Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
c3e804d5213e258543acc613d8f5c6d57cb5ed277af78b46ff1eee11eaaaf9c4.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c3e804d5213e258543acc613d8f5c6d57cb5ed277af78b46ff1eee11eaaaf9c4.dll
Resource
win10v2004-20240226-en
Target
c3e804d5213e258543acc613d8f5c6d57cb5ed277af78b46ff1eee11eaaaf9c4
Size
3.4MB
MD5
3dd13bcab95c9ba831aa7ad0e9796397
SHA1
445ac27be02f7b88ab6e76bceb4c5019a062e32a
SHA256
c3e804d5213e258543acc613d8f5c6d57cb5ed277af78b46ff1eee11eaaaf9c4
SHA512
2a1ef096fbdaeae188b5c37c02a0b325d834aeb1afab1b0b2e38d3ce0eec78424520d420a243bc06b0617a1eb2e3f3a4849f32a0ae505b3d7a594f627c4c387d
SSDEEP
49152:p+B7620mBw8lMiyjrifyiKKD+vsiRxhJggr9XFm8NAztBbPB/ATGl3xRRt5Gxde3:p+B790mA/gKKDyTRHygpXFmSmNv
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
C:\BuildAgent\work\33b2b67282fffa05\tmnetfilter\bin\Release\Win32\ProtocolFilters.pdb
CreateMutexA
CreateEventA
GetLastError
GetTempFileNameW
OpenProcess
GetProcAddress
GetModuleHandleA
GetFileAttributesW
CreateDirectoryW
LoadLibraryA
GetVersion
ProcessIdToSessionId
QueryPerformanceFrequency
QueryPerformanceCounter
DeleteFileW
DeleteCriticalSection
InitializeCriticalSection
FindClose
FindNextFileW
FindFirstFileW
ExpandEnvironmentStringsW
GetShortPathNameW
CloseHandle
WaitForSingleObject
CreateProcessW
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
WriteConsoleW
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
HeapReAlloc
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
FormatMessageA
WideCharToMultiByte
LocalFree
GetCurrentDirectoryW
CreateFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
SetEndOfFile
SetFileInformationByHandle
SetFilePointerEx
AreFileApisANSI
CopyFileW
MoveFileExW
GetFileInformationByHandleEx
MultiByteToWideChar
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
SetLastError
GetSystemTime
SystemTimeToFileTime
GetModuleHandleExW
ReleaseSRWLockShared
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemDirectoryA
GetStdHandle
GetFileType
WriteFile
GetEnvironmentVariableW
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
LoadLibraryW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
RtlUnwind
RaiseException
InterlockedFlushSList
LoadLibraryExW
ReadFile
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetModuleFileNameW
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
SetConsoleCtrlHandler
HeapFree
HeapAlloc
GetTimeZoneInformation
GetConsoleOutputCP
GetFileSizeEx
FlushFileBuffers
GetDateFormatW
GetTimeFormatW
SetEvent
GetTokenInformation
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
LookupAccountSidW
LookupAccountSidA
DeregisterEventSource
OpenProcessToken
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
PFXExportCertStoreEx
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertGetCertificateContextProperty
CertGetCertificateChain
CertSetCertificateContextProperty
CertCloseStore
CertFreeCertificateContext
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateChain
GetModuleFileNameExA
gethostbyaddr
getservbyname
ioctlsocket
gethostbyname
getservbyport
select
WSAGetLastError
WSASetLastError
send
recv
htons
WSACleanup
WSAStartup
WSAAddressToStringA
ntohs
htonl
ntohl
getsockopt
inet_addr
closesocket
connect
setsockopt
socket
shutdown
inet_ntoa
BCryptGenRandom
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
VariantClear
?PFObject_create@ProtocolFilters@@YAPAVPFObject@1@HH@Z
?pf_addException@ProtocolFilters@@YAXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@G0@Z
?pf_addFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@KW4_PF_OpTarget@1@1@Z
?pf_canDisableFiltering@ProtocolFilters@@YAH_K@Z
?pf_deleteExceptions@ProtocolFilters@@YAXW4_eEXCEPTION_CLASS@1@@Z
?pf_deleteFilter@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_free@ProtocolFilters@@YAXXZ
?pf_getFilterCount@ProtocolFilters@@YAH_K@Z
?pf_getNFEventHandler@ProtocolFilters@@YAPAVNF_EventHandler@nfapi@@XZ
?pf_getProcessOwnerA@ProtocolFilters@@YAHKPADH@Z
?pf_getProcessOwnerW@ProtocolFilters@@YAHKPA_WH@Z
?pf_getRootSSLCertFileName@ProtocolFilters@@YAHPA_WH@Z
?pf_getSSLSignedCertificate@ProtocolFilters@@YAXPBDAAV?$vector@EV?$allocator@E@std@@@std@@1@Z
?pf_importCompleted@ProtocolFilters@@YAHXZ
?pf_init@ProtocolFilters@@YAHPAVPFEvents@1@PB_WABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@KV?$function@$$A6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z@4@3@Z
?pf_isFilterActive@ProtocolFilters@@YAH_KW4_PF_FilterType@1@@Z
?pf_loadCAStore@ProtocolFilters@@YAHPBD@Z
?pf_postObject@ProtocolFilters@@YAH_KPAVPFObject@1@@Z
?pf_removeAllExceptions@ProtocolFilters@@YA_NPAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?pf_setExceptionsTimeout@ProtocolFilters@@YAXW4_eEXCEPTION_CLASS@1@_K@Z
?pf_setRootSSLCertImportFlags@ProtocolFilters@@YAXK@Z
?pf_setRootSSLCertSubject@ProtocolFilters@@YAXPBD@Z
?pf_setRootSSLCertSubjectEx@ProtocolFilters@@YAXPBD0H0H@Z
?pf_startLog@ProtocolFilters@@YAHPBD@Z
?pf_stopLog@ProtocolFilters@@YAXXZ
?pf_unzipStream@ProtocolFilters@@YAHPAVPFStream@1@@Z
?pf_updateFlags@ProtocolFilters@@YAXK@Z
?pf_waitForImportCompletion@ProtocolFilters@@YAXXZ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ