Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
ExecModelClient.dll
Resource
win10v2004-20240508-en
Target
ExecModelClient.dll
Size
234KB
MD5
2dd4365101f30ea454907737d5bbfe3e
SHA1
57b74f993dcd21150338a6ad50a0c83057b81aae
SHA256
e88ff384650a974b2c16cb09bc7fd14b654c98066fcd9a40668079a3017029aa
SHA512
657f6ac7a9fca15880f994a295e972d94d252810912c9008432d9d92eab9f11d448247623f506686c2c3a056eb6e7715334dae5d9cec7c7135e02f40b6b16fb5
SSDEEP
6144:m7tnAZJ3J9WS3V0Hk5zsh6ObBzJ9IuV3gBYhtiWohms95VE:AevZOLh6ObBz9V3gBmtxohmC5VE
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
ExecModelClient.pdb
memmove_s
wcstok_s
wcscpy_s
realloc
_CxxThrowException
memcpy
memmove
??1exception@@UAE@XZ
??1type_info@@UAE@XZ
??0exception@@QAE@ABQBD@Z
memcmp
??0exception@@QAE@ABQBDH@Z
__CxxFrameHandler3
_callnewh
_onexit
??0exception@@QAE@XZ
_vsnwprintf
__dllonexit
?terminate@@YAXXZ
??0exception@@QAE@ABV0@@Z
_unlock
_lock
_initterm
?what@exception@@UBEPBDXZ
malloc
free
_amsg_exit
_XcptFilter
_purecall
??3@YAXPAX@Z
_except_handler4_common
toupper
memcpy_s
_vsnprintf_s
memset
FindResourceExW
GetModuleHandleW
GetModuleHandleExW
DisableThreadLibraryCalls
GetModuleFileNameA
LockResource
LoadResource
GetProcAddress
LoadLibraryExW
ReleaseMutex
ReleaseSemaphore
WaitForSingleObjectEx
OpenSemaphoreW
InitializeCriticalSectionEx
CreateMutexExW
CreateEventW
InitializeSRWLock
LeaveCriticalSection
EnterCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
WaitForSingleObject
AcquireSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
DeleteCriticalSection
CreateEventExW
SetEvent
WaitForMultipleObjectsEx
InitializeCriticalSection
HeapFree
GetProcessHeap
HeapAlloc
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RaiseException
GetCurrentProcess
GetProcessId
TerminateProcess
CreateThread
OpenProcessToken
GetCurrentThreadId
GetCurrentProcessId
GetThreadId
FormatMessageW
OutputDebugStringW
DebugBreak
IsDebuggerPresent
CloseHandle
NdrClientCall4
RpcStringFreeW
RpcBindingFree
RpcBindingFromStringBindingW
RpcBindingCreateW
RpcBindingBind
I_RpcMapWin32Status
I_RpcExceptionFilter
RpcStringBindingComposeW
EventWriteTransfer
EventSetInformation
EventUnregister
EventRegister
EventProviderEnabled
RoOriginateErrorW
GetRestrictedErrorInfo
RoTransformError
RoOriginateError
SetRestrictedErrorInfo
EncodePointer
DecodePointer
WindowsGetStringLen
WindowsCreateStringReference
WindowsStringHasEmbeddedNull
WindowsDeleteString
WindowsDuplicateString
WindowsIsStringEmpty
WindowsCreateString
WindowsGetStringRawBuffer
WindowsConcatString
CoInitializeEx
CoMarshalInterface
CoUninitialize
CoCreateInstance
StringFromGUID2
CreateStreamOnHGlobal
CoTaskMemRealloc
CoGetClassObject
CoCreateGuid
CoGetCallContext
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoWaitForMultipleHandles
CoTaskMemAlloc
CoReleaseMarshalData
CoGetApartmentType
CoGetCallerTID
InitializeConditionVariable
Sleep
WakeConditionVariable
InitOnceExecuteOnce
InitOnceInitialize
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
LocalReAlloc
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildSecurityDescriptorForSharingAccess
QueryTransientObjectSecurityDescriptor
FreeTransientObjectSecurityDescriptor
SHTaskPoolAllowThreadReuse
SHTaskPoolQueueTask
RoGetMatchingRestrictedErrorInfo
RoReportFailedDelegate
IsErrorPropagationEnabled
RoGetAgileReference
RoActivateInstance
RoGetActivationFactory
OpenProcess
EqualSid
GetTokenInformation
RtlQueryUnbiasedInterruptTime
RtlSleepConditionVariableSRW
RtlAcquireSRWLockShared
RtlAcquireSRWLockExclusive
RtlReleaseSRWLockExclusive
RtlReleaseSRWLockShared
RtlInitializeSRWLock
RtlFreeHeap
RtlAllocateHeap
RtlLengthSid
RtlCopySid
NtQueryInformationToken
RtlValidSid
NtQuerySystemInformation
RtlDeriveCapabilitySidsFromName
RtlGetDeviceFamilyInfoEnum
RtlRunOnceExecuteOnce
PsmGetPackageFullNameFromKey
PsmCreateKey
PsmGetKeyFromProcess
PsmGetApplicationNameFromKey
QuirkIsEnabledForPackage
CompareStringOrdinal
ord435
RegGetValueW
CoreUICreate
ApiSetQueryApiSetPresence
ResolveDelayLoadedAPI
DelayLoadFailureHook
UnsubscribeServiceChangeNotifications
SubscribeServiceChangeNotifications
OpenServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
CreateForegroundTaskManager
CreateModernVoipPolicy
DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject
PlmGetHostIdForDesktopAppxProcess
PlmGetHostIdForDynamicProcess
PlmGetHostIdForMixedHost
PlmGetHostIdForPple
TestHook_CancelShutdown
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ