Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
ShdApi.dll
Resource
win10v2004-20240802-en
Target
ShdApi.dll
Size
127KB
MD5
81a69ef79b80cb85e9d58b2bc3b988d1
SHA1
3f6696145303419aaef92791b8837ac29bd59258
SHA256
d1f25f08a4724fccd6de7346a6b1edc16ac32889599e9e1cae16be7a1f6f5dc9
SHA512
76f24d4f77d5651936848450ffedbd133e6819315c0acb477acd2c0c77fb3d3a6999b172ae00b4ee42a6b1017d0358dd7aeefceafef936206fdf8da24ab34e46
SSDEEP
3072:/gg8HkiHnERgxUM0sq9IwAiV9GOlO9Uxrgaef8:YrNEKxFN9ibGOlIA5
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
e:\svnhome\shield6_build\trunk\Release\x64\ShdApi.pdb
FileTimeToSystemTime
GetLocalTime
lstrcpynW
lstrlenW
GetLastError
GetCurrentProcess
CloseHandle
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
DeleteCriticalSection
FreeLibrary
GetProcAddress
GetModuleHandleW
lstrcmpiW
RaiseException
LoadLibraryExW
InitializeCriticalSection
TlsGetValue
TlsSetValue
SystemTimeToFileTime
lstrcpyW
CreateFileW
WriteFile
GetCurrentProcessId
GetLogicalDrives
LocalFree
ReadFile
GetShortPathNameW
TlsAlloc
GetProcessShutdownParameters
SetProcessShutdownParameters
TlsFree
HeapAlloc
HeapFree
GetSystemTimeAsFileTime
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
RtlCaptureContext
FindClose
FindNextFileW
FindFirstFileW
GetUserDefaultUILanguage
MultiByteToWideChar
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
WideCharToMultiByte
SetLastError
lstrcpynA
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapDestroy
GetDlgItem
GetWindowRect
ScreenToClient
MoveWindow
CharNextW
SetWindowTextW
RegDeleteValueW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyW
GetTokenInformation
OpenProcessToken
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
RegCreateKeyExW
RegCloseKey
ConvertSidToStringSidW
SHGetSpecialFolderPathW
CoSetProxyBlanket
CoInitialize
CoUninitialize
CoCreateGuid
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
VariantInit
VariantClear
VarUI4FromStr
?g_OsVer@@3GA
?g_SpVer@@3GA
?ShdFormatMessage@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@JK@Z
?ShdFormatTime@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AEAU_SYSTEMTIME@@@Z
?GetChildCount@CXmlElem@@QEAAIXZ
?GetAttr@CXmlElem@@QEAAPEB_WPEB_W@Z
?QueryStrValue@CShdKey@@QEAAJPEB_WAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H@Z
?Open@CShdKey@@QEAAJPEAUHKEY__@@PEB_WKK@Z
??1CShdKey@@QEAA@XZ
??0CShdKey@@QEAA@XZ
?GetChildData@CXmlElem@@QEAAPEB_WPEB_WH@Z
?GetChild@CXmlElem@@QEAAPEAV1@PEB_W@Z
?g_AppPath@@3V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@A
?GetChild@CXmlElem@@QEAAPEAV1@I@Z
?ShdAcronym2PrimaryKey@@YAPEAUHKEY__@@PEB_WPEAH@Z
?Load@CShdXml@@QEAAPEAVCXmlElem@@PEB_W0H@Z
??1CShdXml@@QEAA@XZ
??0CShdXml@@QEAA@XZ
??1CShdHttp@@QEAA@XZ
?ShdAStr2Bin@@YAHPEBDPEAEH@Z
?DownloadData@CShdHttp@@QEAAJAEAU_SHDHTTP_REQUEST@@@Z
??0CShdHttp@@QEAA@XZ
?ShdBin2AStr@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@PEBEH@Z
?Digest@CShdMd5@@QEAAXPEBEIPEAE@Z
??0CShdMd5@@QEAA@XZ
?GetSysDriveDiskNumber@CShdDisk@@SAJXZ
?GetDiskSerial@CShdDisk@@SAHKAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ShdGetProcessId@@YAKPEB_WK@Z
?ShdTrace@@YAXKKPEB_W0K0ZZ
?RSAPublicDecrypt@@YAHPEAURSA_PUBLIC_KEY@@PEAEI1PEAI@Z
?ShdGetLongPathName@@YAHPEB_WAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ShdFindSwitch@@YAHPEB_W@Z
?ShdGetSwitchParam@@YAHPEB_WAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@H@Z
?WStrToUTF8@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@PEB_W@Z
?ShdFormatTime@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_J@Z
?DelElem@CXmlElem@@QEAAHPEB_W@Z
StrToIntW
_CxxThrowException
__CxxFrameHandler3
__clean_type_info_names_internal
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
__CppXcptFilter
_amsg_exit
_encoded_null
_initterm_e
_initterm
_malloc_crt
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
__C_specific_handler
memset
wcschr
memcpy
_wtoi
swscanf_s
_wcsupr_s
qsort
wcsstr
wcsncpy_s
_recalloc
??2@YAPEAX_K@Z
calloc
wcscspn
wcsspn
malloc
_mbscmp
free
??_U@YAPEAX_K@Z
??_V@YAXPEAX@Z
wcsnlen
_ismbcspace
_mbscspn
_mbsspn
_mbschr
vsprintf_s
??3@YAXPEAX@Z
isdigit
atol
memcpy_s
memmove_s
vswprintf_s
_vscwprintf
strnlen
sprintf_s
strtoul
_wcsicmp
iswspace
_mbsinc
_vscprintf
?Count2ShdTime@@YAXKAEAU_SHDTIME@@@Z
?IsValidShdTime@@YAHAEBU_SHDTIME@@@Z
?ShdActivate@@YAJPEBDPEAEI@Z
?ShdAddInfo@@YAJKPEBXK@Z
?ShdAddRedirectEntry@@YAKPEAEKAEAKKPEB_W2PEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?ShdAddSnapshot@@YAJAEAU_ARCHIVE_POINT@@@Z
?ShdAddTask@@YAJAEAU_SHIELD_TASK@@@Z
?ShdAddUser@@YAJAEAU_SHIELD_USER@@PEB_W@Z
?ShdArrayToMultiString@@YAPEA_WAEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@AEAKH@Z
?ShdBackupSyncReg@@YAJXZ
?ShdCalcSpace@@YAJXZ
?ShdCheckActivate@@YAJXZ
?ShdCheckUpdate@@YAJXZ
?ShdClose@@YAJXZ
?ShdCompareNetOption@@YAHAEAU_SHDNETOPT@@0@Z
?ShdConvertKeyName@@YAJAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ShdDecryptRegCode@@YAJPEAEI@Z
?ShdDefragInSubSys@@YAJK@Z
?ShdDeleteInfo@@YAJKPEAGG@Z
?ShdDeleteLog@@YAJPEAGG@Z
?ShdDeleteSnapshot@@YAJPEAGG@Z
?ShdDeleteTask@@YAJPEAGG@Z
?ShdDeleteUser@@YAJPEAGG@Z
?ShdDigestPassword@@YAXPEB_WPEAE@Z
?ShdExecTask@@YAHK@Z
?ShdExportLog@@YAHPEB_W@Z
?ShdExportSyncReg@@YAJPEB_W@Z
?ShdFindSnapshot@@YAJAEAGPEBXG@Z
?ShdFormatMsg@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@J@Z
?ShdFormatTime@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AEBU_SHDTIME@@@Z
?ShdGetActivateInfo@@YAJAEAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@0@Z
?ShdGetActiveTimeBias@@YAGXZ
?ShdGetAllInfo@@YAPEAXKKAEAKK@Z
?ShdGetBuildNumber@@YAKXZ
?ShdGetCurLangId@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?ShdGetCurrentTime@@YAXAEAU_SHDTIME@@@Z
?ShdGetFileSysString@@YAPEB_WI@Z
?ShdGetInfo@@YAJKPEAXK@Z
?ShdGetLangId@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@XZ
?ShdGetLangInfos@@YAXAEAV?$CAtlArray@ULANGINFO@@V?$CElementTraits@ULANGINFO@@@ATL@@@ATL@@@Z
?ShdGetLastLogonInfo@@YAHAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@Z
?ShdGetLogTypeString@@YAPEB_WI@Z
?ShdGetMachineCode@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@XZ
?ShdGetModuleLang@@YAPEAVCXmlElem@@PEB_W0@Z
?ShdGetMultiString@@YAJKAEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?ShdGetNetStateString@@YAPEB_WK@Z
?ShdGetPModeString@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@K@Z
?ShdGetProductType@@YAKXZ
?ShdGetRedirectEntry@@YAKPEAEKAEAKAEAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PEAV12@PEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@2@@Z
?ShdGetRegCode@@YAJPEBD0PEAEI@Z
?ShdGetRestoreMode@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AEAU_SHDRESTOREMODE@@@Z
?ShdGetSerialInfo@@YAHPEBDAEAU_SERIALINFO@@@Z
?ShdGetSnapTypeIcon@@YAHEE@Z
?ShdGetSnapTypeString@@YAPEB_WE@Z
?ShdGetSnapshotInfo@@YAJAEAU_ARCHIVE_POINT@@@Z
?ShdGetString@@YAPEB_WPEB_W@Z
?ShdGetTaskDescription@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AEAU_SHIELD_TASK@@@Z
?ShdGetTaskInfo@@YAJAEAU_SHIELD_TASK@@@Z
?ShdGetTaskTypeString@@YAPEB_WE@Z
?ShdGetUpdateMode@@YAJAEAU_SHDUPDATEMODE@@@Z
?ShdGetUserInfo@@YAJAEAU_SHIELD_USER@@@Z
?ShdGetVersionType@@YAKXZ
?ShdGetWindowsUpdateStatusString@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@_J@Z
?ShdGetWorkModeState@@YAKPEAK@Z
?ShdHasFreeSpace@@YAHXZ
?ShdHasUserRight@@YAHK@Z
?ShdHookKeyboard@@YAJK@Z
?ShdInitLang@@YAPEAVCXmlElem@@PEB_W000@Z
?ShdIoCtrl@@YAJKPEBXKPEAXPEAK@Z
?ShdIsAccessCtrlEnabled@@YAHXZ
?ShdIsConflictTask@@YAHPEAU_SHIELD_TASK@@0@Z
?ShdIsDemoExpired@@YAHXZ
?ShdIsUninstalled@@YAHXZ
?ShdIsValidBiosKey@@YAHGG@Z
?ShdIsValidCode@@YAHPEBD@Z
?ShdIsValidSerial@@YAJPEBD@Z
?ShdIsValidTask@@YAJAEAU_SHIELD_TASK@@@Z
?ShdIsWriteProtected@@YAHXZ
?ShdLockSnapshot@@YAJPEAGGH@Z
?ShdLogonUser@@YAJPEB_W0@Z
?ShdMountSnapshot@@YAJGJPEB_WH@Z
?ShdMultiStringToArray@@YAXAEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@PEA_WK@Z
?ShdOpen@@YAJXZ
?ShdOptimizeSnapshot@@YAJH@Z
?ShdParseRestoreMode@@YAHAEAU_SHDRESTOREMODE@@@Z
?ShdParseSchTime@@YAHKPEB_WAEAU_SHDTIME@@PEAE@Z
?ShdParseUpdateMode@@YAHAEAU_SHDUPDATEMODE@@@Z
?ShdQueryLicence@@YAJAEAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@AEAV?$CAtlMap@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@V12@V?$CElementTraits@V?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@@2@V32@@2@@Z
?ShdRegisterNotify@@YAJPEAUIShdNotify@@@Z
?ShdResetBaseline@@YAJXZ
?ShdRestoreDrive@@YAJPEAGGHPEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?ShdRestoreSnapshot@@YAJGHPEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?ShdRevokeRegCode@@YAJPEBD0@Z
?ShdSendEvent@@YAJK_KPEBXK@Z
?ShdSetDlgLang@@YAPEAVCXmlElem@@PEAUHWND__@@PEB_W1H@Z
?ShdSetInfo@@YAJKPEBXK@Z
?ShdSetLangId@@YAJPEB_W@Z
?ShdSetLastLogonInfo@@YAJHPEB_W@Z
?ShdSetMultiString@@YAJKAEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@H@Z
?ShdSetRestoreMode@@YAJAEAU_SHDRESTOREMODE@@@Z
?ShdSetSnapshotInfo@@YAJAEAU_ARCHIVE_POINT@@@Z
?ShdSetSyncFile@@YAJAEAV?$CAtlArray@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@V?$CElementTraits@V?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@@2@@ATL@@@Z
?ShdSetTaskInfo@@YAJAEAU_SHIELD_TASK@@@Z
?ShdSetUpdateMode@@YAJAEAU_SHDUPDATEMODE@@@Z
?ShdSetUserInfo@@YAJAEAU_SHIELD_USER@@PEB_W@Z
?ShdSkipChkCurSnap@@YAJXZ
?ShdSwitchProtectMode@@YAJEE@Z
?ShdTime2Count@@YAKAEBU_SHDTIME@@@Z
?ShdTime2SysTime@@YAHAEBU_SHDTIME@@AEAU_SYSTEMTIME@@@Z
?ShdTime2Time64@@YAHAEBU_SHDTIME@@AEA_J@Z
?ShdUninstall@@YAJG@Z
?ShdUnmountSnapshot@@YAJJ@Z
?ShdUnregisterNotify@@YAJPEAUIShdNotify@@@Z
?ShdUpdateBaseline@@YAJXZ
?ShdUpdateSystemNow@@YAJXZ
?ShdUpdateWindowsNow@@YAJK@Z
?ShdWriteLog@@YAJKPEB_W0ZZ
?SysTime2ShdTime@@YAXAEBU_SYSTEMTIME@@AEAU_SHDTIME@@@Z
?Time642ShdTime@@YAXAEB_JAEAU_SHDTIME@@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ