Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
20c4d7282008b80d75b15154c06bbf49.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
20c4d7282008b80d75b15154c06bbf49.exe
Resource
win10v2004-20231215-en
Target
20c4d7282008b80d75b15154c06bbf49
Size
532KB
MD5
20c4d7282008b80d75b15154c06bbf49
SHA1
f9fbbd3f402636ce4b2cb4ce54a6d6fd24a1e56b
SHA256
107343b19e6fdb38842d66f7f079cf41b21dc38dd41329bd8f61db2994b5747f
SHA512
9af5565e1c19f8275fe3052c7cb86a3dcc6417556c7d740ab7400650a0c45ab4257c9c5675cdb00ea75aa6b1e8ec53acb2fa2f3c5cecfbb4b8be326f71ea6648
SSDEEP
12288:r5fZQgCnQD9Ts7P5Mcp7YJeqgxDWbdjMNwbn9y6sY:kQD9TIP5MceJcxcYw
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageNetscapeServerGatedCrypto
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SymCleanup
SymGetModuleInfoW
SymLoadModule
SymInitialize
SymSetOptions
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
GetModuleFileNameExW
GetModuleFileNameExA
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Create
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Value@TiXmlNode@@QBEPBDXZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
GetACP
GetVersionExA
GetThreadLocale
InterlockedCompareExchange
HeapReAlloc
HeapSize
GetLocaleInfoA
InterlockedExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
DeviceIoControl
SetFileAttributesW
GetSystemTimeAsFileTime
GetProcessTimes
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
MoveFileW
VirtualQuery
VirtualFree
VirtualAlloc
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
OpenThread
SizeofResource
FreeLibrary
ReadProcessMemory
LockResource
WriteProcessMemory
LoadResource
FindResourceExW
CreateThread
FindResourceW
OpenProcess
GetLastError
WideCharToMultiByte
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
VirtualQueryEx
LoadLibraryW
FindFirstFileW
CreateFileA
GetExitCodeProcess
FindNextFileW
TerminateProcess
FindClose
SetEvent
lstrcpyW
WaitForSingleObject
CreateProcessW
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
MultiByteToWideChar
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
GlobalFree
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeResource
CreateEventW
GetFileAttributesW
CreateFileW
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
DeleteCriticalSection
RaiseException
GetVersionExW
ReadFile
SetFilePointer
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
CreateDirectoryW
GetSystemDefaultLCID
GetThreadSelectorEntry
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
GetClassInfoExW
DefWindowProcW
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
CreatePopupMenu
GetGuiResources
ReleaseDC
EnableMenuItem
CloseClipboard
GetMenuItemID
SetClipboardData
GetMenuItemCount
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
RegisterClassExW
GetWindowTextW
SendDlgItemMessageW
GetWindowTextLengthW
SetTimer
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
CallWindowProcW
DrawTextW
GetDC
SetWindowLongW
EndPaint
ClientToScreen
KillTimer
BeginPaint
GetSysColorBrush
DialogBoxParamW
SetDlgItemTextW
GetWindow
GetKeyState
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
CreateWindowExW
DestroyWindow
UnregisterClassA
EnableWindow
GetSystemMenu
SelectObject
GetStockObject
SetTextColor
DeleteObject
CreateFontW
SetBkMode
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
ord155
SHBindToParent
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
CreateStreamOnHGlobal
DoDragDrop
OleUninitialize
OleInitialize
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysStringLen
GdipDeleteGraphics
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameDimensionsList
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipImageSelectActiveFrame
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
PathFileExistsW
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
_invalid_parameter_noinfo
memcpy
memset
malloc
vsprintf_s
_vscprintf
swscanf
wcsncmp
vswprintf_s
__wargv
__argc
_vscwprintf
_mbscmp
free
wcschr
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
strlen
_time32
_mbsstr
_snprintf
_mbslwr_s
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
wcscmp
??0exception@std@@QAE@ABV01@@Z
wcsrchr
_wcslwr_s
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
iswspace
_wcsicmp
memcmp
strcmp
strtoul
fprintf
wcscpy
wcscat
_wfopen
fseek
ftell
_lock
fwrite
_encode_pointer
__dllonexit
_unlock
fclose
_beginthreadex
wcsstr
towlower
isspace
_onexit
strncpy_s
tolower
sprintf_s
isalnum
_wtoi
wcsncpy
_time64
memmove
iswalnum
iswalpha
iswdigit
fread
wcscat_s
wcscpy_s
_gmtime32
_snwprintf
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_mbsicmp
_mbschr
strncmp
strchr
__CxxFrameHandler3
strrchr
atoi
_CxxThrowException
WTSFreeMemory
WTSQuerySessionInformationW
CertGetNameStringW
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
GetAdaptersAddresses
GetAdaptersInfo
Netbios
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE