Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageContentCommitment
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-24_e7447a831cb90fea0df77f5e2be6a845_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-02-24_e7447a831cb90fea0df77f5e2be6a845_mafia.exe
Resource
win10v2004-20240221-en
Target
2024-02-24_e7447a831cb90fea0df77f5e2be6a845_mafia
Size
7.5MB
MD5
e7447a831cb90fea0df77f5e2be6a845
SHA1
9dccdac0b0645316891047ab1ad4a5b30c12e823
SHA256
ee2e7893c55eea5335ad58cf0f252d235f88b3f1f4dac7c2a1cef14085ab683a
SHA512
8a9e84f6f394148ae007d2e57523703fb51734b982610e1f38fdc428a676104d06730d90392c8fe83b7cad7bfa650ee544a406025792945c37b1d28c6b068c49
SSDEEP
98304:R34RoXHwJG2DbDcP74+WI3Pwy/6kmS8M08/QhHC4xkZbhpXnwEitjksxgo/ooTpV:54ur27HVCL7Zbhp3tipdxg8VaznO
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
R:\Jenkins\Pokki (Sergey)\workspace\build\win32\Pokki\Redist\ServiceHostApp.pdb
SymSetOptions
SymInitialize
SymFromAddr
SymGetLineFromAddr64
SymFunctionTableAccess64
SymGetModuleBase64
StackWalk64
MiniDumpWriteDump
AlphaBlend
GdipDrawImageRectRectI
GdipCreateFromHWNDICM
GdipSetCompositingMode
GdipSetCompositingQuality
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipSetSmoothingMode
GdipDrawLine
GdipDrawLines
GdipFree
GdipAlloc
GdipDeleteGraphics
GdipDisposeImage
GdipGetImageWidth
GdipGetImageHeight
GdipDrawRectangle
GdipFillRectangle
GdipFillEllipse
GdipFillPath
GdipGetImagePixelFormat
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromFile
GdipSaveImageToFile
GdipCreateBitmapFromHBITMAP
GdipDrawImageRectI
GdipCreateBitmapFromHICON
GdipBitmapGetPixel
GdipBitmapSetPixel
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipDeleteBrush
GdipCreatePen1
GdipDeletePen
GdipCreateStringFormat
GdipDeleteStringFormat
GdipCreatePath
GdipDeletePath
GdipFlush
GdipCreateFontFamilyFromName
GdipGetGenericFontFamilySansSerif
GdipDeleteFontFamily
GdipCreateFont
GdipDeleteFont
GdipSetImageAttributesWrapMode
GdipCreateSolidFill
GdipSetStringFormatFlags
GdipSetStringFormatTrimming
GdipClosePathFigures
GdipAddPathLine
GdipCloneBrush
GdipSetClipRectI
GdipCreateFromHWND
GdipDrawImage
GdipMeasureString
GdipDrawString
GdipDrawImageRectRect
GdipGraphicsClear
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipCreateFromHDC
GdipSetImageAttributesColorMatrix
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipBitmapApplyEffect
GdipCreateEffect
GdipSetEffectParameters
GdipDeleteEffect
GdipCloneImage
GdipDrawImageI
GdipGetImageGraphicsContext
GdiplusShutdown
GdiplusStartup
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromFileICM
QueryWorkingSet
GetProcessMemoryInfo
WriteFile
OutputDebugStringA
FormatMessageA
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
TryEnterCriticalSection
InterlockedExchangeAdd
IsDebuggerPresent
SetThreadPriority
TlsGetValue
TlsFree
TlsSetValue
TlsAlloc
GetModuleHandleExW
QueryPerformanceCounter
QueryPerformanceFrequency
SystemTimeToFileTime
TzSpecificLocalTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
OpenProcess
SetInformationJobObject
GetExitCodeProcess
CreateToolhelp32Snapshot
GetProcessIoCounters
VirtualQueryEx
HeapSetInformation
SetPriorityClass
AllocConsole
AttachConsole
Process32NextW
Process32FirstW
GetProcessHeaps
GetModuleHandleExA
TerminateProcess
GetSystemInfo
ResumeThread
AssignProcessToJobObject
ReadFile
GetStdHandle
SetHandleInformation
CreatePipe
GetProcessTimes
InterlockedIncrement
RtlCaptureStackBackTrace
GetCurrentThread
GetDiskFreeSpaceExW
GlobalMemoryStatusEx
UnregisterWaitEx
RegisterWaitForSingleObject
InterlockedExchange
GetQueuedCompletionStatus
GetModuleFileNameW
PostQueuedCompletionStatus
TerminateJobObject
InitializeCriticalSection
SignalObjectAndWait
GetProcessHandleCount
VirtualFree
VirtualAllocEx
FreeLibrary
LoadLibraryW
WriteProcessMemory
GetThreadContext
MapViewOfFile
CreateFileMappingW
InterlockedDecrement
VirtualProtectEx
GetFileAttributesW
QueryDosDeviceW
GetLongPathNameW
SetFilePointer
CreateJobObjectW
CreateNamedPipeW
SearchPathW
GetCurrentDirectoryW
DebugBreak
ReadProcessMemory
SuspendThread
CreateProcessW
DeleteFileW
ReleaseMutex
ExpandEnvironmentStringsW
GetVersionExW
GetDriveTypeW
SetEnvironmentVariableA
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
SetCurrentDirectoryW
GetNativeSystemInfo
InterlockedCompareExchange
LocalFree
GetVersion
LoadLibraryA
WaitForMultipleObjects
HeapAlloc
GetProcessHeap
HeapFree
VirtualQuery
MulDiv
GetEnvironmentVariableW
CreateThread
CreateTimerQueue
GetProcessId
CreateTimerQueueTimer
DeleteTimerQueue
DeleteTimerQueueTimer
CreateEventW
GetCommandLineW
SetProcessShutdownParameters
SetUnhandledExceptionFilter
Sleep
GetLastError
OpenEventW
ResetEvent
CreateDirectoryW
CreateFileW
GetSystemPowerStatus
SetLastError
FlushInstructionCache
lstrlenW
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetCurrentThreadId
GetCurrentProcessId
ProcessIdToSessionId
GetUserGeoID
GetGeoInfoW
SetEvent
GetTickCount
GetCurrentProcess
DuplicateHandle
CreateSemaphoreA
CreateEventA
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
WaitForSingleObject
ReleaseSemaphore
CloseHandle
lstrlenA
VirtualFreeEx
CreateMutexW
FlushConsoleInputBuffer
FindClose
FindFirstFileA
FindNextFileA
GetVersionExA
GlobalMemoryStatus
WideCharToMultiByte
FatalAppExitA
SetStdHandle
MultiByteToWideChar
ExpandEnvironmentStringsA
WriteConsoleW
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
IsValidCodePage
GetOEMCP
GetACP
HeapCreate
GetDateFormatA
GetTimeFormatA
GetCPInfo
LCMapStringW
GetNumberOfConsoleInputEvents
PeekConsoleInputA
SetConsoleMode
ReadConsoleInputA
GetTimeZoneInformation
SetConsoleCtrlHandler
SetFileAttributesA
FindFirstFileExA
GetDriveTypeA
ExitThread
ExitProcess
GetConsoleMode
GetConsoleCP
UnhandledExceptionFilter
GetStartupInfoW
GetCommandLineA
VirtualProtect
RtlUnwind
CreateWaitableTimerA
SetWaitableTimer
OpenEventA
DecodePointer
EncodePointer
GetStringTypeW
HeapSize
HeapReAlloc
HeapDestroy
LocalAlloc
GetUserDefaultUILanguage
InterlockedPopEntrySList
VirtualAlloc
GetFileType
PeekNamedPipe
SleepEx
IsProcessorFeaturePresent
InterlockedPushEntrySList
GetSystemDefaultUILanguage
VerSetConditionMask
VerifyVersionInfoA
CreateIoCompletionPort
FindResourceA
GetLocaleInfoA
CreateFileA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetFullPathNameW
GetFullPathNameA
FormatMessageW
GetTempPathA
UnmapViewOfFile
DeleteFileA
RemoveDirectoryW
FindFirstFileW
CreateDirectoryA
FindNextFileW
GetThreadPriority
TerminateThread
GetFileAttributesA
UnlockFileEx
LockFileEx
LockFile
UnlockFile
SetEndOfFile
AreFileApisANSI
GlobalFree
GetFileSize
GetShortPathNameW
GetConsoleDisplayMode
FreeConsole
SetThreadLocale
GetThreadLocale
CreateMutexA
GetFileSizeEx
ConnectNamedPipe
WaitNamedPipeW
SetNamedPipeHandleState
GetNamedPipeInfo
FlushFileBuffers
DisconnectNamedPipe
GetSystemTime
GetLocaleInfoW
IsWow64Process
VerifyVersionInfoW
LoadLibraryExW
EnumResourceNamesW
FindResourceW
LoadResource
SizeofResource
LockResource
FreeResource
CompareStringW
FindFirstFileExW
GetFileTime
FileTimeToLocalFileTime
GetFileInformationByHandle
GetTempPathW
GetTempFileNameW
CopyFileW
MoveFileExW
GetFileAttributesExW
OutputDebugStringW
GetExitCodeThread
ord413
ord410
_TrackMouseEvent
ord412
GetPwrCapabilities
SetSuspendState
WTSDisconnectSession
WTSRegisterSessionNotification
RegDeleteValueW
RegOpenKeyExW
RegCloseKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegDeleteKeyW
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
RegQueryValueExW
RegSetValueExW
CopySid
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
SetThreadToken
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
AllocateAndInitializeSid
FreeSid
GetSecurityDescriptorLength
RegEnumKeyExW
RegEnumKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
GetUserNameW
GetCurrentHwProfileW
RegCreateKeyExW
GetAclInformation
InitializeAcl
AddAce
AddAccessAllowedAceEx
GetAce
RegOpenKeyW
OpenThreadToken
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
RevertToSelf
RegDisablePredefinedCache
RegisterTraceGuidsW
TraceEvent
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
GetSidSubAuthorityCount
GetSidSubAuthority
CreateProcessAsUserW
RegNotifyChangeKeyValue
RegEnumValueW
RegQueryInfoKeyW
GetTokenInformation
ConvertSidToStringSidW
CreateSolidBrush
CreateFontIndirectW
SetTextColor
CreateBitmap
GetTextExtentPoint32W
SetMapMode
GetTextMetricsW
CreateFontW
BitBlt
CreateDIBSection
CreateCompatibleBitmap
LPtoDP
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC
TextOutW
SetDIBits
GetDeviceCaps
GetBitmapBits
GetObjectA
SetBkMode
SetBrushOrgEx
GetStockObject
DeleteObject
GetDIBits
CreateDCA
sendto
recvfrom
getaddrinfo
listen
freeaddrinfo
connect
socket
closesocket
getpeername
getsockopt
htons
bind
ntohs
getsockname
setsockopt
WSAIoctl
send
recv
select
WSAGetLastError
__WSAFDIsSet
WSASetLastError
WSAStartup
WSACleanup
accept
ioctlsocket
gethostname
shutdown
ord143
ord26
ord211
ord60
ord50
ord79
ord200
ord22
ord35
ord32
ord30
ord46
ord33
ord27
ord301
ord41
IdnToUnicode
IdnToAscii
GetUserNameExW
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
CoInitializeSecurity
OleInitialize
OleUninitialize
CoTaskMemFree
PropVariantClear
CoAllowSetForegroundWindow
CoInitializeEx
CoCreateInstance
CoUninitialize
CreateErrorInfo
SysFreeString
SysAllocString
VariantInit
VariantClear
SafeArrayDestroy
SysAllocStringLen
VariantCopy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElement
GetErrorInfo
VariantChangeType
SetErrorInfo
?Pump@IPokki@@SAXXZ
?Destroy@IPokki@@SAXPAV1@_N@Z
?SetOSModal@IPokki@@SAX_N@Z
?libPokkiStart@@YAHPAXP6AHXZPB_W_N@Z
?RunMessageLoop@IPokki@@SAXXZ
?DoIdleTasks@IPokki@@SAXXZ
?EnableBrowserPurge@IPokki@@SAX_N@Z
?PluginsRefresh@IPokki@@SAXP6AXXZ@Z
?PluginsUnload@IPokki@@SAXPB_W@Z
?CreateInstance@IPokki@@SAPAV1@PB_W0PAVIPokkiListener@@@Z
SHDeleteKeyW
StrRetToBufW
ord176
SHStrDupW
ord487
StrChrIW
timeBeginPeriod
timeGetTime
timeEndPeriod
RpcStringFreeW
UuidCreateSequential
UuidToStringW
ord217
ord173
WinHttpOpen
WinHttpGetProxyForUrl
WinHttpCloseHandle
ExpandEnvironmentStringsForUserW
GetUserProfileDirectoryW
CreateEnvironmentBlock
DestroyEnvironmentBlock
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
DeleteUrlCacheEntryW
InternetQueryOptionW
HidD_GetHidGuid
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
MFCreateAttributes
MFEnumDeviceSources
GetSaveFileNameW
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ