Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Behavioral task
behavioral1
Sample
0x0007000000015d1e-104.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0x0007000000015d1e-104.dll
Resource
win10v2004-20240419-en
Target
0x0007000000015d1e-104.dat
Size
23.2MB
MD5
8721b105e2efed4fdb463323d81f0a68
SHA1
7d277e0906ce4107542fbb24553a8db4d99fa758
SHA256
9d090f43c035ae5ef025a82d7308672a05996ee41cb44b1fd3951f2244602a68
SHA512
3e3a8a11392e41b685d826fcf3db0036533a738f1026c7774b7200e6403f3549b65c8fee61c9d6e43e5da3c3d090a26ea8faa65c577196d5fadb7bdc72ba587f
SSDEEP
393216:hVp/ry7BsnFZrzzGcsUPdsnwINNxKwhT/Sa3sy8YPOjRfo1eDrGt7kfbooeXJ6zu:YGsoCPBZ
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
SendSAS
WTSQuerySessionInformationW
WTSEnumerateSessionsA
WTSFreeMemory
LsaFreeReturnBuffer
LsaEnumerateLogonSessions
LsaGetLogonSessionData
ReadFile
SetFilePointer
ResetEvent
ReleaseMutex
CreateMutexA
Sleep
GlobalSize
GlobalFree
MultiByteToWideChar
CreateFileMappingW
OpenFileMappingW
UnmapViewOfFile
MapViewOfFile
VirtualQuery
GetProcessHeap
HeapFree
HeapAlloc
LoadLibraryExA
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObjectEx
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
CreateSemaphoreW
SetThreadPriority
WakeAllConditionVariable
TryEnterCriticalSection
InitOnceBeginInitialize
InitOnceComplete
GetStdHandle
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
InitializeSRWLock
GetSystemDirectoryW
GetModuleFileNameW
GetSystemTimeAsFileTime
GetProcessAffinityMask
SetThreadErrorMode
GetModuleHandleExW
SwitchToThread
MoveFileExA
MoveFileExW
CreateEventW
WaitForMultipleObjectsEx
WideCharToMultiByte
GetCurrentThread
RtlCaptureContext
GetLogicalDrives
SetFileTime
RtlLookupFunctionEntry
SetConsoleMode
GetSystemInfo
GetDiskFreeSpaceExW
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
VirtualQueryEx
GetTickCount64
GlobalMemoryStatusEx
SetErrorMode
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
GetFileType
GetFileInformationByHandleEx
SetHandleInformation
InitializeCriticalSection
GetFileSize
DuplicateHandle
GetLogicalProcessorInformation
PostQueuedCompletionStatus
CreateIoCompletionPort
GetQueuedCompletionStatusEx
SetFileCompletionNotificationModes
ConnectNamedPipe
CancelIoEx
GetOverlappedResult
WriteFile
FreeEnvironmentStringsW
CompareStringOrdinal
SetThreadStackGuarantee
GetEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCommandLineW
FlushFileBuffers
SetFilePointerEx
WriteFileEx
SleepEx
HeapReAlloc
GetFileInformationByHandle
CreateDirectoryW
DeleteFileW
RemoveDirectoryW
GetFinalPathNameByHandleW
CopyFileExW
CancelIo
ExitProcess
GetFullPathNameW
ReadFileEx
WaitForMultipleObjects
GetWindowsDirectoryW
CreateProcessW
ReadConsoleW
TlsGetValue
TlsSetValue
GetTempPathW
GetFileAttributesW
FindNextFileW
FindFirstFileW
FindClose
LocalAlloc
LocalFree
CreateNamedPipeW
SleepConditionVariableSRW
GlobalAlloc
GlobalUnlock
GlobalLock
GetModuleHandleW
LoadLibraryA
lstrlenW
RtlVirtualUnwind
FileTimeToSystemTime
GetCurrentDirectoryW
ReleaseSemaphore
GetNativeSystemInfo
FreeLibrary
LoadLibraryExW
GetComputerNameExW
SetLastError
GetUserDefaultLocaleName
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ProcessIdToSessionId
CreateThread
SetConsoleCtrlHandler
CreateSemaphoreA
GetExitCodeProcess
ResumeThread
QueueUserAPC
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
WTSGetActiveConsoleSessionId
GetProcAddress
SetNamedPipeHandleState
CreateFileW
CreateEventA
SetThreadExecutionState
GetCurrentProcess
OpenProcess
GetCurrentProcessId
OutputDebugStringW
GetFileSizeEx
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetConsoleOutputCP
PeekNamedPipe
FreeLibraryAndExitThread
ExitThread
TlsFree
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
RtlUnwindEx
RaiseException
RtlPcToFileHeader
GetCPInfo
GetStringTypeW
LCMapStringEx
DecodePointer
EncodePointer
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FormatMessageW
TryAcquireSRWLockExclusive
SetEvent
LoadLibraryW
TerminateProcess
GetLastError
GetCurrentThreadId
GetModuleHandleExA
WaitForSingleObject
CloseHandle
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapSize
HeapQueryInformation
SetStdHandle
SetEndOfFile
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetFileTime
StartServiceCtrlDispatcherW
RegDeleteTreeW
RegOpenKeyExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
CreateProcessWithLogonW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyExW
CreateProcessAsUserW
RegisterServiceCtrlHandlerExW
AllocateAndInitializeSid
EqualSid
FreeSid
GetUserNameW
AdjustTokenPrivileges
DuplicateTokenEx
ImpersonateLoggedOnUser
LookupPrivilegeValueW
RegQueryInfoKeyW
RegCloseKey
RegEnumKeyExW
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid
SetServiceStatus
SystemFunction036
SetSecurityDescriptorDacl
SetEntriesInAclW
InitializeSecurityDescriptor
CreateProcessWithTokenW
CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemFree
OleInitialize
CoSetProxyBlanket
CoInitializeSecurity
PropVariantClear
StringFromGUID2
ReleaseStgMedium
OleIsCurrentClipboard
OleGetClipboard
OleSetClipboard
OleUninitialize
SetWindowLongPtrW
EmptyClipboard
RegisterClipboardFormatW
SetClipboardData
MsgWaitForMultipleObjectsEx
GetRawInputData
GetKeyboardState
MapVirtualKeyExW
GetSystemMetrics
VkKeyScanExW
RegisterClassExA
CreateWindowExA
GetClipboardOwner
SetClipboardViewer
ChangeClipboardChain
RegisterClipboardFormatA
CountClipboardFormats
EnumClipboardFormats
GetClipboardFormatNameA
IsClipboardFormatAvailable
LoadCursorA
FindWindowExA
GetDesktopWindow
ExitWindowsEx
AttachThreadInput
SetWindowPos
AdjustWindowRectEx
GetMenu
GetWindowLongW
GetMessageA
LockWorkStation
GetCursorPos
GetCursorInfo
DefWindowProcA
SetWindowsHookExA
DispatchMessageA
UnhookWindowsHookEx
GetMessageW
DestroyAcceleratorTable
PostQuitMessage
AppendMenuW
InsertMenuW
VkKeyScanW
ClientToScreen
DispatchMessageW
RedrawWindow
ValidateRect
PostThreadMessageW
PeekMessageW
MapVirtualKeyW
GetUpdateRect
PostMessageW
GetIconInfo
CreatePopupMenu
CreateMenu
SetMenuItemInfoW
DrawIconEx
CheckMenuItem
CreateWindowExW
RegisterClassW
TrackPopupMenu
DefWindowProcW
CreateIcon
DestroyIcon
RegisterWindowMessageA
PostMessageA
SendMessageA
GetUserObjectInformationA
GetThreadDesktop
CloseDesktop
SetThreadDesktop
OpenInputDesktop
EnumDisplaySettingsExW
EnumDisplayDevicesW
GetKeyState
CallNextHookEx
FindWindowA
PostThreadMessageA
DestroyWindow
GetDC
ReleaseDC
BlockInput
GetForegroundWindow
GetWindowThreadProcessId
InvalidateRgn
RegisterRawInputDevices
CloseClipboard
GetDoubleClickTime
ChangeDisplaySettingsExW
MessageBoxW
ToUnicodeEx
GetKeyboardLayout
EnumDisplaySettingsW
SetForegroundWindow
SendMessageW
FindWindowW
GetClipboardData
OpenClipboard
RegisterClassExW
SendInput
TranslateMessage
CreateAcceleratorTableW
ShowWindow
BCryptOpenAlgorithmProvider
BCryptGenRandom
BCryptCloseAlgorithmProvider
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
NtReadFile
NtDeviceIoControlFile
NtWriteFile
RtlNtStatusToDosError
NtCreateFile
CertNameToStrA
CertCloseStore
CertEnumCertificatesInStore
CryptHashCertificate
CertOpenSystemStoreA
D3D11CreateDevice
CreateDXGIFactory1
GetObjectA
GetBitmapBits
CreateCompatibleDC
SelectObject
DeleteDC
GetDIBits
CreateDIBSection
DeleteObject
CreateCompatibleBitmap
BitBlt
CreateDCW
GetIfTable2
FreeMibTable
SendARP
GetAdaptersAddresses
GetIfEntry2
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum
GetErrorInfo
SysAllocString
VariantClear
SysStringLen
SysFreeString
PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhCollectQueryData
CallNtPowerInformation
GetModuleFileNameExW
GetPerformanceInfo
Shell_NotifyIconW
ShellExecuteExW
SHAddToRecentDocs
ShellExecuteW
CommandLineToArgvW
SHGetKnownFolderPath
Shell_NotifyIconGetRect
WSAIoctl
getaddrinfo
closesocket
connect
WSAGetLastError
bind
listen
getsockname
getpeername
getsockopt
ioctlsocket
shutdown
recv
recvfrom
send
sendto
freeaddrinfo
setsockopt
WSASocketW
accept
WSASend
socket
WSAStartup
WSACleanup
SetWindowSubclass
RemoveWindowSubclass
DefSubclassProc
CreateEnvironmentBlock
DestroyEnvironmentBlock
drop_dart_object
free_WireSyncReturn
free_c_args
free_zero_copy_buffer_f32
free_zero_copy_buffer_f64
free_zero_copy_buffer_i16
free_zero_copy_buffer_i32
free_zero_copy_buffer_i64
free_zero_copy_buffer_i8
free_zero_copy_buffer_u16
free_zero_copy_buffer_u32
free_zero_copy_buffer_u64
free_zero_copy_buffer_u8
get_dart_object
get_rgba
init_frb_dart_api_dl
new_StringList_0
new_dart_opaque
new_uint_8_list_0
privacy_mode_hook_keyboard
privacy_mode_hook_mouse
rustdesk_core_main_args
session_get_rgba
session_get_rgba_size
session_next_rgba
session_register_texture
store_dart_post_cobject
translate
wire_cm_can_elevate
wire_cm_check_click_time
wire_cm_check_clients_length
wire_cm_close_connection
wire_cm_close_voice_call
wire_cm_elevate_portable
wire_cm_get_click_time
wire_cm_get_clients_length
wire_cm_get_clients_state
wire_cm_handle_incoming_voice_call
wire_cm_init
wire_cm_login_res
wire_cm_remove_disconnected_connection
wire_cm_send_chat
wire_cm_switch_back
wire_cm_switch_permission
wire_get_double_click_time
wire_get_local_flutter_config
wire_get_local_kb_layout_type
wire_host_stop_system_key_propagate
wire_install_install_me
wire_install_install_path
wire_install_run_without_install
wire_install_show_run_without_install
wire_main_account_auth
wire_main_account_auth_cancel
wire_main_account_auth_result
wire_main_change_id
wire_main_change_language
wire_main_change_theme
wire_main_check_connect_status
wire_main_check_mouse_time
wire_main_check_super_user_permission
wire_main_create_shortcut
wire_main_current_is_wayland
wire_main_default_video_save_directory
wire_main_device_id
wire_main_device_name
wire_main_discover
wire_main_forget_password
wire_main_get_api_server
wire_main_get_app_name
wire_main_get_app_name_sync
wire_main_get_async_status
wire_main_get_build_date
wire_main_get_connect_status
wire_main_get_current_display
wire_main_get_data_dir_ios
wire_main_get_default_sound_input
wire_main_get_env
wire_main_get_error
wire_main_get_fav
wire_main_get_fingerprint
wire_main_get_home_dir
wire_main_get_hostname
wire_main_get_lan_peers
wire_main_get_langs
wire_main_get_last_remote_id
wire_main_get_license
wire_main_get_local_option
wire_main_get_mouse_time
wire_main_get_my_id
wire_main_get_new_version
wire_main_get_option
wire_main_get_options
wire_main_get_peer
wire_main_get_peer_option
wire_main_get_peer_option_sync
wire_main_get_permanent_password
wire_main_get_socks
wire_main_get_software_update_url
wire_main_get_sound_inputs
wire_main_get_temporary_password
wire_main_get_user_default_option
wire_main_get_uuid
wire_main_get_version
wire_main_goto_install
wire_main_handle_relay_id
wire_main_has_hwcodec
wire_main_hide_docker
wire_main_init
wire_main_is_can_input_monitoring
wire_main_is_can_screen_recording
wire_main_is_installed
wire_main_is_installed_daemon
wire_main_is_installed_lower_version
wire_main_is_login_wayland
wire_main_is_process_trusted
wire_main_is_rdp_service_open
wire_main_is_root
wire_main_is_share_rdp
wire_main_is_using_public_server
wire_main_load_fav_peers
wire_main_load_lan_peers
wire_main_load_recent_peers
wire_main_load_recent_peers_sync
wire_main_on_main_window_close
wire_main_peer_has_password
wire_main_post_request
wire_main_remove_discovered
wire_main_remove_peer
wire_main_set_home_dir
wire_main_set_local_option
wire_main_set_option
wire_main_set_options
wire_main_set_peer_alias
wire_main_set_peer_option
wire_main_set_peer_option_sync
wire_main_set_permanent_password
wire_main_set_share_rdp
wire_main_set_socks
wire_main_set_user_default_option
wire_main_start_dbus_server
wire_main_start_grab_keyboard
wire_main_start_ipc_url_server
wire_main_start_pa
wire_main_start_service
wire_main_stop_service
wire_main_store_fav
wire_main_supported_hwdecodings
wire_main_test_if_valid_server
wire_main_update_me
wire_main_update_temporary_password
wire_main_use_texture_render
wire_main_wol
wire_option_synced
wire_plugin_enable
wire_plugin_event
wire_plugin_feature_is_enabled
wire_plugin_get_session_option
wire_plugin_get_shared_option
wire_plugin_install
wire_plugin_is_enabled
wire_plugin_list_reload
wire_plugin_register_event_stream
wire_plugin_reload
wire_plugin_set_session_option
wire_plugin_set_shared_option
wire_plugin_sync_ui
wire_query_onlines
wire_send_url_scheme
wire_session_add_job
wire_session_add_port_forward
wire_session_add_sync
wire_session_alternative_codecs
wire_session_cancel_job
wire_session_change_prefer_codec
wire_session_change_resolution
wire_session_close
wire_session_close_voice_call
wire_session_create_dir
wire_session_ctrl_alt_del
wire_session_elevate_direct
wire_session_elevate_with_logon
wire_session_enter_or_leave
wire_session_get_audit_server_sync
wire_session_get_custom_image_quality
wire_session_get_flutter_config
wire_session_get_image_quality
wire_session_get_keyboard_mode
wire_session_get_option
wire_session_get_peer_option
wire_session_get_platform
wire_session_get_remember
wire_session_get_scroll_style
wire_session_get_toggle_option
wire_session_get_toggle_option_sync
wire_session_get_view_style
wire_session_handle_flutter_key_event
wire_session_input_key
wire_session_input_os_password
wire_session_input_string
wire_session_is_keyboard_mode_supported
wire_session_load_last_transfer_jobs
wire_session_lock_screen
wire_session_login
wire_session_new_rdp
wire_session_peer_option
wire_session_read_dir_recursive
wire_session_read_local_dir_sync
wire_session_read_remote_dir
wire_session_reconnect
wire_session_record_screen
wire_session_refresh
wire_session_remove_all_empty_dirs
wire_session_remove_file
wire_session_remove_port_forward
wire_session_request_voice_call
wire_session_restart_remote_device
wire_session_resume_job
wire_session_send_chat
wire_session_send_files
wire_session_send_mouse
wire_session_send_note
wire_session_set_confirm_override_file
wire_session_set_custom_fps
wire_session_set_custom_image_quality
wire_session_set_flutter_config
wire_session_set_image_quality
wire_session_set_keyboard_mode
wire_session_set_scroll_style
wire_session_set_size
wire_session_set_view_style
wire_session_start
wire_session_switch_display
wire_session_switch_sides
wire_session_toggle_option
wire_set_cur_session_id
wire_set_local_flutter_config
wire_set_local_kb_layout_type
wire_start_global_event_stream
wire_stop_global_event_stream
wire_version_to_number
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ