANCE__@@0@Z
?CreateElement@DUIXmlParser@DirectUI@@QEAAJPEBGPEAVElement@2@1PEAKPEAPEAV32@@Z
GetScaleFactor
?Destroy@DUIXmlParser@DirectUI@@QEAAXXZ
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
StrToID
?SetCaretPosition@TouchEdit2@DirectUI@@QEAAJJ@Z
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
SLGetProductSkuInformation
SLGetWindowsInformation
SLConsumeWindowsRight
SLGetPKeyInformation
SLOpen
SLClose
ord100
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ