Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
AAD.Core.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
SamFw Tool 4.9 (Crack 2024).exe
Resource
win7-20240220-en
Behavioral task
behavioral3
Sample
SamFw Tool 4.9 (Crack 2024).exe
Resource
win10v2004-20240226-en
Target
b8e1a4ce9642f7323f682800cbd7710f8422127182f715a37d13a3c8d4b1ef5c.zip
Size
8.0MB
MD5
8e56310f1a25728f793b76498b0b75db
SHA1
f90596c072926f8ce448329f462899573d2c0081
SHA256
b8e1a4ce9642f7323f682800cbd7710f8422127182f715a37d13a3c8d4b1ef5c
SHA512
7dec7b9e8d0725024774adfdfae4ad7d1581ca1fae541bdb2367ad6b1e8443dd34d22908e1dd93b9c4afe1c385bdb974860e4e79f5e019b93c4eb3ec330de963
SSDEEP
196608:Pk1DbDJxk2fX7boIQmqFs2PaUOzO5bZSCVnhSSLeCKcm:P+L1P70IQEy5Fth7b8
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
AAD.Core.pdb
RtlAllocateHeap
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlImageNtHeader
RtlFreeHeap
RtlGetDeviceFamilyInfoEnum
RtlInitUnicodeString
ZwQueryLicenseValue
RtlNtStatusToDosError
EventSetInformation
EventActivityIdControl
EventRegister
EventUnregister
EventWriteTransfer
OutputDebugStringW
IsDebuggerPresent
DebugBreak
OutputDebugStringA
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
RegisterTraceGuidsW
UnregisterTraceGuids
TraceMessage
GetTraceEnableFlags
GetTraceLoggerHandle
GetTraceEnableLevel
OpenSemaphoreW
WaitForSingleObject
CreateEventExW
ReleaseSemaphore
ResetEvent
CreateSemaphoreExW
DeleteCriticalSection
SetEvent
InitializeCriticalSectionEx
ReleaseMutex
EnterCriticalSection
ReleaseSRWLockShared
ReleaseSRWLockExclusive
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockShared
LeaveCriticalSection
AcquireSRWLockExclusive
RoOriginateError
RoOriginateErrorW
GetLastError
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DecodePointer
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
StringFromGUID2
CoCreateGuid
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoGetContextToken
CoGetObjectContext
CoGetApartmentType
CLSIDFromString
CoCreateInstance
CoTaskMemFree
ResolveLocaleName
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
RegOpenKeyExW
RegCloseKey
RegGetValueW
SetThreadStackGuarantee
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
LocalFree
GetProcAddress
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks
InitOnceExecuteOnce
WakeAllConditionVariable
SleepConditionVariableSRW
Sleep
CryptReleaseContext
?__abi_FailFast@@YAXXZ
?UninitializeData@Details@Platform@@YAXH@Z
?InitializeData@Details@Platform@@YAJH@Z
?CreateException@Exception@Platform@@SAPE$AAV12@HPE$AAVString@2@@Z
??0NullReferenceException@Platform@@QE$AAA@XZ
?__abi_cast_String_to_Object@__abi_details@@YAPE$AAVObject@Platform@@PE$AAVString@3@@Z
??0InvalidArgumentException@Platform@@QE$AAA@PE$AAVString@1@@Z
?ToString@Guid@Platform@@QEAAPE$AAVString@2@XZ
?EventSourceGetTargetArrayEvent@Details@Platform@@YAPEAXPEAXIPEBXPEA_J@Z
?EventSourceGetTargetArraySize@Details@Platform@@YAIPEAX@Z
?EventSourceGetTargetArray@Details@Platform@@YAPEAXPEAXPEAUEventLock@12@@Z
??0ChangedStateException@Platform@@QE$AAA@XZ
?EventSourceInitialize@Details@Platform@@YAXPEAPEAX@Z
??0OutOfBoundsException@Platform@@QE$AAA@XZ
??0FailureException@Platform@@QE$AAA@XZ
??0ClassNotRegisteredException@Platform@@QE$AAA@PE$AAVString@1@@Z
??0COMException@Platform@@QE$AAA@HPE$AAVString@1@@Z
??0OutOfMemoryException@Platform@@QE$AAA@XZ
?EventSourceAdd@Details@Platform@@YA?AVEventRegistrationToken@Foundation@Windows@@PEAPEAXPEAUEventLock@12@PE$AAVDelegate@2@@Z
?EventSourceRemove@Details@Platform@@YAXPEAPEAXPEAUEventLock@12@VEventRegistrationToken@Foundation@Windows@@@Z
??0FailureException@Platform@@QE$AAA@PE$AAVString@1@@Z
?EventSourceUninitialize@Details@Platform@@YAXPEAPEAX@Z
?__abi_ObjectToString@__abi_details@@YAPE$AAVString@Platform@@PE$AAVObject@3@_N@Z
?GetIBoxArrayVtable@Details@Platform@@YAPEAXPEAX@Z
?get@Message@Exception@Platform@@QE$AAAPE$AAVString@3@XZ
?ReCreateException@Exception@Platform@@SAPE$AAV12@H@Z
??0DisconnectedException@Platform@@QE$AAA@XZ
?__abi_cast_Object_to_String@__abi_details@@YAPE$AAVString@Platform@@_NPE$AAVObject@3@@Z
?GetIidsFn@@YAJHPEAKPEBU__s_GUID@@PEAPEAVGuid@Platform@@@Z
?get@FullName@Type@Platform@@QE$AAAPE$AAVString@3@XZ
?__abi_make_type_id@@YAPE$AAVType@Platform@@AEBU__abi_type_descriptor@@@Z
?GetTypeCode@Type@Platform@@SA?AW4TypeCode@2@PE$AAV12@@Z
?GetIBoxVtable@Details@Platform@@YAPEAXPEAX@Z
?CreateValue@Details@Platform@@YAPE$AAVObject@2@W4TypeCode@2@PEBX@Z
?GetProxyImpl@Details@Platform@@YAJPEAUIUnknown@@AEBU_GUID@@0PEAPEAU3@@Z
?ReleaseInContextImpl@Details@Platform@@YAJPEAUIUnknown@@0@Z
?Allocate@Heap@Details@Platform@@SAPEAX_K@Z
??0Delegate@Platform@@QE$AAA@XZ
?GetObjectContext@Details@Platform@@YAPEAUIUnknown@@XZ
??0NotImplementedException@Platform@@QE$AAA@PE$AAVString@1@@Z
?AllocateException@Heap@Details@Platform@@SAPEAX_K0@Z
?ToString@Enum@Platform@@QE$AAAPE$AAVString@2@XZ
?Allocate@Heap@Details@Platform@@SAPEAX_K0@Z
?ReleaseTarget@ControlBlock@Details@Platform@@AEAAXXZ
?AlignedFree@Heap@Details@Platform@@SAXPEAX@Z
?Free@Heap@Details@Platform@@SAXPEAX@Z
??0Object@Platform@@QE$AAA@XZ
?__abi_WinRTraiseObjectDisposedException@@YAXXZ
?__abi_WinRTraiseInvalidCastException@@YAXXZ
?__abi_WinRTraiseNotImplementedException@@YAXXZ
?__abi_WinRTraiseDisconnectedException@@YAXXZ
?__abi_WinRTraiseFailureException@@YAXXZ
?__abi_WinRTraiseOperationCanceledException@@YAXXZ
?__abi_WinRTraiseAccessDeniedException@@YAXXZ
?__abi_WinRTraiseInvalidArgumentException@@YAXXZ
?__abi_WinRTraiseClassNotRegisteredException@@YAXXZ
?__abi_WinRTraiseCOMException@@YAXJ@Z
?__abi_WinRTraiseNullReferenceException@@YAXXZ
?__abi_WinRTraiseChangedStateException@@YAXXZ
?__abi_WinRTraiseOutOfBoundsException@@YAXXZ
?__abi_WinRTraiseWrongThreadException@@YAXXZ
?__abi_WinRTraiseOutOfMemoryException@@YAXXZ
?ReCreateFromException@Details@Platform@@YAJPE$AAVException@2@@Z
?GetActivationFactoryByPCWSTR@@YAJPEAXAEAVGuid@Platform@@PEAPEAX@Z
?TerminateModule@Details@Platform@@YA_NPEAVModuleBase@1WRL@Microsoft@@@Z
?GetActivationFactory@Details@Platform@@YAJPEAVModuleBase@1WRL@Microsoft@@PEAUHSTRING__@@PEAPEAUIActivationFactory@@@Z
?CreateException@Exception@Platform@@SAPE$AAV12@H@Z
wcscat_s
wcsncpy_s
??3@YAXPEAX@Z
__CxxFrameHandler3
memcpy_s
memmove_s
wcsstr
vswprintf_s
_vscwprintf
??_V@YAXPEAX@Z
_purecall
time
__RTDynamicCast
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
__ExceptionPtrDestroy
__ExceptionPtrRethrow
__ExceptionPtrCurrentException
__ExceptionPtrCreate
?terminate@@YAXXZ
_wcsicmp
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
wcsrchr
?name@type_info@@QEBAPEBDXZ
__RTtypeid
wcschr
free
calloc
_ultoa_s
strncmp
_strlwr_s
malloc
swprintf_s
isalpha
isalnum
_wcslwr_s
wcspbrk
wcsnlen
iswspace
_time64
_gmtime64_s
wcsftime
__C_specific_handler
_vsnprintf
_wtoi
__ExceptionPtrCopyException
__ExceptionPtrAssign
__ExceptionPtrToBool
wcsncmp
srand
rand
_wcsupr_s
_wcsnicmp
_wcsicoll
wcscspn
wcsspn
_vsnwprintf
_vsnprintf_s
difftime
_wtol
??0exception@@QEAA@AEBQEBDH@Z
memset
wcslen
_CxxThrowException
??1type_info@@UEAA@XZ
_lock
_unlock
__dllonexit
_onexit
_XcptFilter
_amsg_exit
_initterm
_errno
realloc
memmove
??8type_info@@QEBAHAEBV0@@Z
_callnewh
memcpy
__ExceptionPtrCopy
memcmp
??2@YAPEAX_KHPEBDH@Z
LsaLookupUserAccountType
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringLen
WindowsDeleteString
WindowsDuplicateString
WindowsGetStringRawBuffer
WindowsCompareStringOrdinal
WindowsConcatString
WindowsIsStringEmpty
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
GetSystemInfo
VirtualQuery
VirtualAlloc
VirtualProtect
ResolveDelayLoadedAPI
DelayLoadFailureHook
SystemTimeToFileTime
DllCanUnloadNow
DllGetActivationFactory
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_EH_prolog
IsProcessorFeaturePresent
LocalAlloc
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
CharToOemA
GetProcessWindowStation
RegOpenKeyExA
CoInitializeSecurity
VariantClear
ord155
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ