Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
135e476aaab42c8bccc54b7b12ed9b50_NEIKI.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
135e476aaab42c8bccc54b7b12ed9b50_NEIKI.exe
Resource
win10v2004-20240426-en
Target
135e476aaab42c8bccc54b7b12ed9b50_NEIKI
Size
6.0MB
MD5
135e476aaab42c8bccc54b7b12ed9b50
SHA1
4a82a3450136e7868c273182d34b156b4c2950d5
SHA256
1eac8ea0ab295f2e3b1cd734ed0e7253dae2f1df5755a19b14c73b2d8f14b8d5
SHA512
3d7cd202ea58242397ecbf9276207852dc97777a7190d04457d3197ec43af9fea2190656c0e4a21caf9e99cd4b4b84f932ce9ad78320bbe314977d37928a899b
SSDEEP
98304:cLLbzI7o/Es8OOj4GJ1/4wpp+7NrMstXr+yx2+k/jM3aU0NgfZyXurNgaEw2ry:SI7qvOj3VkXTx2+kr/U1fI+ZEPry
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
E:\GG\HaoYou\Output\HYSW\steamok.pdb
VirtualQueryEx
CreateFileMappingA
CreateDirectoryA
GetFileSize
Wow64EnableWow64FsRedirection
CreateEventW
SetEvent
ResetEvent
GetEnvironmentVariableA
GlobalAddAtomW
GetSystemDirectoryA
GetDiskFreeSpaceExA
WriteFile
SetFileTime
SetFilePointer
DuplicateHandle
GetFileType
DosDateTimeToFileTime
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
SetLastError
SetUnhandledExceptionFilter
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualFree
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
CreateTimerQueue
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
ReadConsoleInputW
SetConsoleMode
SetStdHandle
GetTimeZoneInformation
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetCurrentProcessId
GetDateFormatW
MoveFileExW
SetEnvironmentVariableW
GetFullPathNameW
ReadConsoleW
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
VirtualAlloc
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
MulDiv
GetLocaleInfoW
LCMapStringW
CompareStringW
TlsFree
TlsSetValue
TlsGetValue
GetCurrentThread
GetCurrentThreadId
SetDllDirectoryW
SetCurrentDirectoryW
GlobalMemoryStatusEx
GetSystemPowerStatus
CreateDirectoryW
GetDriveTypeW
ReadProcessMemory
GetExitCodeProcess
OpenFileMappingA
LocalFree
LocalAlloc
GetCommandLineW
OpenMutexW
OpenFileMappingW
ReleaseMutex
CreateMutexW
FormatMessageA
GetACP
GlobalUnlock
GlobalLock
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
OutputDebugStringA
ExitProcess
FreeResource
WritePrivateProfileSectionW
FindResourceW
LoadResource
FindResourceExW
DeleteFileW
LockResource
CopyFileA
GetPrivateProfileSectionNamesW
LeaveCriticalSection
EnterCriticalSection
SizeofResource
CreateThread
DeviceIoControl
GetTickCount
GetPrivateProfileStringA
WinExec
GetSystemTime
CreateProcessA
Module32NextW
WideCharToMultiByte
GetModuleHandleW
VirtualProtect
VirtualQuery
TlsAlloc
LoadLibraryExA
SleepEx
QueryPerformanceFrequency
VerifyVersionInfoA
CreateProcessW
SystemTimeToFileTime
GetCPInfo
GetStringTypeW
AreFileApisANSI
SetFilePointerEx
SetEndOfFile
GetFileInformationByHandle
GetFileAttributesExW
FindFirstFileExW
EncodePointer
SwitchToThread
FormatMessageW
RemoveDirectoryA
GetStartupInfoA
GetLogicalDriveStringsA
GetCurrentDirectoryW
GetLocalTime
Module32FirstW
SetFileAttributesA
WritePrivateProfileStringA
GetSystemInfo
CloseHandle
Process32FirstW
GlobalAlloc
DeleteFileA
InitializeSListHead
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
UnhandledExceptionFilter
GlobalMemoryStatus
FindNextFileW
CopyFileW
FlushConsoleInputBuffer
GetStdHandle
GetFileSizeEx
ExpandEnvironmentStringsA
WaitForSingleObjectEx
QueryPerformanceCounter
LoadLibraryA
FileTimeToSystemTime
CreateFileA
Process32NextW
Wow64RevertWow64FsRedirection
Sleep
GetPrivateProfileStringW
MultiByteToWideChar
CreateToolhelp32Snapshot
GetLogicalDriveStringsW
OpenProcess
GetModuleHandleA
GetVersionExW
CreateFileW
WaitForSingleObject
FindClose
CreatePipe
FindNextFileA
GetModuleFileNameW
TerminateProcess
GetPrivateProfileIntW
Wow64DisableWow64FsRedirection
GetCurrentProcess
WritePrivateProfileStringW
FindFirstFileA
GetModuleFileNameA
ReadFile
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
InitializeCriticalSection
HeapFree
LoadLibraryExW
FreeLibrary
GetProcAddress
LoadLibraryW
GetTimeFormatW
OutputDebugStringW
GetPropW
SetPropW
LoadImageW
GetClassInfoExW
RegisterClassW
CallWindowProcW
PostQuitMessage
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
SetRect
FillRect
CharPrevW
GetSysColor
SetCaretPos
ShowCaret
HideCaret
CreateCaret
EnableWindow
GetCaretPos
SetWindowRgn
UnregisterHotKey
CreatePopupMenu
TrackPopupMenu
OffsetRect
ClientToScreen
AttachThreadInput
RegisterHotKey
GetForegroundWindow
LoadIconW
SetCapture
AppendMenuW
SystemParametersInfoW
ReleaseCapture
IsIconic
GetCursorPos
GetWindowRgn
FindWindowA
ShowWindowAsync
MapVirtualKeyW
keybd_event
GetSystemMetrics
BlockInput
ClipCursor
SendMessageA
mouse_event
SetCursorPos
IsWindowVisible
GetParent
MonitorFromWindow
GetMonitorInfoW
GetDesktopWindow
MessageBoxA
FlashWindow
BringWindowToTop
wsprintfW
SetForegroundWindow
PostMessageW
FindWindowW
SetTimer
ShowWindow
IsWindow
MoveWindow
SendMessageW
OpenClipboard
CloseClipboard
EmptyClipboard
SetClipboardData
GetWindowLongW
SetWindowPos
SetWindowLongW
GetClientRect
GetDC
DrawTextW
ReleaseDC
MessageBoxW
GetWindowThreadProcessId
GetWindowRect
GetClassNameA
GetWindowTextA
EnumWindows
GetProcessWindowStation
GetUserObjectInformationW
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
KillTimer
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
PtInRect
GetWindow
wvsprintfW
SetCursor
IsZoomed
GetCaretBlinkTime
GetObjectW
SetBkMode
CreateCompatibleBitmap
ExtTextOutW
TextOutW
MoveToEx
SetStretchBltMode
StretchBlt
SetBkColor
ExtSelectClipRgn
SelectClipRgn
RoundRect
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateSolidBrush
CreatePatternBrush
CreateRoundRectRgn
SetWindowOrgEx
GetTextMetricsW
SaveDC
RestoreDC
Rectangle
GetStockObject
CreatePen
CreateFontIndirectW
GetObjectA
GdiFlush
SetTextColor
CreateRectRgn
PtInRegion
GetPixel
BitBlt
SelectObject
CreateDIBSection
CreateCompatibleDC
CreateFontW
GetDeviceCaps
DeleteDC
DeleteObject
CryptGetUserKey
RegEnumKeyExA
RegQueryValueExW
RegEnumValueA
RegOpenKeyExW
RegOpenKeyExA
OpenProcessToken
RegSetValueExA
RegSetValueExW
RegCreateKeyExW
RegCreateKeyExA
RegQueryValueExA
RegQueryInfoKeyW
RegCloseKey
RegEnableReflectionKey
AdjustTokenPrivileges
RegDisableReflectionKey
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
RegEnumKeyA
OpenThreadToken
CryptEnumProvidersA
CryptSignHashA
CryptDecrypt
CryptExportKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
ReportEventA
RegisterEventSourceA
DeregisterEventSource
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
CommandLineToArgvW
ShellExecuteExW
SHFileOperationW
ShellExecuteA
SHGetSpecialFolderPathA
ShellExecuteW
Shell_NotifyIconW
SHGetSpecialFolderPathW
CoUninitialize
CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
MakeSureDirectoryPathExists
PathFileExistsW
PathFileExistsA
StrStrIA
PathFindExtensionW
PathRemoveFileSpecW
PathFindFileNameW
StrCpyW
PathIsDirectoryW
StrStrA
SHDeleteKeyW
PathIsDirectoryA
PathRemoveFileSpecA
PathFindFileNameA
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipDeleteFont
GdipGetFamily
GdipCreateFontFromLogfontA
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipGetImageEncodersSize
GdipCreateBitmapFromScan0
GdipImageGetFrameCount
GdiplusStartup
GdiplusShutdown
GdipGetImageHeight
GdipCloneImage
GdipAlloc
GdipCreateFontFromDC
GdipFree
GdipGetImageWidth
GdipSaveImageToFile
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDisposeImage
GdipSetStringFormatLineAlign
GdipSetStringFormatAlign
GdipDeleteStringFormat
GdipCreateStringFormat
GdipCloneBrush
GdipDeleteBrush
GdipCreateLineBrushI
GdipGetImageGraphicsContext
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetCompositingQuality
GdipSetSmoothingMode
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDrawImageRectI
GdipDeleteFontFamily
GdipDrawString
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoW
GetFileVersionInfoA
GetFileVersionInfoSizeW
VerQueryValueW
GetAdaptersInfo
InternetOpenW
InternetCloseHandle
InternetReadFile
DeleteUrlCacheEntryA
DeleteUrlCacheEntryW
InternetOpenUrlW
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CertEnumCertificatesInStore
CryptStringToBinaryA
CryptQueryObject
CryptMsgClose
CertGetNameStringA
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertGetCertificateContextProperty
CertCloseStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFreeCertificateChain
gethostbyname
getservbyname
socket
WSAGetLastError
htonl
shutdown
setsockopt
ioctlsocket
htons
recv
send
freeaddrinfo
getaddrinfo
WSAIoctl
ntohs
getsockopt
getsockname
getpeername
bind
WSASetLastError
WSACleanup
__WSAFDIsSet
closesocket
select
WSAStartup
connect
CreateDXGIFactory
PdhSetCounterScaleFactor
PdhGetFormattedCounterValue
PdhAddCounterW
PdhCloseQuery
PdhOpenQueryW
PdhCollectQueryData
PdhRemoveCounter
VerSetConditionMask
URLDownloadToFileA
URLDownloadToFileW
ImmSetCompositionWindow
ImmSetCompositionFontW
ImmReleaseContext
ImmGetContext
ord17
_TrackMouseEvent
VariantClear
VariantInit
SysFreeString
SysAllocString
?BindingNetbar@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UBindingNetbarDto@@@Z
?CreateStringByParam@BLC_Net@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@00PAVHttpParamsI@1@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@@Z
?CurlGetData@BLC_Net@@YA?AW4HTTPRETDATAENUM@1@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@1H0@Z
?CurlGetDataWithSign@BLC_Net@@YA?AW4HTTPRETDATAENUM@1@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@1H0@Z
?CurlPostData@BLC_Net@@YA?AW4HTTPRETDATAENUM@1@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@1H0@Z
?CurlPostDataWithSign@BLC_Net@@YA?AW4HTTPRETDATAENUM@1@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0AAV34@V?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@4@1H0@Z
?Curl_DownloadFile@BLC_Net@@YA?AW4DW_STATE@1@PBD0@Z
?FindSteamPathReportMessage@@YA_NUMSGObject@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetKey@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetNetbarBusiness@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV12@AAH1@Z
?GetParaForGGJiaSu@@YA_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetParaForTQ@@YA_NAA_NAAH1@Z
?GetSteamAccePara@@YA_NAAV?$map@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@U?$less@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V12@@std@@@2@@std@@@Z
?IfNetbarReportMessage@@YA_NUMSGObject@@@Z
?NetbarSpecialSet@@YA_NV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ReportMessage@@YA_NUMSGObject@@@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ