Extended Key Usages
ExtKeyUsageTimeStamping
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.868a9f39e14d2dd05e6ce33239fc1440.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.868a9f39e14d2dd05e6ce33239fc1440.exe
Resource
win10v2004-20231023-en
Target
NEAS.868a9f39e14d2dd05e6ce33239fc1440.exe
Size
1.1MB
MD5
868a9f39e14d2dd05e6ce33239fc1440
SHA1
99afb45330a7d48281a0eddf6e30933fb11775ea
SHA256
ef42023eee6a326542f38dd49bc0c0d14b5ff39a6f0d67595c4dac34a54847b3
SHA512
e2dc1d73992e1a0d6da9d46d8b2b4807d8b07d45e3d09e826b055c4847045c59bae38092dfa6177ec66b0c04ef1d3bf75bbd6236824000f7bac7ec0bb1a597a9
SSDEEP
12288:NJgjBjgwsxFa9hxDpM3K6mBA2fCAp5FSI0RuQg8Y01cWiyYJFej/A/XNBNjsg9QF:pejnafPuQg8Y01cWi9JFt/rGgaGBVBP
ExtKeyUsageTimeStamping
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
StartServiceCtrlDispatcherW
RegisterTraceGuidsW
EnableTrace
ControlTraceW
UnregisterTraceGuids
GetTraceLoggerHandle
GetTraceEnableFlags
GetTraceEnableLevel
TraceEvent
GetSecurityInfo
EqualSid
RegConnectRegistryW
InitializeSecurityDescriptor
AllocateAndInitializeSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupAccountSidW
LogonUserW
CheckTokenMembership
CreateWellKnownSid
ImpersonateSelf
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
GetLengthSid
OpenThreadToken
RevertToSelf
SetThreadToken
StartTraceW
ReleaseMutex
OpenMutexW
LocalFree
GetComputerNameW
GetTimeZoneInformation
GetSystemDefaultUILanguage
GetNativeSystemInfo
FindClose
FindNextFileW
FindFirstFileW
GetTempPathW
LocalAlloc
GetLocaleInfoW
CompareStringW
SetEndOfFile
SetFilePointerEx
GetDiskFreeSpaceW
GetVolumePathNameW
SystemTimeToFileTime
HeapCreate
ReadProcessMemory
SetHandleInformation
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
InterlockedIncrement
InterlockedDecrement
TlsAlloc
TlsGetValue
TlsSetValue
CreateSemaphoreW
ReleaseSemaphore
SetConsoleCtrlHandler
GetCommandLineW
QueryPerformanceCounter
LoadLibraryW
GetLastError
GetProcAddress
FreeLibrary
Sleep
MapViewOfFile
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetProcessHeap
GetModuleHandleW
GetModuleFileNameW
TlsFree
SetEvent
CreateEventW
CloseHandle
DuplicateHandle
OpenThread
GetThreadTimes
WaitForSingleObjectEx
GetThreadLocale
ResetEvent
HeapAlloc
DeleteFiber
RaiseException
VirtualQueryEx
GetVersionExW
VirtualQuery
GetCurrentThread
GetProcessTimes
SetThreadAffinityMask
GetSystemInfo
VirtualFree
DebugBreak
VirtualAlloc
GlobalMemoryStatusEx
CreateMutexW
SuspendThread
SetThreadPriority
GetThreadPriority
ExitProcess
WaitForSingleObject
SwitchToThread
VirtualProtect
MapViewOfFileEx
UnmapViewOfFile
PostQueuedCompletionStatus
CreateIoCompletionPort
SetThreadLocale
CreateFileMappingW
OpenFileMappingW
GetOverlappedResult
WaitForMultipleObjects
SetProcessWorkingSetSize
GetModuleHandleA
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
SwitchToFiber
SignalObjectAndWait
InterlockedFlushSList
QueryDepthSList
CreateFiber
ConvertThreadToFiber
GetQueuedCompletionStatus
ResumeThread
SetThreadIdealProcessor
GetProcessAffinityMask
OutputDebugStringA
GetLocalTime
QueryPerformanceFrequency
SetLastError
OutputDebugStringW
LoadLibraryA
GetSystemDirectoryA
MultiByteToWideChar
FileTimeToSystemTime
GetComputerNameA
GetComputerNameExW
WriteFile
GetSystemTime
DeleteFileW
GetEnvironmentVariableW
CreateFileW
IsWow64Process
_snwprintf_s_l
wcsrchr
_invalid_parameter_noinfo
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
_vsnwprintf
wcsncmp
_vsnwprintf_s
??0exception@std@@QAE@ABV01@@Z
wcspbrk
_findclose
_wfindnext64i32
_wfindfirst64i32
_localtime64_s
wcsstr
_itow
_wcsupr_l
strncmp
wcschr
strcat_s
_sprintf_s_l
_strtoul_l
free
calloc
strcpy_s
_strnicmp_l
_stricmp_l
strchr
wcsncpy_s
_wcsicmp
_wcsnicmp_l
memcpy_s
_isctype_l
__pctype_func
srand
_time64
strncpy_s
_wmakepath_s
_beginthreadex
rand
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
_CIsqrt
_vsnprintf_l
malloc
_resetstkoflw
_set_invalid_parameter_handler
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
_wcsicmp_l
_printf_l
_vsnwprintf_l
_clearfp
_fpreset
_controlfp
wcscpy_s
_wsplitpath_s
_CxxThrowException
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_purecall
__CxxFrameHandler3
_wcslwr
wprintf
_endthread
_wtoi
_wcsnicmp
memcpy
memset
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
_wfullpath
_wtoi64_l
_iswprint_l
swprintf_s
wcslen
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
ntohs
WSAGetLastError
WSAStringToAddressW
inet_addr
gethostbyname
inet_ntoa
htonl
getservbyname
htons
gethostbyaddr
getservbyport
WSASetLastError
getnameinfo
WSACleanup
WSAStartup
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PADH@Z
?seekpos@strstreambuf@std@@MAE?AV?$fpos@H@2@V32@H@Z
?seekoff@strstreambuf@std@@MAE?AV?$fpos@H@2@JHH@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPBDH@Z
?_Xsgetn_s@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADIH@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHPADH@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?pbackfail@strstreambuf@std@@MAEHH@Z
??0strstreambuf@std@@QAE@PADH0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD0@Z
??1strstreambuf@std@@UAE@XZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?exceptions@ios_base@std@@QAEXH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?length@?$char_traits@D@std@@SAIPBD@Z
?width@ios_base@std@@QBEHXZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?width@ios_base@std@@QAEHH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?uncaught_exception@std@@YA_NXZ
GetTlsSlotInfo
PathFindExtensionW
PathRemoveExtensionW
PathAddExtensionW
PathFindFileNameW
PathRenameExtensionW
PathCanonicalizeW
PathAppendW
PathRemoveFileSpecW
PathFileExistsW
PathCombineW
PathRemoveBackslashW
CharLowerBuffW
timeGetDevCaps
timeBeginPeriod
timeEndPeriod
UuidCreate
GetAdaptersAddresses
AlterXESessions
DmpGetClientExport
DmpRemoteDumpRequest
XEGetAPI
_CreateILockBytesOnSOSMemory@4
_CreateNativeLoggingObject@4
_GetDefaultTraceLevel@4
_GetNativeLoggingTraceDirectory@4
_GetNativeLoggingTracePath@4
_GetNativeTraceLevel@12
_IsGcInProgress@0
_IsManagedDebuggerAttached@0
_NativeLoggingTrace@28
_ReleaseNativeLoggingObject@4
_RsDump@4
_RsDumpAddMemory@8
_RsDumpDump@0
_RsDumpSetErrorAddress@4
_RsDumpSetErrorDetails@4
_RsDumpSetErrorSignature@4
_RsDumpSetErrorText@4
_RsDumpSetLogFile@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ