Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3.dll
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3.dll
Resource
win10v2004-20240508-en
Target
b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3
Size
442KB
MD5
4fb1b32bdef4796f48259f8a99f7a85b
SHA1
1a37b53b4a0a316ea657f699b61ff0063487983f
SHA256
b227d9721ccf1e97de8fd68cd6538460ff01e224adea66cc1dda2f6bd3a917e3
SHA512
06766085cd7befe095804718398414323804e431158caf0777d8125ef3e63027bba47a80362db16830343ce32014909e92ca9dd2a534ea219f6aaf6075591201
SSDEEP
6144:4BqrTExMbwTmaI1gWzShM/EhZi5mdCavkHsqrqseBbm13fvqWBV+UdvrEFp7hKO:WqrQO2/C1CYEhQ5frq1VmRBjvrEH7F
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
arsyswatcher.pdb
WriteLog
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetSystemDirectoryW
GetTickCount
WaitForMultipleObjects
SystemTimeToTzSpecificLocalTime
DeviceIoControl
GetDriveTypeW
CreateThread
GetFileInformationByHandle
GetExitCodeThread
FindClose
MultiByteToWideChar
ReadProcessMemory
TerminateThread
OpenProcess
GetProcessHeap
GetModuleHandleW
HeapFree
GetCurrentProcess
SystemTimeToFileTime
HeapAlloc
FindFirstFileW
GetFileSize
ResumeThread
GetSystemTime
CloseHandle
CancelIo
CreateEventW
CreateFileW
GetFileAttributesW
WaitForSingleObjectEx
SetEvent
WaitForSingleObject
GetProcAddress
GetLastError
LoadLibraryW
FreeLibrary
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
GetVersionExW
LoadLibraryExW
GetModuleFileNameW
OutputDebugStringW
GetCurrentProcessId
GetEnvironmentVariableW
GetCurrentDirectoryW
ExpandEnvironmentStringsW
GetWindowThreadProcessId
GetWindow
GetSystemMetrics
IsWindowVisible
GetWindowLongW
GetWindowTextW
FindWindowW
GetParent
FindFirstPrinterChangeNotification
ClosePrinter
FindNextPrinterChangeNotification
FreePrinterNotifyInfo
EnumPrintersW
FindClosePrinterChangeNotification
OpenPrinterW
OpenProcessToken
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
PathIsDirectoryW
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW
PathAppendW
PathIsFileSpecW
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Swap_all@_Container_base12@std@@QAEXAAU12@@Z
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_except_handler4_common
__clean_type_info_names_internal
wcsrchr
wcscspn
_wtoi
swscanf
towupper
wcstok
realloc
iswspace
wcsstr
_getdrives
towlower
_wcsicmp
_time64
?terminate@@YAXXZ
ldiv
toupper
_vsnwprintf
_beginthreadex
tolower
malloc
_wcsnicmp
free
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
memmove
_except1
_CxxThrowException
__CxxFrameHandler3
memcmp
memcpy
memset
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
??0DataLossDelegator@syswatcher@@QAE@ABV01@@Z
??0DataLossDelegator@syswatcher@@QAE@XZ
??0FileChangesMonitor@syswatcher@@QAE@ABV01@@Z
??0FileChangesMonitor@syswatcher@@QAE@XZ
??0MountPointMonitor@syswatcher@@QAE@ABV01@@Z
??0MountPointMonitor@syswatcher@@QAE@XZ
??0PrinterMonitor@syswatcher@@QAE@ABV01@@Z
??0PrinterMonitor@syswatcher@@QAE@XZ
??0ProcessMonitor@syswatcher@@QAE@ABV01@@Z
??0ProcessMonitor@syswatcher@@QAE@XZ
??0ShareMonitor@syswatcher@@QAE@ABV01@@Z
??0ShareMonitor@syswatcher@@QAE@XZ
??0SystemWatcher@syswatcher@@QAE@ABV01@@Z
??0SystemWatcher@syswatcher@@QAE@XZ
??1DataLossDelegator@syswatcher@@QAE@XZ
??1FileChangesMonitor@syswatcher@@UAE@XZ
??1MountPointMonitor@syswatcher@@UAE@XZ
??1PrinterMonitor@syswatcher@@UAE@XZ
??1ProcessMonitor@syswatcher@@QAE@XZ
??1ShareMonitor@syswatcher@@UAE@XZ
??1SystemWatcher@syswatcher@@UAE@XZ
??4DataLossDelegator@syswatcher@@QAEAAV01@ABV01@@Z
??4FileChangesMonitor@syswatcher@@QAEAAV01@ABV01@@Z
??4MountPointMonitor@syswatcher@@QAEAAV01@ABV01@@Z
??4PrinterMonitor@syswatcher@@QAEAAV01@ABV01@@Z
??4ProcessMonitor@syswatcher@@QAEAAV01@ABV01@@Z
??4ShareMonitor@syswatcher@@QAEAAV01@ABV01@@Z
??4SystemWatcher@syswatcher@@QAEAAV01@ABV01@@Z
??_7DataLossDelegator@syswatcher@@6B@
??_7FileChangesMonitor@syswatcher@@6B@
??_7FileChangesMonitor@syswatcher@@6BIConsumer@1@@
??_7FileChangesMonitor@syswatcher@@6BIProducer@1@@
??_7MountPointMonitor@syswatcher@@6B@
??_7PrinterMonitor@syswatcher@@6B@
??_7ProcessMonitor@syswatcher@@6B@
??_7ShareMonitor@syswatcher@@6B@
??_7SystemWatcher@syswatcher@@6B@
?Add@FileChangesMonitor@syswatcher@@UAGKPAXPB_WKK@Z
?AddPolicy@FileChangesMonitor@syswatcher@@UAGKPAXKPB_W@Z
?AddRefer@FileChangesMonitor@syswatcher@@UAGKPAXKPB_W@Z
?Bind@FileChangesMonitor@syswatcher@@UAGKPAXKK00@Z
?CheckChanges@MountPointMonitor@syswatcher@@UAGKPAK00@Z
?CheckDrives@MountPointMonitor@syswatcher@@UAGKKPAK@Z
?Choose@FileChangesMonitor@syswatcher@@MAGKPAX0IPAH@Z
?CleanupThread@FileChangesMonitor@syswatcher@@KGIPAX@Z
?CleanupThread@ShareMonitor@syswatcher@@KGIPAX@Z
?Close@DataLossDelegator@syswatcher@@UAGKPAX@Z
?Close@FileChangesMonitor@syswatcher@@UAGKPAX@Z
?Close@PrinterMonitor@syswatcher@@UAGKPAX@Z
?Close@ProcessMonitor@syswatcher@@UAGKPAX@Z
?Close@ShareMonitor@syswatcher@@UAGKPAX@Z
?Close@SystemWatcher@syswatcher@@UAGKPAX@Z
?ClosePrinters@PrinterMonitor@syswatcher@@MAGKPAX@Z
?Consume@FileChangesMonitor@syswatcher@@MAGKPAX0I@Z
?ConsumerThread@FileChangesMonitor@syswatcher@@KGIPAX@Z
?Control@DataLossDelegator@syswatcher@@UAGKPAXK0I@Z
?CurrentDrives@MountPointMonitor@syswatcher@@UAGKPAK@Z
?DeletePolicy@FileChangesMonitor@syswatcher@@UAGKPAXPB_W@Z
?DeleteRefer@FileChangesMonitor@syswatcher@@UAGKPAXPB_W@Z
?DeviceLock@FileChangesMonitor@syswatcher@@UAGKPAX0@Z
?DeviceUnlock@FileChangesMonitor@syswatcher@@UAGKPAX0@Z
?DispatcherThread@FileChangesMonitor@syswatcher@@KGIPAX@Z
?DriveChangeEvent@FileChangesMonitor@syswatcher@@UAGKPAX@Z
?DriveChangeEvent@SystemWatcher@syswatcher@@UAGKPAX@Z
?EnumProcessesCallbackHandler@ProcessMonitor@syswatcher@@KGKKPAXPAW4_CALLBACK_CONTROL2@2@0@Z
?Filter@FileChangesMonitor@syswatcher@@MAGKPAX0IPAKPAH@Z
?FreeData@ProcessMonitor@syswatcher@@UAGKPAX@Z
?Get@FileChangesMonitor@syswatcher@@UAGKPAXK0I@Z
?GetDriveTypeW@MountPointMonitor@syswatcher@@UAGKKPAK@Z
?GetFileChangesType@MountPointMonitor@syswatcher@@UAGKPB_WPAK@Z
?GetHandle@SystemWatcher@syswatcher@@UAGKPAXKPAPAX@Z
?GetMountPointMonitor@FileChangesMonitor@syswatcher@@UAGPAUIMountPointMonitor@2@PAX@Z
?Integrate@FileChangesMonitor@syswatcher@@UAGKPAXKK0@Z
?Open@DataLossDelegator@syswatcher@@UAGKPAPAXP6GKKPAX11@Z1@Z
?Open@FileChangesMonitor@syswatcher@@UAGKPAPAXP6GKKPAX11@Z1K@Z
?Open@PrinterMonitor@syswatcher@@UAGKPAPAXP6GKKPAX11@Z1@Z
?Open@ProcessMonitor@syswatcher@@UAGKPAPAXPAUIHash@2@W4HASH_ALGORITHM@2@P6GKKPAX33@Z3K@Z
?Open@ProcessMonitor@syswatcher@@UAGKPAPAXPAUIOption@2@PAXP6GKK222@Z2K@Z
?Open@ShareMonitor@syswatcher@@UAGKPAPAXP6GKKPAX11@Z11K@Z
?Open@SystemWatcher@syswatcher@@UAGKPAPAXKKKP6GKKPAX11@Z1PAUIOption@2@1@Z
?Produce@FileChangesMonitor@syswatcher@@MAGKPAX0I@Z
?ProducerThread@FileChangesMonitor@syswatcher@@KGIPAX@Z
?Query@FileChangesMonitor@syswatcher@@UAGKPAXK0PAI@Z
?QueryRemove@FileChangesMonitor@syswatcher@@UAGKPAX0@Z
?RaiseEvent@FileChangesMonitor@syswatcher@@UAGKPAX0IK@Z
?ReadEvent@FileChangesMonitor@syswatcher@@KGXKKPAU_OVERLAPPED@@@Z
?Remove@FileChangesMonitor@syswatcher@@UAGKPAXPB_WKK@Z
?RemoveFailed@FileChangesMonitor@syswatcher@@UAGKPAX0@Z
?Report@SystemWatcher@syswatcher@@UAGKPAXK0@Z
?ResetPolicy@FileChangesMonitor@syswatcher@@UAGKPAX@Z
?Scan@ProcessMonitor@syswatcher@@MAGKPAX@Z
?ScanPrinters@PrinterMonitor@syswatcher@@MAGKPAX@Z
?ScanThread@ProcessMonitor@syswatcher@@KGIPAX@Z
?ServiceCtrlHandler@SystemWatcher@syswatcher@@SGKPAXKK00@Z
?Set@FileChangesMonitor@syswatcher@@UAGKPAXK0I@Z
?Set@ProcessMonitor@syswatcher@@UAGKPAXKK@Z
?Set@ShareMonitor@syswatcher@@UAGKPAXKI@Z
?Set@SystemWatcher@syswatcher@@UAGKPAXK0I@Z
?ShareMonitorThread@ShareMonitor@syswatcher@@KGIPAX@Z
?StartDriveEvent@FileChangesMonitor@syswatcher@@UAGKPAX@Z
?Subscribe@SystemWatcher@syswatcher@@UAGKPAXKK@Z
?TryRead@FileChangesMonitor@syswatcher@@MAGKPAX0@Z
?WatchSignal@SystemWatcher@syswatcher@@KGIPAX@Z
?WatchThread@PrinterMonitor@syswatcher@@KGIPAX@Z
?WatchThread@SystemWatcher@syswatcher@@KGIPAX@Z
?WorkerThread@ShareMonitor@syswatcher@@KGIPAX@Z
?getcpid@ProcessMonitor@syswatcher@@UAGKPAXKPAPAKPAK@Z
?getppid@ProcessMonitor@syswatcher@@UAGKPAXKPAPAKPAK@Z
BeginDeviceHandleNotification
BeginDeviceNotification
BeginPsApiEnvironment
BinaryToHexString
ChangeTokenPrivilege
ComposeWindowHandleHelperResult
DiffSystemTime
EndDeviceNotification
EndPsApiEnvironment
EnumerateHandles
EnumerateProcesses
FindCloseWindowHandleChanges
FindFirstWindowHandleChanges
FindNextWindowHandleChanges
FindWindowHandleHelper
FreeProcessIdHelper
FreeWindowHandleHelper
GetFileSizeHelperW
GetFileSizeQW
GetFileTimeHelperW
GetParentProcessId
GetProcessCommandLineW
GetProcessFileNameW
GetProcessHandleFileNameW
GetProcessIdHelperExW
GetProcessIdHelperW
GetRealFilePathName
GetServiceHandle
GetWindowHandle
HexStringToBinary
IsExtensionW
IsServiceInstalled
MultiStringToWideString
MultiStringToWideStringN
NtToDosDeviceNameW
OpenProcessTokenHelper
QueryInformationProcessHelper
ReleaseString
ReleaseStringList2W
ReleaseStringListW
SetServiceHandle
SetWindowHandle
StringCompareRight
StringFindLeftCharW
StringFindRightToken
StringListByTokenW
StringReplaceW
StringToList2W
SystemWatcherSetDriveMask
TrimString
basenameW
wstristr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ