Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
1e60df76bb39fdb3b9cf4f604244d8075d20c6db77bf4f7f23410c715778c89b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1e60df76bb39fdb3b9cf4f604244d8075d20c6db77bf4f7f23410c715778c89b.exe
Resource
win10v2004-20240221-en
Target
1e60df76bb39fdb3b9cf4f604244d8075d20c6db77bf4f7f23410c715778c89b
Size
380KB
MD5
7b656f3b4d4240a6b0aaac6f29282f6a
SHA1
59ed929b2981b0c34e76650fcf2b162223347b8a
SHA256
1e60df76bb39fdb3b9cf4f604244d8075d20c6db77bf4f7f23410c715778c89b
SHA512
1f0fb6c587388880f12327db29b1915cf780071756045195c0998b3faf0c01ae928f4a6cc53b146ad1da1e3be797b4434e8caeaf1567f3d4de99d16063983ce0
SSDEEP
6144:ApqawP6DG+K/1vkhNVkIpjFP2O1sMboV2HnLKm9YeTBR9Bq3OAJ3JRI/U+R:AjquGdENeCPvKm9YeTnC3oM+R
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
d:\winapps\5.0\dll\vc\Memfiles\sourcecode\Memfiles\x64\Release\MemfilesService.pdb
ord570
ord762
ord1103
ord5658
ord4103
ord1519
ord285
ord3008
ord4145
ord4121
ord6422
ord3901
ord6424
ord4438
ord2110
ord2065
ord5713
ord3906
ord1025
ord5230
ord6363
ord5511
ord3932
ord1966
ord3005
ord5356
ord5358
ord2303
ord4050
ord4687
ord5362
ord5345
ord1211
ord911
ord1041
ord440
ord680
ord6438
ord2981
ord2016
ord3261
ord2515
ord799
ord1149
ord5696
ord2602
ord2325
ord779
ord265
ord266
ord1233
ord640
ord386
ord2797
ord2904
ord4419
ord2780
ord2907
ord2605
ord2711
ord2598
ord3818
ord3819
ord3809
ord2709
ord4051
ord4596
ord4372
ord3424
ord1071
ord3930
ord688
ord450
ord772
ord577
ord3783
ord4658
ord286
ord2533
ord5533
ord316
ord589
ord6281
ord4187
ord280
ord2378
ord791
ord887
ord789
ord2531
ord296
ord588
ord5532
ord777
memcpy
__CxxFrameHandler3
memset
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crt_debugger_hook
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
fclose
ftell
fwrite
ferror
fprintf
fread
fopen
_errno
malloc
fputc
strrchr
rand
free
memcpy_s
wcscpy_s
printf
_strnicmp
wcsrchr
isalpha
_stricmp
wcsncpy_s
tolower
strstr
wcschr
_wcsicmp
?what@exception@std@@UEBAPEBDXZ
_purecall
swprintf_s
_invalid_parameter_noinfo
??0exception@std@@QEAA@AEBV01@@Z
??0exception@std@@QEAA@XZ
??1exception@std@@UEAA@XZ
??0exception@std@@QEAA@AEBQEBD@Z
memmove_s
_CxxThrowException
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
CreateThread
SetEvent
WaitForSingleObject
GetLastError
CreateFileW
FormatMessageW
LocalFree
DeviceIoControl
Sleep
CreateEventW
ReadDirectoryChangesW
GetOverlappedResult
QueryPerformanceCounter
GetVolumeInformationW
GetDiskFreeSpaceW
FindFirstFileW
FindClose
FindNextFileW
MultiByteToWideChar
WideCharToMultiByte
GetDriveTypeW
ExpandEnvironmentStringsA
EnterCriticalSection
GlobalLock
GlobalUnlock
GlobalFree
GetModuleFileNameW
GetPrivateProfileStringW
CreateMutexW
CreateWaitableTimerW
SetWaitableTimer
ResumeThread
MapViewOfFile
UnmapViewOfFile
OpenProcess
DuplicateHandle
GetCurrentProcess
CreateFileMappingW
GetSystemInfo
GetTickCount
GetLogicalDrives
ConnectNamedPipe
SetLastError
CreateNamedPipeW
SetNamedPipeHandleState
WaitNamedPipeW
DisconnectNamedPipe
GlobalAlloc
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
SetUnhandledExceptionFilter
GetStartupInfoW
CloseHandle
GetModuleHandleW
GetCurrentThreadId
ResetEvent
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
WriteFile
ReadFile
GetNamedPipeInfo
TranslateMessage
PeekMessageW
MsgWaitForMultipleObjects
PostMessageW
DispatchMessageW
SHCreateDirectoryExA
SHGetDesktopFolder
InitCommonControlsEx
PathFileExistsA
CoUninitialize
CoInitialize
CreateStreamOnHGlobal
VariantInit
VariantClear
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAXXZ
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV12@_KPEB_W0@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAPEBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@PEBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@AEBV10@PEB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@PEB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAA@PEB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2_KB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA?AV12@_K0@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KD_K@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_NXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@PEBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV01@AEBV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBA_KPEBD_K1@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEA_W_K@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QEAAAEAV01@_W@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAA?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
GetFileInfoByFileNumber
StopScanFile
ScanAll
DeleteItemTree
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ