Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
e4b75ab56504d706a5c48f267a835b98b760b80b1e4a797d100959ce48c60ebb.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e4b75ab56504d706a5c48f267a835b98b760b80b1e4a797d100959ce48c60ebb.exe
Resource
win10v2004-20220812-en
Target
e4b75ab56504d706a5c48f267a835b98b760b80b1e4a797d100959ce48c60ebb
Size
51KB
MD5
594423decec9d3c5fff628a5dc8fb340
SHA1
a7a960b8dcd7faa4aabf523b5ad9a7035a828ef6
SHA256
e4b75ab56504d706a5c48f267a835b98b760b80b1e4a797d100959ce48c60ebb
SHA512
51a006de8f43557f4fcc7f100ffb513dd70da21926fbda966706ed2f951c95c53f62f81dac50b4b6b9304d11954bfa608f46e1ff2b5cdd47eae0c3fe68a91642
SSDEEP
768:nL+D+ONaDS5MCioMpXbgngyB4fLoxIETB:iD+O7MPdbWAfGF
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
ZwQueryInformationFile
ZwCreateFile
RtlInitUnicodeString
wcslen
_wcslwr
wcscpy
DbgPrint
IofCompleteRequest
ObfDereferenceObject
_stricmp
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
IoDeleteDevice
IoDeleteSymbolicLink
ZwQueryValueKey
ZwOpenKey
IoCreateSymbolicLink
IoCreateDevice
wcscat
wcsrchr
KeInitializeSpinLock
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlCompareUnicodeString
ObQueryNameString
wcsncpy
MmIsAddressValid
ZwClose
wcsstr
IoGetBaseFileSystemDeviceObject
ObReferenceObjectByHandle
mbstowcs
strrchr
RtlAssert
_wcsnicmp
NtBuildNumber
MmGetSystemRoutineAddress
strncpy
ExInitializeNPagedLookasideList
_wcsicmp
ExInterlockedPopEntrySList
ExInterlockedPushEntrySList
ExDeleteNPagedLookasideList
KeServiceDescriptorTable
ExGetPreviousMode
wcsncat
_except_handler3
ZwCreateKey
ZwEnumerateValueKey
ZwEnumerateKey
ZwDeleteValueKey
ZwDeleteKey
ZwSetValueKey
ZwOpenProcess
ZwWriteFile
ExAllocatePoolWithTag
ZwReadFile
ExFreePool
IoGetCurrentProcess
swprintf
strncmp
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
KfAcquireSpinLock
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ