Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
BaristaBagging.exe
Resource
win11-20240802-en
Target
BaristaBagging.json
Size
8.6MB
MD5
5c32783ed50ced55e9a3a8a2e5a0c0d4
SHA1
fd69896cb6268c93f977a56fe62201c1280710c7
SHA256
5436a830f3d34bf161b846de94286967ddb63a0090b8ac59ea0cd3e066bf00bc
SHA512
9d0f1f60da250408e4402e4e4475703eef586bb592b778836ec99fad07b0ce7abddc2611746e2835d99e28de69dfdf483eed7ab3e1d5444328e15d45ce28691b
SSDEEP
196608:ZEVEZEPE8Jf808zwUIvP4Btk3CDHKhiBm4omLvorU:ZEVEZEPEwf8xzw734BtnSCmlmDT
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
SearchIndexer.pdb
?_Winerror_map@std@@YAHH@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
_Wcsxfrm
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Xbad_alloc@std@@YAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBE_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$collate@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
_Wcscoll
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Xlength_error@std@@YAXPBD@Z
memset
wcsncmp
wcspbrk
memmove_s
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
memmove
_o__wtol
_o__initialize_narrow_environment
_o_calloc
_o_ceil
_o_exit
_o_free
_o_iswspace
_o_iswxdigit
_o_malloc
_o_qsort
_o_realloc
_o_terminate
_o_towupper
_o_wcsncpy_s
_o_wcstok
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__get_narrow_winmain_command_line
_o__get_errno
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__invalid_parameter_noinfo_noreturn
_o__exit
_o__errno
_o__invalid_parameter_noinfo
_o____lc_codepage_func
__std_terminate
_o__initialize_onexit_table
_o_abort
__CxxFrameHandler3
wcschr
wcsstr
strchr
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__configthreadlocale
memcmp
memcpy
GetModuleHandleExW
LockResource
FindResourceExW
LoadResource
FindStringOrdinal
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
LoadStringW
SizeofResource
GetModuleHandleExA
InitializeSRWLock
OpenEventW
ReleaseSemaphore
ReleaseMutex
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
TryAcquireSRWLockExclusive
CreateMutexW
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapAlloc
HeapDestroy
HeapReAlloc
HeapSetInformation
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException
GetCurrentThread
OpenProcessToken
TerminateProcess
CreateThread
GetCurrentProcessId
OpenThreadToken
TlsAlloc
GetCurrentThreadId
TlsFree
SetPriorityClass
GetStartupInfoW
GetCurrentProcess
GetSystemPreferredUILanguages
FormatMessageA
GetSystemDefaultLCID
LocaleNameToLCID
FormatMessageW
GetNLSVersionEx
LCMapStringW
GetLocaleInfoEx
ResolveLocaleName
GetLocaleInfoW
DebugBreak
OutputDebugStringW
IsDebuggerPresent
CloseHandle
DuplicateHandle
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocString
SafeArrayDestroy
SetErrorInfo
GetErrorInfo
VarUI4FromStr
VarBstrCat
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
VariantInit
RegGetValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegGetKeySecurity
RegCloseKey
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteKeyExW
RegCreateKeyExW
PathIsRootW
PathIsUNCServerShareW
PathCanonicalizeW
PathAddBackslashW
PathIsUNCServerW
PathStripToRootW
PathIsUNCW
PathFileExistsW
PathSkipRootW
PathAppendW
PathRemoveBackslashW
PathFindNextComponentW
CoInitializeEx
CoImpersonateClient
CoRevertToSelf
CoReleaseServerProcess
CLSIDFromString
CoMarshalInterface
CoAddRefServerProcess
PropVariantClear
CoRegisterClassObject
CoInitializeSecurity
StringFromGUID2
CoResumeClassObjects
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoCreateInstance
IIDFromString
CoGetMalloc
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
SHTaskPoolQueueTask
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CreateThreadpoolTimer
VerSetConditionMask
VerifyVersionInfoW
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceInitialize
RtlNtStatusToDosError
RtlIsStateSeparationEnabled
NtQueryWnfStateData
NtSetInformationFile
NtOpenFile
RtlInitUnicodeString
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageClaims
RtlGetPersistedStateLocation
RtlGetDeviceFamilyInfoEnum
SetFileAttributesW
GetFileAttributesW
FindClose
GetFileAttributesExW
DeleteFileW
FindNextFileW
FindFirstFileExW
SetFileTime
CreateDirectoryW
GetVolumeInformationW
FindFirstVolumeW
FindFirstFileW
GetFileTime
FindVolumeClose
FindNextVolumeW
CreateFileW
CompareFileTime
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
lstrcmpiW
lstrcmpW
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventEnabled
EventActivityIdControl
GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount64
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
CompareStringW
SHDeleteKeyW
SHGetValueW
SHSetValueW
SHCopyKeyW
ord290
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SearchPathW
LoadLibraryW
CharNextW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
OpenProcess
IsProcessorFeaturePresent
SetProcessMitigationPolicy
ChangeServiceConfig2W
RoOriginateError
RoOriginateErrorW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
LocalFree
GetFileInformationByHandleEx
CopyFileW
QueryPerformanceCounter
InitializeSListHead
ApiSetQueryApiSetPresence
SHStrDupW
ord1
ord184
?GetFilterHostProcessPoolManager@CSearchServiceObj@@SGJPAPAUIFilterHostProcessPoolManager@@@Z
??1CSearchServiceObj@@QAE@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
StrStrIW
StrCmpNICW
PathCchSkipRoot
MoveFileW
GetSystemPowerStatus
RegisterWaitForSingleObject
ControlService
QueryServiceStatus
EnumDependentServicesW
SetThreadDescription
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
RegSetKeyValueW
RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
DecodePointer
EncodePointer
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus
UnregisterWaitEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LCIDToLocaleName
I_RpcBindingInqLocalClientPID
QueryFullProcessImageNameW
SHCreateMemStream
QueryUnbiasedInterruptTime
RoGetAgileReference
GetApplicationUserModelIdFromToken
ResolveDelayLoadedAPI
DelayLoadFailureHook
ord437
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ