Static task
static1
Behavioral task
behavioral1
Sample
007c4f8d6bc3eed8420790af9024fc354b66d1416cac676987d8e673cf7a1afc.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral2
Sample
007c4f8d6bc3eed8420790af9024fc354b66d1416cac676987d8e673cf7a1afc.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Target
007c4f8d6bc3eed8420790af9024fc354b66d1416cac676987d8e673cf7a1afc
Size
6.4MB
MD5
14e420d3837936b32d4c4fa1de55bfd5
SHA1
295047f835c5bfa38c5806e3378010ede06f6723
SHA256
007c4f8d6bc3eed8420790af9024fc354b66d1416cac676987d8e673cf7a1afc
SHA512
f72931b8ce752ca186e80a3535f4db86075cfb0eb4b20293987bd498f060c28697724ea4787811fe6acadb04dea28b5414be5ddf30809164d17b54a6ca26f740
SSDEEP
98304:hhoYbzeU0/rp5ngOzvlq86SghBCKVQzT95OXu2UiC50ii3ylaCbUDdGGk:hhoYbaU0fgWv08TgPwT52UiCDgxZu
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
SleepEx
GetSystemDirectoryW
GetEnvironmentVariableA
WaitForMultipleObjects
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadConsoleA
SetConsoleMode
SwitchToFiber
DeleteFiber
CreateFiber
GlobalMemoryStatus
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTime
DeleteFileW
InterlockedIncrement
InterlockedDecrement
LoadLibraryExW
SetUnhandledExceptionFilter
GetCommandLineW
FreeResource
ExitProcess
GetCurrentProcess
GetModuleFileNameA
CreateMutexW
DecodePointer
GetDriveTypeW
SetLastError
GetVersionExW
VirtualFreeEx
Sleep
ReadProcessMemory
WriteProcessMemory
VirtualAllocEx
CreateProcessW
WinExec
CreateThread
RaiseException
CreateDirectoryW
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
WideCharToMultiByte
GetDriveTypeA
GetLogicalDriveStringsA
MultiByteToWideChar
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
InitializeCriticalSectionAndSpinCount
GetLastError
ResetEvent
TerminateThread
GetExitCodeThread
WaitForSingleObject
SetEvent
CreateEventW
ReadFile
GetFileSize
CreateFileW
GetModuleFileNameW
GetWindowsDirectoryW
FreeLibrary
CloseHandle
GetProcAddress
FlushFileBuffers
WriteConsoleW
SetEndOfFile
GetFileAttributesExW
LoadLibraryW
OpenProcess
lstrlenW
ReadConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetFileType
GetStdHandle
lstrcmpiW
GetLogicalDriveStringsW
GetTimeZoneInformation
GetModuleHandleExW
ResumeThread
SwitchToThread
GetSystemTimeAsFileTime
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleA
GetFileTime
MoveFileW
RemoveDirectoryW
ExpandEnvironmentStringsW
GetNativeSystemInfo
GetFullPathNameW
SearchPathW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetPrivateProfileStringW
CompareFileTime
VirtualProtect
SetFilePointer
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
DuplicateHandle
WaitForSingleObjectEx
GetCurrentThread
QueryPerformanceCounter
QueryPerformanceFrequency
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
FlushInstructionCache
IsProcessorFeaturePresent
VirtualAlloc
VirtualFree
LoadLibraryExA
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetACP
GlobalLock
GlobalUnlock
GetCurrentDirectoryW
GlobalAlloc
MulDiv
VerSetConditionMask
VerifyVersionInfoW
WriteFile
SetFileTime
SystemTimeToFileTime
LocalFileTimeToFileTime
GetFileAttributesW
LocalFree
GetLocalTime
lstrcpynW
lstrcpyW
GlobalFree
LocalAlloc
GetTempPathW
GetDiskFreeSpaceExW
VirtualQuery
InitializeCriticalSection
CreateFileA
MoveFileExW
DeviceIoControl
GetSystemDirectoryA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
ReleaseSemaphore
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
ExitThread
GetUpdateRect
GetCursorPos
GetSysColor
IsRectEmpty
CharPrevW
DrawTextW
FillRect
SetRect
PrivateExtractIconsW
DestroyIcon
DrawIconEx
UpdateLayeredWindow
GetWindowRgn
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
EqualRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
IsWindowEnabled
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
RegisterClassW
SetPropW
GetPropW
BeginPaint
GetWindow
PostMessageW
IsChild
DefWindowProcW
GetUserObjectInformationW
GetProcessWindowStation
IsZoomed
OffsetRect
ScreenToClient
IsIconic
SetWindowRgn
SetWindowLongW
EnableWindow
SetTimer
UnregisterClassW
SendMessageW
SetForegroundWindow
EndPaint
ReleaseDC
GetDC
ReleaseCapture
SetCapture
GetKeyState
GetFocus
BringWindowToTop
IsWindowVisible
MoveWindow
MessageBoxA
InvalidateRect
GetWindowThreadProcessId
WaitForInputIdle
LoadCursorW
IsWindow
FindWindowW
UnionRect
InflateRect
PtInRect
UpdateWindow
KillTimer
SetRectEmpty
LoadImageW
DestroyWindow
SetActiveWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
ClientToScreen
PostQuitMessage
GetActiveWindow
MessageBoxW
CreateWindowExW
GetClassInfoExW
RegisterClassExW
MonitorFromPoint
EnumChildWindows
MonitorFromWindow
GetMonitorInfoW
GetParent
GetClientRect
MapWindowPoints
GetSystemMetrics
SystemParametersInfoW
wsprintfW
GetClassNameW
SetWindowPos
IntersectRect
CharNextW
GetWindowRect
CopyRect
SetFocus
ShowWindow
FindWindowExW
CallWindowProcW
GetWindowLongW
SetCursor
CreateCompatibleBitmap
CreateDIBSection
ExtSelectClipRgn
SetBkColor
SetBkMode
StretchBlt
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
SetStretchBltMode
CreatePatternBrush
SetTextColor
CreatePenIndirect
GetTextExtentPointA
SetWindowOrgEx
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
GdiFlush
GetObjectW
CreateRoundRectRgn
SelectObject
BitBlt
CreateCompatibleDC
DeleteObject
DeleteDC
CloseEnhMetaFile
CreateDIBitmap
GetObjectA
MoveToEx
TextOutW
CreateRectRgn
CreateRectRgnIndirect
PtInRegion
SaveDC
RestoreDC
Rectangle
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
CreatePen
CreateFontIndirectW
GetBitmapBits
CombineRgn
SetBitmapBits
ImpersonateLoggedOnUser
GetUserNameW
RevertToSelf
DuplicateTokenEx
LookupAccountSidW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegCreateKeyExW
GetSidSubAuthorityCount
GetSidSubAuthority
RegEnumValueW
GetTokenInformation
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW
SHGetFolderLocation
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetSpecialFolderPathW
ShellExecuteW
CommandLineToArgvW
DragQueryFileW
SHEmptyRecycleBinW
SHQueryRecycleBinW
SHGetFolderPathW
CoUninitialize
CoTaskMemFree
CoInitialize
CoTaskMemRealloc
OleDuplicateData
CreateStreamOnHGlobal
ReleaseStgMedium
CoTaskMemAlloc
OleLockRunning
DoDragDrop
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoInitializeEx
VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString
VarUI4FromStr
SHDeleteKeyW
PathIsSameRootW
PathRemoveFileSpecW
PathAppendW
PathCombineW
PathFindFileNameW
PathFileExistsW
StrRetToStrW
StrCmpW
PathParseIconLocationW
PathIsDirectoryW
ord17
_TrackMouseEvent
InitCommonControlsEx
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipGetImageHeight
GdipGetImageWidth
GdipSetStringFormatTrimming
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipCloneStringFormat
GdipDeleteStringFormat
GdipStringFormatGetGenericTypographic
GdipMeasureString
GdipDrawString
GdipDeleteFont
GdipCreateFontFromLogfontA
GdipImageSelectActiveFrame
GdipFillPath
GdipFillRectangleI
GdipDrawRectangleI
GdipSetInterpolationMode
GdipSetTextRenderingHint
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipSetPenMode
GdipCreateSolidFill
GdipDeleteBrush
GdipCloneBrush
ord1
GdipAddPathLine
GdipFree
GdipAlloc
GdipCreateFontFromDC
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDrawImageRectI
GdipDrawEllipseI
GdipDrawArcI
GdipCreatePen1
GdipDeletePen
GdipCreatePath
GdipDeletePath
GdipSetPenStartCap
GdipSetPenEndCap
GdipSetSmoothingMode
GdipStartPathFigure
GdipAddPathArcI
GdipDrawPath
GdipCreateFromHDC
GdipDeleteGraphics
GdipTranslateWorldTransform
GdipRotateWorldTransform
GdipReleaseDC
GdiplusStartup
GdiplusShutdown
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
MiniDumpWriteDump
SfcIsFileProtected
ord70
GetProcessImageFileNameW
EnumProcesses
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
ObtainUserAgentString
URLDownloadToFileW
socket
setsockopt
ntohs
WSAIoctl
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
send
recv
closesocket
WSACleanup
shutdown
accept
htonl
listen
ioctlsocket
__WSAFDIsSet
select
gethostbyname
gethostname
WSAStartup
getnameinfo
getaddrinfo
freeaddrinfo
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSASetLastError
WSAEventSelect
recvfrom
sendto
htons
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertFreeCertificateContext
CertCloseStore
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
ord26
ord41
ord208
ord216
ord301
ord14
ord46
ord219
ord147
ord117
ord133
ord79
ord167
ord127
ord145
ord27
ord142
??4CCleanHelper@@QAEAAV0@$$QAV0@@Z
??4CCleanHelper@@QAEAAV0@ABV0@@Z
?BeginFsRedir@CCleanHelper@@SAHAAJAAPAX@Z
?CreateCleanEng@@YAPAVICleanEng@@XZ
?CreateDirectoryPath@CCleanHelper@@SAHPB_W@Z
?DeleteFileEx@CCleanHelper@@SAHPB_WH@Z
?DeleteFileW@CCleanHelper@@SAHPB_W@Z
?EndFsRedir@CCleanHelper@@SAHJAAPAX@Z
?ExpandInstallLocation@CCleanHelper@@SAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PB_W@Z
?ExpandInternalPath@CCleanHelper@@SAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetFileSize@CCleanHelper@@SA_KPB_W@Z
?GetFolderSize@CCleanHelper@@SA_KPB_WH@Z
?GetPathByRegValue@CCleanHelper@@SAHPAUjson_t@@AAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H@Z
?GetPathByRootReg@CCleanHelper@@SAPB_WPAUHKEY__@@@Z
?GetRegKeyByPath@CCleanHelper@@SAPAUHKEY__@@PB_WK@Z
?GetShortcutTargetPath@CCleanHelper@@SAHPB_WPA_W@Z
?GetSpecialFolderPath@CCleanHelper@@SAHPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?GetWildDirectoryDepth@CCleanHelper@@SAHPB_WAAH@Z
?InitShareddllWhitelist@CCleanHelper@@SAXAAV?$CSimpleArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CSimpleArrayEqualHelper@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?InitSpecialFolderSet@CCleanHelper@@CAXXZ
?IsExclusive@CCleanHelper@@SAHPB_W@Z
?IsFreshFile@CCleanHelper@@SAHU_FILETIME@@@Z
?IsOSx64@CCleanHelper@@SAHXZ
?IsShareddllWhitelist@CCleanHelper@@SAHAAV?$CSimpleArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CSimpleArrayEqualHelper@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@PB_W@Z
?IsSpecialFolder@CCleanHelper@@SAHPB_W@Z
?IsWin8AndLaterOs@CCleanHelper@@SAHXZ
?IsXpOs@CCleanHelper@@SAHXZ
?ListDirectory@CCleanHelper@@SAHPB_WAAV?$list@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@@std@@K@Z
?MoveFileW@CCleanHelper@@SAHPB_W0@Z
?ReFindFirstFile@CCleanHelper@@SAPAXPB_WPAU_WIN32_FIND_DATAW@@@Z
?ReFindNextFile@CCleanHelper@@SAHPAXPAU_WIN32_FIND_DATAW@@@Z
?ReGetFileDirectory@CCleanHelper@@SAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ReGetFullPathName@CCleanHelper@@SAHAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?RePathFileExists@CCleanHelper@@SAHPB_W@Z
?RePathWithExtExists@CCleanHelper@@SAHPB_W@Z
?ReSearchPathExists@CCleanHelper@@SAHPB_WAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ReadSubDirectory@CCleanHelper@@SAHPB_W0AAV?$list@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@@std@@@Z
?RemoveDirectoryEx@CCleanHelper@@SA_KPB_WH@Z
?RemoveDirectoryW@CCleanHelper@@SAHPB_W@Z
?RemoveParameters@CCleanHelper@@SAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?RemoveRegKey@CCleanHelper@@SAJPB_W@Z
?RemoveRegValue@CCleanHelper@@SAJPB_W0@Z
?ReplaceEnvString@CCleanHelper@@SAXAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?m_bSpecialInited@CCleanHelper@@0_NA
?m_pSetSpecialFolder@CCleanHelper@@0PAV?$set@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@U?$less@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@std@@V?$allocator@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@4@@std@@A
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ