Extended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.0e4194933a16e2c58fd49350fbd82640.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.0e4194933a16e2c58fd49350fbd82640.dll
Resource
win10v2004-20231020-en
Target
NEAS.0e4194933a16e2c58fd49350fbd82640.exe
Size
991KB
MD5
0e4194933a16e2c58fd49350fbd82640
SHA1
b6df52768bd3070d60dcdf57f940ec2ad277c5c0
SHA256
04c5c01fb48000d639066aa81a93e006b7f4f3b49874d74f8271eeef1411e9c7
SHA512
a4629bd103b76e2600ed5e9e51ea533465f75d37352774d6bc8f832225cf0e9888bcebd23b91cef1cddb09d6f933168c04f459d6558f56fe21afb5b9769f772e
SSDEEP
24576:nl1BC445BKifgZzZqixwL7h3QuPQmbHMMjeD10:nl1BABKiA4NL7hAcDMMK10
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
GetProcAddress
FindClose
LocalAlloc
DeviceIoControl
FindNextFileW
LocalFree
ExpandEnvironmentStringsW
CreateJobObjectW
OpenProcess
IsProcessInJob
Sleep
GetModuleHandleW
GetExitCodeProcess
GetCurrentProcess
TerminateJobObject
ResumeThread
GetPrivateProfileStringW
WritePrivateProfileSectionW
WritePrivateProfileStringW
GetPrivateProfileIntW
FreeLibrary
LoadLibraryW
RemoveDirectoryW
AssignProcessToJobObject
WaitForSingleObject
SetCurrentDirectoryW
MoveFileW
GetCurrentDirectoryW
GetTempPathW
CreateProcessW
GetDriveTypeW
FindFirstFileW
GetWindowsDirectoryW
WaitForMultipleObjects
OpenThread
GetCurrentProcessId
GetCurrentThreadId
GetLocalTime
CreateFileW
GetModuleFileNameW
WriteFile
OutputDebugStringW
SetFilePointer
CloseHandle
CreateEventW
SetEvent
GetDiskFreeSpaceExW
InterlockedExchange
GetSystemDirectoryW
DeleteCriticalSection
DecodePointer
GetLastError
RaiseException
InitializeCriticalSectionAndSpinCount
DeleteFileW
SetFileAttributesW
FormatMessageW
QueryInformationJobObject
LoadLibraryExW
SizeofResource
EnumResourceNamesW
GetVersion
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
GetVolumeInformationW
GetDiskFreeSpaceW
GetLogicalDriveStringsW
GetFileSizeEx
lstrcpyW
lstrcatW
QueryDosDeviceW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
InitializeCriticalSection
SearchPathW
InterlockedExchangeAdd
WideCharToMultiByte
GetACP
MultiByteToWideChar
CreateMutexW
OpenMutexW
EncodePointer
ReleaseMutex
GetLongPathNameW
GetFileAttributesExW
GetShortPathNameW
ResetEvent
OpenEventW
GetEnvironmentVariableW
FindResourceW
LoadResource
GetVersionExW
LockResource
GetSystemInfo
lstrcmpiW
GetFileSize
SetEndOfFile
SetFileTime
ReadFile
GetFileTime
TerminateProcess
GetFileAttributesW
LoadLibraryA
HeapAlloc
HeapFree
GetProcessHeap
GlobalAlloc
GlobalFree
GetFullPathNameW
GetTempFileNameW
MoveFileExW
CreateDirectoryW
CopyFileW
lstrlenW
LoadImageW
PrivateExtractIconsW
DestroyIcon
GetActiveWindow
GetWindowTextLengthW
GetDC
CreateIconFromResourceEx
ReleaseDC
GetDesktopWindow
EnumChildWindows
IsWindowVisible
EnumDesktopWindows
CloseDesktop
GetWindowThreadProcessId
GetIconInfo
GetWindowTextW
DestroyWindow
IsWindow
SendMessageW
UnregisterClassW
LookupIconIdFromDirectoryEx
OpenDesktopW
GetTextExtentExPointW
GetObjectW
GetTextExtentPointW
SelectObject
CreateFontIndirectW
GetStockObject
DeleteObject
RegCloseKey
AdjustTokenPrivileges
RegOpenKeyExW
FreeSid
IsValidSid
RegEnumValueW
SetEntriesInAclW
AllocateAndInitializeSid
LookupPrivilegeValueW
SetNamedSecurityInfoW
GetTokenInformation
OpenProcessToken
GetLengthSid
ConvertSidToStringSidW
EqualSid
RegSetValueExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
RegCreateKeyExW
SHChangeNotify
ord727
ExtractIconExW
SHGetPathFromIDListW
SHGetMalloc
SHGetFileInfoW
SHGetSpecialFolderLocation
ShellExecuteExW
SHFileOperationW
ShellExecuteW
SHGetDesktopFolder
DuplicateIcon
CreateStreamOnHGlobal
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
SHDeleteKeyW
PathRemoveFileSpecW
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_C_str@?$_Yarn@D@std@@QBEPBDXZ
?width@ios_base@std@@QAE_J_J@Z
?width@ios_base@std@@QBE_JXZ
?flags@ios_base@std@@QBEHXZ
?fail@ios_base@std@@QBE_NXZ
?good@ios_base@std@@QBE_NXZ
?rdstate@ios_base@std@@QBEHXZ
??Bios_base@std@@QBE_NXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?_Getname@_Locinfo@std@@QBEPBDXZ
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@HPBD@Z
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?global@locale@std@@SA?AV12@ABV12@@Z
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@_N@Z
?_Makeloc@_Locimp@locale@std@@CAPAV123@ABV_Locinfo@3@HPAV123@PBV23@@Z
?uncaught_exception@std@@YA_NXZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xruntime_error@std@@YAXPBD@Z
?_BADOFF@std@@3_JB
??_7?$basic_ostream@DU?$char_traits@D@std@@@std@@6B@
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?_Swap_all@_Container_base0@std@@QAEXAAU12@@Z
?_Orphan_all@_Container_base0@std@@QAEXXZ
??0id@locale@std@@QAE@I@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
calloc
strchr
memchr
tolower
toupper
_stricmp
_splitpath_s
_wcsnicmp
wcsncpy
_wcsicmp
?terminate@@YAXXZ
_vswprintf_c_l
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
__CxxFrameHandler3
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
__clean_type_info_names_internal
_localtime64
_mktime64
_beginthreadex
fwrite
memcpy_s
_lock_file
setvbuf
fsetpos
fgetc
fflush
_fseeki64
fgetpos
strstr
ungetc
_unlock_file
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
fputc
_time64
srand
rand
_errno
towupper
wcsstr
towlower
wcschr
memmove_s
memset
_recalloc
_ui64tow_s
_wtoi64
fclose
fseek
iswxdigit
_vsnwprintf
fread
??_V@YAXPAX@Z
fopen
malloc
_except1
_wtoi
atoi
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??2@YAPAXI@Z
_hypot
_purecall
free
memmove
??3@YAXPAX@Z
memcpy
wcsrchr
wcstol
realloc
_CxxThrowException
__RTDynamicCast
_libm_sse2_pow_precise
_libm_sse2_sqrt_precise
_wtof
GdipDisposeImage
GdipAlloc
GdipCreateBitmapFromStream
GdipFree
GdipCreateHICONFromBitmap
GdipCloneImage
GdipCreateBitmapFromStreamICM
VariantClear
SysAllocString
InternetGetConnectedState
GetAdaptersInfo
CreateObject
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ