Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
Static task
static1
Behavioral task
behavioral1
Sample
9d8eb4357ffaf0048e18112a15a6d01c63ee0260479b32387c179b639512d1c0.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9d8eb4357ffaf0048e18112a15a6d01c63ee0260479b32387c179b639512d1c0.dll
Resource
win10v2004-20240426-en
Target
9d8eb4357ffaf0048e18112a15a6d01c63ee0260479b32387c179b639512d1c0
Size
101KB
MD5
15b36d0debc0d7cde2dff576846d3f21
SHA1
263a7db09440cba205f948f87594880d8d7a4f4d
SHA256
9d8eb4357ffaf0048e18112a15a6d01c63ee0260479b32387c179b639512d1c0
SHA512
5d30413492ffbc3f04fa77a81a6a809deb15d2403a4b1ecd635fcc9fb2002e1e470a2762a87aaf5600c0f67cb3498d752a2cf2c8673db66760aaf398aeeff5db
SSDEEP
3072:v/2z9iUqSRtwCKlpnvsmnOu+qCOdpV1VPnpimXRxg:HsiFmtFYBka+qCOd16
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
D:\DC\_main\Output\Release\FileSystemCheck.pdb
??0CHardDriveIO@@QAE@XZ
?LoadSetting@CHardDriveIO@@SAXAAVCHardDriveIOSetting@@@Z
?ConvertPartitionDevice2DiskDevice@CNTFSLib@@SGHPAUIManager@@PAUIManagerItem@@AAHAA_J@Z
??0CVolumeIO@@QAE@XZ
??0CHardDriveIOSetting@@QAE@PAUIManager@@PAVIDevice@@@Z
??0CNtfsFileRecordAttribute@@QAE@XZ
??1CNtfsFileRecordAttribute@@QAE@XZ
?GetResidentData@CNtfsFileRecordAttribute@@QAE_JPAE_J@Z
?GetDataRunList@CNtfsFileRecordAttribute@@QAEHAAVCNtfsRunList@@@Z
??4CNtfsFileRecordAttribute@@QAEABV0@ABV0@@Z
?GetNTFSVersion@CNTFSLib@@SGHH_JAAK@Z
?DestroyBitmap@TBitmap@@QAEHXZ
?GetMaxBitIndex@TBitmap@@QAE_JXZ
?GetBitmapSize@TBitmap@@QAEHXZ
?GetBitmapData@TBitmap@@QAEPAEXZ
??0CNtfsRunList@@QAE@XZ
??1CNtfsRunList@@QAE@XZ
??0CNtfsMFT@@QAE@XZ
??1CNtfsMFT@@UAE@XZ
?GetFileRecordCount@CNtfsMFT@@QAE_JXZ
?Get0XB0AllocSize@CNtfsMFT@@QAE_JXZ
?Get0XB0FileRecord@CNtfsMFT@@QAEHAAVCNtfsFileRecord@@@Z
?Get0XB0DataRun@CNtfsMFT@@QAEHAAVCNtfsRunList@@@Z
??0CNtfsFileRecord@@QAE@XZ
??1CNtfsFileRecord@@QAE@XZ
?InitFromSourceFileRecord@CNtfsFileRecord@@QAEHPAEJ@Z
?GetFileRecordHeader@CNtfsFileRecord@@QAEHAAUtagFILERECORD@@@Z
?IsAttributeListPresent@CNtfsFileRecord@@QAEHXZ
??0CNtfsVolume@@QAE@XZ
??1CNtfsVolume@@UAE@XZ
?LoadNtfsVolume@CNtfsVolume@@UAEHJ_J@Z
?LoadNtfsVolumeByIO@CNtfsVolume@@UAEHPAVCHardDriveIO@@@Z
?GetVolumeDevice@CNtfsVolume@@UAEPAXXZ
?SetVolumeDevice@CNtfsVolume@@UAEXPAX@Z
??4CNtfsVolume@@QAEABV0@AAV0@@Z
??0TBuffer@@QAE@XZ
??1TBuffer@@QAE@XZ
?Malloc@TBuffer@@QAEPAXH@Z
??1CStorageIO@@UAE@XZ
?OpenVolume@CStorageIO@@UAEHPBD@Z
?ReadSector@CStorageIO@@UAEHPAE_JK1@Z
??1CHardDriveIO@@UAE@XZ
?Read@CHardDriveIO@@UAEHPAE_JK@Z
?WriteSector@CHardDriveIO@@UAEHPAE_JK1@Z
?VerifySector@CHardDriveIO@@UAEH_J0@Z
?OpenDisk@CHardDriveIO@@UAEHH@Z
?CloseDisk@CHardDriveIO@@UAEHXZ
?GetGeometryInfo@CHardDriveIO@@UAEHPAUtagGEOMETRY_INFO@@@Z
?GetHardDriveNumber@CHardDriveIO@@UAEHAAH@Z
?SetDevice@CHardDriveIO@@UAEXPAVIDevice@@@Z
?GetDevice@CHardDriveIO@@UAEPAVIDevice@@XZ
?IsVolumeDevice@CHardDriveIO@@UAEHXZ
?GetSectorSize@CHardDriveIO@@UAEKXZ
??0TBitmap@@QAE@XZ
??1TBitmap@@QAE@XZ
?CreateBitmap@TBitmap@@QAEH_J@Z
?SetBit@TBitmap@@QAEH_JHH@Z
?GetBit@TBitmap@@QAEH_J@Z
??1CVolumeIO@@UAE@XZ
?OpenVolume@CVolumeIO@@UAEHPBD@Z
?ReadSector@CVolumeIO@@UAEHPAE_JK1@Z
??1CHardDriveIOSetting@@UAE@XZ
CreateEventA
GetProcAddress
LoadLibraryA
CloseHandle
DuplicateHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CreatePipe
ReadFile
TerminateProcess
CreateProcessA
GetExitCodeProcess
Sleep
WriteFile
SetEvent
WaitForSingleObject
GetCurrentProcess
PeekNamedPipe
GetLastError
GetVolumeInformationA
InterlockedDecrement
InterlockedIncrement
FreeLibrary
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
?what@exception@std@@UBEPBDXZ
strcat_s
??3@YAXPAX@Z
_purecall
strcpy_s
??_V@YAXPAX@Z
malloc
free
memmove
vsprintf
mbstowcs
sprintf
_invalid_parameter_noinfo
??2@YAPAXI@Z
strncat
sprintf_s
strncpy
?terminate@@YAXXZ
__clean_type_info_names_internal
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
_encoded_null
_initterm
_initterm_e
__RTDynamicCast
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_ltoa
__CxxFrameHandler3
memcpy
memset
_CxxThrowException
??1exception@std@@UAE@XZ
??0?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAE@XZ
??0?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAE@XZ
??0?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAE@ABV01@@Z
??0CHardDriveIO@@QAE@ABV0@@Z
??0CHardDriveIOSetting@@QAE@ABV0@@Z
??0CNtfsRunList@@QAE@ABV0@@Z
??0CNtfsVolume@@IAE@AAV0@@Z
??0CNtfsVolume@@IAE@PAV0@@Z
??0CStorageIO@@QAE@ABV0@@Z
??0CVolumeIO@@QAE@ABV0@@Z
??0IDevice@@QAE@ABV0@@Z
??0IDevice@@QAE@XZ
??1?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAE@XZ
??1?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAE@XZ
??1?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAE@XZ
??1IDevice@@UAE@XZ
??4?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEAAV01@ABV01@@Z
??4CHardDriveIO@@QAEAAV0@ABV0@@Z
??4CHardDriveIOSetting@@QAEAAV0@ABV0@@Z
??4CNTFSLib@@QAEAAV0@ABV0@@Z
??4CNtfsMFT@@QAEAAV0@AAV0@@Z
??4CNtfsRunList@@QAEAAV0@ABV0@@Z
??4CStorageIO@@QAEAAV0@ABV0@@Z
??4CVolumeIO@@QAEAAV0@ABV0@@Z
??4IDevice@@QAEAAV0@ABV0@@Z
??4TBuffer@@QAEAAV0@ABV0@@Z
??A?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAEAAIH@Z
??A?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAEAAUSECTOR_RANGE@@H@Z
??A?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEAAUtagDataRun@@H@Z
??A?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QBEABUtagDataRun@@H@Z
??A?$CSimpleArray@VCNtfsFileRecordAttribute@@V?$CSimpleArrayEqualHelper@VCNtfsFileRecordAttribute@@@MyTemplate@@@MyTemplate@@QAEAAVCNtfsFileRecordAttribute@@H@Z
??_7CHardDriveIO@@6B@
??_7CHardDriveIOSetting@@6B@
??_7CNtfsVolume@@6B@
??_7CStorageIO@@6B@
??_7CVolumeIO@@6B@
??_7IDevice@@6B@
?Add@?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAEHABI@Z
?Add@?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAEHABUSECTOR_RANGE@@@Z
?Add@?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEHABUtagDataRun@@@Z
?GetAttributeHeaderSize@CNtfsFileRecordAttribute@@QAEJXZ
?GetAttributeLength@CNtfsFileRecordAttribute@@QBE_JXZ
?GetBytePerCluster@CNtfsVolume@@QBEJXZ
?GetBytesPerFileRecord@CNtfsVolume@@QBEJXZ
?GetBytesPerSector@CNtfsVolume@@QBEJXZ
?GetCompressionUnitSize@CNtfsFileRecordAttribute@@QBEGXZ
?GetDataAllocatedLength@CNtfsFileRecordAttribute@@QBE_JXZ
?GetDataInitiatedLength@CNtfsFileRecordAttribute@@QBE_JXZ
?GetDataRealLength@CNtfsFileRecordAttribute@@QBE_JXZ
?GetFlags@CNtfsFileRecordAttribute@@QBEGXZ
?GetHardDriveIO@CNtfsMFT@@UAEAAVCHardDriveIO@@XZ
?GetHardDriveNumber@CNtfsVolume@@QBEJXZ
?GetID@CNtfsFileRecordAttribute@@QBEKXZ
?GetLastVCN@CNtfsFileRecordAttribute@@QBE_JXZ
?GetMftLcnAddress@CNtfsVolume@@QBE_JXZ
?GetMftMirrorLcnAddress@CNtfsVolume@@QBE_JXZ
?GetName@CNtfsFileRecordAttribute@@QBEHPAGJ@Z
?GetNameLength@CNtfsFileRecordAttribute@@QBEJXZ
?GetSectorAddressFromLCN@CNtfsVolume@@QBE_J_J@Z
?GetSectorsPerCluster@CNtfsVolume@@QBEJXZ
?GetSectorsPerIndexRecord@CNtfsVolume@@QBEJXZ
?GetSize@?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QBEHXZ
?GetSize@?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QBEHXZ
?GetSize@?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QBEHXZ
?GetSize@?$CSimpleArray@VCNtfsFileRecordAttribute@@V?$CSimpleArrayEqualHelper@VCNtfsFileRecordAttribute@@@MyTemplate@@@MyTemplate@@QBEHXZ
?GetSourceFileRecord@CNtfsFileRecord@@QAEPAEAAJ@Z
?GetSourceFileRecordAttribute@CNtfsFileRecordAttribute@@QBEPAEAAJ@Z
?GetStartVCN@CNtfsFileRecordAttribute@@QBE_JXZ
?GetTotalSecs@CStorageIO@@UAE_JXZ
?GetTotalSecs@CVolumeIO@@UAE_JXZ
?GetType@CNtfsFileRecordAttribute@@QBEKXZ
?GetVolumeClusterCount@CNtfsVolume@@QBE_JXZ
?GetVolumeSerialNumber@CNtfsVolume@@QBE_JXZ
?GetVolumeStartSectorNumber@CNtfsVolume@@QBE_JXZ
?GetVolumeTotalSectorNumber@CNtfsVolume@@QBE_JXZ
?GetWriteSectosPerFileRecord@CNtfsVolume@@QBEJXZ
?Has0X20@CNtfsMFT@@QAEHXZ
?InternalSetAtIndex@?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAEXHABI@Z
?InternalSetAtIndex@?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAEXHABUSECTOR_RANGE@@@Z
?InternalSetAtIndex@?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEXHABUtagDataRun@@@Z
?IsCompressed@CNtfsFileRecordAttribute@@QBEHXZ
?IsInitiated@CNtfsMFT@@QAEHXZ
?IsNamed@CNtfsFileRecordAttribute@@QBEHXZ
?IsResident@CNtfsFileRecordAttribute@@QBEHXZ
?IsSparseFile@CNtfsFileRecordAttribute@@QBEHXZ
?RemoveAll@?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAEXXZ
?RemoveAll@?$CSimpleArray@USECTOR_RANGE@@V?$CSimpleArrayEqualHelper@USECTOR_RANGE@@@MyTemplate@@@MyTemplate@@QAEXXZ
?RemoveAll@?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEXXZ
?RemoveAt@?$CSimpleArray@IV?$CSimpleArrayEqualHelper@I@MyTemplate@@@MyTemplate@@QAEHH@Z
?RemoveAt@?$CSimpleArray@UtagDataRun@@V?$CSimpleArrayEqualHelper@UtagDataRun@@@MyTemplate@@@MyTemplate@@QAEHH@Z
?SetDataAllocatedLength@CNtfsFileRecordAttribute@@QAEH_J@Z
?SetDataInitiatedLength@CNtfsFileRecordAttribute@@QAEH_J@Z
?SetDataRealLength@CNtfsFileRecordAttribute@@QAEH_J@Z
?SetID@CNtfsFileRecordAttribute@@QAEXG@Z
?SetLastVCN@CNtfsFileRecordAttribute@@QAEH_J@Z
?SetSectorSize@IDevice@@QAEXK@Z
?SetStartVCN@CNtfsFileRecordAttribute@@QAEH_J@Z
?SetStorage@CStorageIO@@QAEXPAUIStorageDevice@@@Z
GetModule
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ