Extended Key Usages
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
be1d22d44e18eb8a9a498e6a77aaf163.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be1d22d44e18eb8a9a498e6a77aaf163.exe
Resource
win10v2004-20240226-en
Target
be1d22d44e18eb8a9a498e6a77aaf163
Size
2.5MB
MD5
be1d22d44e18eb8a9a498e6a77aaf163
SHA1
0cce786f542991fb0affc871b9a5fab4847e7106
SHA256
d47f4f6ee3ce2d9c3483ad230f65a720f3367eae3f201c4a579fa51541958230
SHA512
9a3e97def6d0df372e68b82b8d5fcc7601ca6523f27872119b22a0bacc93996395bd896496474ef2993cefee85dafce518b4dc33636b2570da2753c70889936e
SSDEEP
49152:8uw6uSxPoFoqEzxbkGbbhtvxeTK3aM3xcKy7LxF/K9CEThY0uM:8uw6uVFoqEzxbNbh7eKmKypF2+M
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
?TridentDeleteTridentLocationSensor@@YAXPAVILocationSensor@@@Z
?TridentDeleteTridentEmailNotification@@YAXPAVIEmailNotification@@@Z
?TridentCreateTridentEmailNotification@@YAPAVIEmailNotification@@XZ
?TridentDeleteSmcServiceProtection@@YAXPAVISmcServiceProtection@@@Z
?TridentCreateSmcServiceProtection@@YAPAVISmcServiceProtection@@XZ
?TridentDeleteClassLoader@@YAXPAVITridentClassLoader@@@Z
?TridentCreateClassLoader@@YAPAVITridentClassLoader@@XZ
?TridentDeleteTridentArbitrator@@YAXPAVITridentArbitrator@@@Z
?TridentCreateTridentArbitrator@@YAPAVITridentArbitrator@@XZ
?TridentDeletePrestartingProtection@@YAXPAVIPrestartingProtection@@@Z
?TridentCreatePrestartingProtection@@YAPAVIPrestartingProtection@@XZ
?TridentDeleteTridentInstaller@@YAXPAVITridentInstaller@@@Z
?TridentCreateTridentInstaller@@YAPAVITridentInstaller@@PAD0@Z
?TridentDeleteTridentEngine@@YAXPAVITridentEngine@@@Z
?TridentCreateTridentEngine@@YAPAVITridentEngine@@KPADPAVIWsProcessSensor@@PAVINetPortManager@@PAVISyLog@@PAVITridentState@@PAVITsePromptDialog@@PAVITridentData@@PAK@Z
?TridentSetEventOutput@@YAXP6AXUSEL_EVENT_LOG@@PAX@Z1@Z
?TridentSetDebugOutput@@YAXP6AXPBDPAX@Z1@Z
?TridentCreateTridentState@@YAPAVITridentState@@XZ
?TridentDeleteTridentState@@YAXPAVITridentState@@@Z
?TridentDeleteTridentConfig@@YAXPAVITridentConfig@@@Z
?TridentCreateTridentConfig@@YAPAVITridentConfig@@XZ
?TridentCreateTridentLocationSensor@@YAPAVILocationSensor@@PAVINetPortManager@@W4hi_status@1@@Z
?DmCreateDataManager@@YAPAVIDataManager@@PAK@Z
?DmSetDebugOutput@@YAXP6AXPBD@Z@Z
?DmDeleteDataManager@@YAXPAVIDataManager@@@Z
?SlCreateSyLog@@YAPAVISyLog@@PAKPBD111J@Z
?SlDeleteSyLog@@YAXPAVISyLog@@@Z
?SlSetDebugOutput@@YAXP6AXPBD@Z@Z
?NpCreateNetPortManagerInstaller@@YAPAVINetPortManagerInstaller@@PAD0@Z
?NpCreateNetPortManager@@YAPAVINetPortManager@@PADJJPAK@Z
?NpSetEventOutput@@YAXP6AXUSEL_EVENT_LOG@@PAX@Z@Z
?NpSetDebugOutput@@YAXP6AXPBD@Z@Z
?NpDeleteNetPortManagerInstaller@@YAXPAVINetPortManagerInstaller@@@Z
?NpDeleteNetPortManager@@YAXPAVINetPortManager@@@Z
?WpsSetDebugOutput@@YAXP6AXPBDPAX@Z1@Z
?WpsDeleteProcessSensor@@YAXPAVIWsProcessSensor@@@Z
?WpsCreateWpsInstaller@@YAPAVIWpsInstaller@@PAD0@Z
?WpsDeleteWpsInstaller@@YAXPAVIWpsInstaller@@@Z
?WpsCreateProcessSensor@@YAPAVIWsProcessSensor@@HPADPAK@Z
SyLinkCreateInstance
?SyLinkCreateInstaller@@YAPAVISyLinkInstaller@@PADPAK@Z
?SyLinkDeleteInstaller@@YAXPAVISyLinkInstaller@@@Z
?SyLinkCreateConfig@@YAPAVISyLinkConfig@@XZ
?SyLinkSetDebugOutput@@YAXP6AXPADPAX@Z1@Z
?SyLinkDeleteConfig@@YAXPAVISyLinkConfig@@@Z
SyLinkDeleteInstance
??0STseProcessInfo@@QAE@XZ
??1STseProcessInfo@@UAE@XZ
?TseDeleteClassLoader@@YAXPAVITseClassLoader@@@Z
?TseCreateClassLoader@@YAPAVITseClassLoader@@XZ
??0STseProcessInfo@@QAE@ABV0@@Z
UnzipSignatureFile
?SpNetGetProtocolNameAndDescription@@YAHEHHPADI0I@Z
?SpNetCreatePacketDecode@@YAPAVIPacketDecode@@PAK@Z
?SpNetDeletePacketDecode@@YAXPAVIPacketDecode@@@Z
?SpCreateSeal@@YAPAVISeal@@XZ
?SpNetDeleteDesCrypto@@YAXPAVIDesCrypto@@@Z
?SpCreateTsePlugin@@YAPAVITSEPlugIn@@XZ
?SpDeleteTsePlugin@@YAXPAVITSEPlugIn@@@Z
?SpDeleteSeal@@YAXPAVISeal@@@Z
?SpDeleteAttackerSeal@@YAXPAVIAttackerSeal@@@Z
?SpNetCreateDesCrypto@@YAPAVIDesCrypto@@PAE@Z
?SpCreateAttackerSeal@@YAPAVIAttackerSeal@@XZ
?SpNetDeleteEmailNotify@@YAXPAVIEmailNotify@@@Z
?SpNetCreateName2Ip@@YAPAVIName2Ip@@PAVINetPortManager@@PAK@Z
?SpNetCreateEmailNotify@@YAPAVIEmailNotify@@PAVISyLog@@PAK@Z
?SpNetDeleteName2Ip@@YAXPAVIName2Ip@@@Z
?SsSetPowerBroadcast@@YAXH@Z
?SsGetPowerBroadcastData@@YAXPAIPAJ@Z
WSAGetLastError
closesocket
inet_addr
sendto
htons
ntohs
recvfrom
__WSAFDIsSet
select
ntohl
htonl
socket
recv
send
connect
WSACleanup
WSAStartup
setsockopt
WSASocketA
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
Netbios
?SpDeleteIdsSignatureLib@@YAXPAVIIdsSignatureLib@@@Z
?SpCreateIdsSignatureLib@@YAPAVIIdsSignatureLib@@XZ
FatalAppExitA
CreateProcessA
GetStartupInfoA
RemoveDirectoryA
QueryPerformanceCounter
ResumeThread
SetThreadPriority
GetComputerNameA
GetCurrentThread
GetFileTime
LoadResource
FindResourceA
LockResource
MulDiv
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
lstrcatA
GetVersion
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
CreateSemaphoreA
ReleaseSemaphore
ReleaseMutex
WaitForMultipleObjects
VirtualProtect
SuspendThread
lstrcmpA
GlobalFlags
SizeofResource
TlsAlloc
SetEndOfFile
TlsFree
GlobalReAlloc
TlsSetValue
LocalReAlloc
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
FindResourceExA
lstrlenW
LocalUnlock
LocalLock
GetPrivateProfileIntA
WritePrivateProfileStringA
GetCurrentDirectoryA
GetThreadLocale
GlobalSize
SetErrorMode
DuplicateHandle
ReadFile
WriteFile
FlushFileBuffers
LockFile
UnlockFile
MoveFileA
GetVolumeInformationA
GetFullPathNameA
TerminateThread
CreateThread
SystemTimeToFileTime
SetFileTime
GetTempFileNameA
GetDiskFreeSpaceA
lstrcpynA
RaiseException
ExitThread
GetTimeZoneInformation
GetFileType
GetCommandLineA
ExitProcess
GetACP
HeapReAlloc
GetFileSize
CreateFileA
LCMapStringA
LCMapStringW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
SetHandleCount
GetStdHandle
SetStdHandle
FreeEnvironmentStringsA
FreeEnvironmentStringsW
SetFilePointer
GetEnvironmentStringsW
GetStringTypeA
GetStringTypeW
IsValidLocale
IsValidCodePage
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetExitCodeThread
SleepEx
GetLastError
GetCurrentThreadId
GetTickCount
WaitForMultipleObjectsEx
CloseHandle
CreateEventA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
IsBadCodePtr
SetProcessWorkingSetSize
MultiByteToWideChar
WinExec
DefineDosDeviceA
LocalAlloc
OpenMutexA
CreateMutexA
GetShortPathNameA
SetFileAttributesA
GetWindowsDirectoryA
FindFirstFileA
FindNextFileA
CompareFileTime
DebugBreak
FormatMessageA
LocalFree
SetConsoleCtrlHandler
GetModuleFileNameA
GetCurrentProcessId
IsBadReadPtr
GetLocalTime
UnmapViewOfFile
GetProfileStringA
InterlockedExchange
CreateFileMappingA
MapViewOfFile
GetLocaleInfoA
GetDateFormatA
GetTimeFormatA
GlobalLock
lstrcpyA
GlobalUnlock
FindClose
GetPrivateProfileStringA
GlobalAlloc
GetSystemDefaultLangID
GlobalFree
HeapSize
GetEnvironmentStrings
IsBadWritePtr
GetExitCodeProcess
FileTimeToLocalFileTime
FileTimeToSystemTime
GetVersionExA
GetModuleHandleA
lstrlenA
OutputDebugStringA
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentProcess
ExpandEnvironmentStringsA
GetFileAttributesA
SetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemDirectoryA
OpenProcess
CopyFileA
GetSystemTime
WaitForSingleObjectEx
Sleep
TerminateProcess
SetCurrentDirectoryA
DeleteFileA
WaitForSingleObject
OpenEventA
GetSystemTimeAsFileTime
ResetEvent
GetStringTypeExA
SetEvent
LocalFileTimeToFileTime
GlobalHandle
RtlUnwind
MapWindowPoints
PeekMessageA
AdjustWindowRectEx
SendDlgItemMessageA
RegisterClipboardFormatA
CheckDlgButton
EndDeferWindowPos
ScrollWindow
GetScrollInfo
SetScrollInfo
GetScrollRange
DeferWindowPos
BeginDeferWindowPos
SetScrollPos
ShowScrollBar
WinHelpA
GetClassInfoA
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetDlgCtrlID
CreateWindowExA
SetWindowsHookExA
SetScrollRange
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
GetScrollPos
IsChild
GetMessagePos
SetWindowPos
OffsetRect
IntersectRect
CallNextHookEx
EndPaint
BeginPaint
GetWindowDC
GetNextDlgTabItem
EndDialog
GetActiveWindow
CreateDialogIndirectParamA
DestroyWindow
IsWindowEnabled
GetClassNameA
ExitWindowsEx
GetCapture
ClipCursor
SetCapture
GetMessageA
DispatchMessageA
SendMessageTimeoutA
RemovePropA
AppendMenuA
GetMenuState
ClientToScreen
SetFocus
SetMenu
GetMenuItemInfoA
SetMenuDefaultItem
DrawIcon
EnumDisplaySettingsA
GetMessageTime
GetWindowPlacement
SetActiveWindow
SetCursorPos
RegisterWindowMessageA
MessageBoxA
SetForegroundWindow
GrayStringA
DrawTextA
TabbedTextOutA
EqualRect
InvertRect
CharUpperA
SystemParametersInfoA
FindWindowA
PtInRect
ReleaseCapture
InflateRect
GetDesktopWindow
GetLastActivePopup
CallWindowProcA
GetMenuItemID
CheckMenuRadioItem
DrawMenuBar
GetFocus
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
CopyRect
TranslateAcceleratorA
GetMenuStringA
GetMenuItemCount
DeleteMenu
InsertMenuA
GetMenu
DestroyAcceleratorTable
LoadAcceleratorsA
DefWindowProcA
RegisterClassA
UnregisterClassA
PostThreadMessageA
ShowWindow
BringWindowToTop
TranslateMessage
ValidateRect
DrawFocusRect
MapDialogRect
GetAsyncKeyState
MsgWaitForMultipleObjects
DestroyMenu
WindowFromPoint
LoadStringA
wvsprintfA
OemToCharA
EnumWindows
GetWindowThreadProcessId
ScreenToClient
RemoveMenu
GetParent
EnableMenuItem
CharToOemA
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
MoveWindow
SetWindowTextA
IsDialogMessageA
ScrollWindowEx
IsDlgButtonChecked
SetRectEmpty
IsIconic
IsZoomed
AdjustWindowRect
IsWindowVisible
IsRectEmpty
GetWindowLongA
SetWindowLongA
SetRect
UpdateWindow
GetWindowRect
PostMessageA
LoadMenuA
SetDlgItemTextA
SetDlgItemInt
GetDlgItemTextA
GetDlgItemInt
GetSubMenu
ModifyMenuA
CheckMenuItem
GetKeyState
GetSystemMenu
SetParent
GetNextDlgGroupItem
CopyAcceleratorTableA
CharNextA
WaitMessage
UnpackDDElParam
ReuseDDElParam
LockWindowUpdate
GetDCEx
IsClipboardFormatAvailable
GetTabbedTextExtentA
GetDialogBaseUnits
SetWindowContextHelpId
ShowOwnedPopups
PostQuitMessage
UnionRect
SetCursor
CheckRadioButton
LoadBitmapA
GetDlgItem
MessageBeep
SetTimer
KillTimer
GetDC
ReleaseDC
GetCursorPos
DestroyIcon
GetSystemMetrics
wsprintfA
FillRect
DrawIconEx
InvalidateRect
FindWindowExA
GetTopWindow
GetWindowTextA
GetWindow
EnableWindow
GetSysColor
GetClientRect
LoadIconA
SendMessageA
IsWindow
GetSysColorBrush
GetForegroundWindow
LoadCursorA
RedrawWindow
IsWindowUnicode
DefDlgProcA
ExcludeUpdateRgn
HideCaret
ShowCaret
StartDocA
DeleteDC
RestoreDC
CreateRectRgn
CreateRectRgnIndirect
SaveDC
SetBkMode
SetPolyFillMode
GetTextMetricsA
SetTextColor
SetMapMode
CreateFontIndirectA
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
GetObjectA
GdiFlush
SetStretchBltMode
Polyline
CreatePen
SetROP2
GetTextExtentPoint32A
DeleteObject
BitBlt
CreateCompatibleBitmap
GetStockObject
CreateCompatibleDC
PatBlt
CreateSolidBrush
SelectObject
SelectPalette
SetBkColor
PlayMetaFile
PolyBezierTo
ExtCreatePen
CreateHatchBrush
CreatePatternBrush
CreateDIBPatternBrushPt
GetDCOrgEx
CreateBitmap
GetMapMode
SetRectRgn
CombineRgn
DPtoLP
StretchDIBits
GetCharWidthA
EnumFontFamiliesExA
GetTextColor
GetBkColor
LPtoDP
CopyMetaFileA
CreateDCA
AbortDoc
EndDoc
EndPage
StartPage
SetAbortProc
EnumMetaFile
GetObjectType
PlayMetaFileRecord
ExtSelectClipRgn
SelectClipPath
GetClipRgn
GetDeviceCaps
SetColorAdjustment
PolylineTo
PolyDraw
SetArcDirection
ArcTo
GetCurrentPositionEx
SetMapperFlags
SetTextCharacterExtra
GetTextExtentPointA
CreateDIBitmap
SetTextJustification
SetTextAlign
LineTo
MoveToEx
OffsetClipRgn
IntersectClipRect
ExcludeClipRect
SelectClipRgn
GetClipBox
ScaleWindowExtEx
SetWindowExtEx
OffsetWindowOrgEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
CreateFontA
GetViewportExtEx
GetWindowExtEx
CommDlgExtendedError
ReplaceTextA
PageSetupDlgA
FindTextA
PrintDlgA
GetSaveFileNameA
GetFileTitleA
GetOpenFileNameA
ClosePrinter
DocumentPropertiesA
OpenPrinterA
SetFileSecurityA
RegCreateKeyA
RegQueryValueA
GetFileSecurityA
RegSetValueA
GetLengthSid
CryptDestroyKey
CryptGenKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDeriveKey
CryptGetUserKey
CryptGetProvParam
CryptAcquireContextA
CryptReleaseContext
CreateProcessAsUserA
RegEnumValueA
RegEnumKeyA
RegDeleteKeyW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExA
GetUserNameA
LookupAccountSidA
ImpersonateLoggedOnUser
RevertToSelf
InitializeSecurityDescriptor
InitializeAcl
AllocateAndInitializeSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
RegCloseKey
RegDeleteKeyA
RegDeleteValueA
ChangeServiceConfigA
QueryServiceConfigA
StartServiceA
StartServiceCtrlDispatcherA
QueryServiceStatus
DeleteService
CreateServiceA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
SetServiceStatus
OpenSCManagerA
OpenServiceA
ControlService
CloseServiceHandle
RegisterServiceCtrlHandlerA
RegCreateKeyExA
RegFlushKey
RegOpenKeyA
GetTokenInformation
LookupPrivilegeValueA
AdjustTokenPrivileges
IsValidSid
GetSidIdentifierAuthority
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
DuplicateToken
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
ExtractIconA
ShellExecuteExA
DragFinish
SHGetFileInfoA
DragQueryFileA
Shell_NotifyIconA
DragAcceptFiles
ShellExecuteA
ExtractIconExA
ImageList_Merge
ord14
ord13
ImageList_Destroy
InitCommonControlsEx
ImageList_SetImageCount
ord17
ImageList_GetImageCount
ImageList_Remove
ImageList_Copy
ImageList_AddMasked
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Read
ImageList_Write
PropertySheetA
DestroyPropertySheetPage
CreatePropertySheetPageA
ImageList_LoadImageA
ImageList_Create
ord8
OleFlushClipboard
CreateStreamOnHGlobal
CreateBindCtx
OleSetClipboard
CoRevokeClassObject
CoRegisterClassObject
CoRegisterMessageFilter
CoFreeUnusedLibraries
OleUninitialize
OleInitialize
CoDisconnectObject
OleRun
ReleaseStgMedium
CoTreatAsClass
StringFromCLSID
ReadClassStg
ReadFmtUserTypeStg
OleRegGetUserType
WriteClassStg
WriteFmtUserTypeStg
SetConvertStg
OleIsCurrentClipboard
OleDuplicateData
CoTaskMemAlloc
CoTaskMemFree
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CLSIDFromProgID
StringFromGUID2
CoGetClassObject
CoCreateInstance
CLSIDFromString
CoInitializeEx
CoUninitialize
StgOpenStorageOnILockBytes
CoInitialize
ord253
SafeArrayDestroyDescriptor
SafeArrayDestroy
SysStringLen
LoadTypeLi
SafeArrayDestroyData
SysFreeString
VariantInit
VariantClear
SysReAllocStringLen
VariantTimeToSystemTime
SysAllocStringLen
SysAllocStringByteLen
VariantChangeType
SafeArrayCreate
SafeArrayUnlock
SafeArrayRedim
SafeArrayPutElement
SafeArrayPtrOfIndex
SafeArrayLock
SafeArrayAllocDescriptor
SafeArrayAllocData
SafeArrayGetElement
SafeArrayGetDim
SysAllocString
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayGetElemsize
VarBstrFromCy
VarBstrFromDate
SafeArrayCopy
VariantCopy
VarDateFromStr
SysStringByteLen
VarCyFromStr
InternetSetStatusCallback
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCloseHandle
?CheckTpmDevice@@YAHPAH@Z
?GetTpmVendorId@@YAHXZ
?InitTpmDevice@@YAHXZ
?TpmIoControl@@YAHKPAKK00@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ