Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
ff79f4fc8e78ba7d9bd21a1c064cc1cc83640c09479d46eacbe87819a00d7ae4.exe
Resource
win10v2004-20240802-en
Target
ff79f4fc8e78ba7d9bd21a1c064cc1cc83640c09479d46eacbe87819a00d7ae4.exe
Size
2.8MB
MD5
f7f03695c287510fc0183b2dea451b05
SHA1
4749592908503e1d2a722afb05748c8fbe35aa04
SHA256
ff79f4fc8e78ba7d9bd21a1c064cc1cc83640c09479d46eacbe87819a00d7ae4
SHA512
e806b2aab776dd638c203db421660cb31967d7de259a12363a8b627c46254d736dd51642fabb080c6413ee3ae27d1a19fb568708188916577cc81e2e2d6778be
SSDEEP
49152:HzEA0NLdb+c1RzEA0NLdb+c1JzEA0NLdb+c1GzEA0NLdb+c1U:TEA0N51EA0N5dEA0N5MEA0N5U
ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
SearchIndexer.pdb
?_Winerror_map@std@@YAHH@Z
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_iostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@@Z
?tolower@?$ctype@_W@std@@QBEPB_WPA_WPB_W@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?epptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?tolower@?$ctype@_W@std@@QBE_W_W@Z
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?egptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?eback@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
_Wcsxfrm
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Xbad_alloc@std@@YAXXZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?_Syserror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?setp@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W0@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Xbad_function_call@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
??1?$basic_iostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
??1facet@locale@std@@MAE@XZ
??0facet@locale@std@@IAE@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
??Bid@locale@std@@QAEIXZ
??Bios_base@std@@QBE_NXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ
??0_Lockit@std@@QAE@H@Z
?id@?$collate@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
_Wcscoll
?c_str@?$_Yarn@D@std@@QBEPBDXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
?setg@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXPA_W00@Z
?_Xlength_error@std@@YAXPBD@Z
memset
wcsncmp
wcspbrk
memmove_s
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
_initterm
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
memmove
_o__wtol
_o__initialize_narrow_environment
_o_calloc
_o_ceil
_o_exit
_o_free
_o_iswspace
_o_iswxdigit
_o_malloc
_o_qsort
_o_realloc
_o_terminate
_o_towupper
_o_wcsncpy_s
_o_wcstok
_o_wcstol
_o_wmemcpy_s
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
_o__get_narrow_winmain_command_line
_o__get_errno
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsnwprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o__invalid_parameter_noinfo_noreturn
_o__exit
_o__errno
_o__invalid_parameter_noinfo
_o____lc_codepage_func
__std_terminate
_o__initialize_onexit_table
_o_abort
__CxxFrameHandler3
wcschr
wcsstr
strchr
_o__crt_atexit
_o__controlfp_s
_o__configure_narrow_argv
_o__configthreadlocale
memcmp
memcpy
GetModuleHandleExW
LockResource
FindResourceExW
LoadResource
FindStringOrdinal
GetModuleHandleW
GetModuleFileNameA
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
GetProcAddress
LoadStringW
SizeofResource
GetModuleHandleExA
InitializeSRWLock
OpenEventW
ReleaseSemaphore
ReleaseMutex
CreateEventW
ResetEvent
InitializeCriticalSectionAndSpinCount
WaitForSingleObject
TryAcquireSRWLockExclusive
CreateMutexW
SetEvent
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
AcquireSRWLockExclusive
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReleaseSRWLockShared
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetProcessHeap
HeapSize
HeapAlloc
HeapDestroy
HeapReAlloc
HeapSetInformation
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetErrorMode
SetLastError
GetLastError
RaiseException
GetCurrentThread
OpenProcessToken
TerminateProcess
CreateThread
GetCurrentProcessId
OpenThreadToken
TlsAlloc
GetCurrentThreadId
TlsFree
SetPriorityClass
GetStartupInfoW
GetCurrentProcess
GetSystemPreferredUILanguages
FormatMessageA
GetSystemDefaultLCID
LocaleNameToLCID
FormatMessageW
GetNLSVersionEx
LCMapStringW
GetLocaleInfoEx
ResolveLocaleName
GetLocaleInfoW
DebugBreak
OutputDebugStringW
IsDebuggerPresent
CloseHandle
DuplicateHandle
SysStringByteLen
LoadRegTypeLi
LoadTypeLi
SysAllocStringLen
VariantClear
SysAllocStringByteLen
SysStringLen
SysAllocString
SafeArrayDestroy
SetErrorInfo
GetErrorInfo
VarUI4FromStr
VarBstrCat
SafeArrayGetElement
SafeArrayGetUBound
SysFreeString
VariantInit
RegGetValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
RegGetKeySecurity
RegCloseKey
RegEnumValueW
RegDeleteTreeW
RegEnumKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegDeleteKeyExW
RegCreateKeyExW
PathIsRootW
PathIsUNCServerShareW
PathCanonicalizeW
PathAddBackslashW
PathIsUNCServerW
PathStripToRootW
PathIsUNCW
PathFileExistsW
PathSkipRootW
PathAppendW
PathRemoveBackslashW
PathFindNextComponentW
CoInitializeEx
CoImpersonateClient
CoRevertToSelf
CoReleaseServerProcess
CLSIDFromString
CoMarshalInterface
CoAddRefServerProcess
PropVariantClear
CoRegisterClassObject
CoInitializeSecurity
StringFromGUID2
CoResumeClassObjects
CoUninitialize
CoCreateFreeThreadedMarshaler
CoTaskMemRealloc
CoCreateInstance
IIDFromString
CoGetMalloc
CoRevokeClassObject
CoTaskMemAlloc
CoTaskMemFree
SHTaskPoolQueueTask
CloseThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
IsThreadpoolTimerSet
CreateThreadpoolTimer
VerSetConditionMask
VerifyVersionInfoW
InitOnceExecuteOnce
Sleep
InitOnceBeginInitialize
InitOnceComplete
InitOnceInitialize
RtlNtStatusToDosError
RtlIsStateSeparationEnabled
NtQueryWnfStateData
NtSetInformationFile
NtOpenFile
RtlInitUnicodeString
RtlQueryWnfStateData
RtlSubscribeWnfStateChangeNotification
RtlUnsubscribeWnfStateChangeNotification
RtlPublishWnfStateData
RtlUnsubscribeWnfNotificationWaitForCompletion
RtlQueryPackageClaims
RtlGetPersistedStateLocation
RtlGetDeviceFamilyInfoEnum
SetFileAttributesW
GetFileAttributesW
FindClose
GetFileAttributesExW
DeleteFileW
FindNextFileW
FindFirstFileExW
SetFileTime
CreateDirectoryW
GetVolumeInformationW
FindFirstVolumeW
FindFirstFileW
GetFileTime
FindVolumeClose
FindNextVolumeW
CreateFileW
CompareFileTime
RemoveDirectoryW
GetLogicalDrives
GetDriveTypeW
DeviceIoControl
GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW
lstrcmpiW
lstrcmpW
EventSetInformation
EventRegister
EventWriteTransfer
EventUnregister
EventEnabled
EventActivityIdControl
GetTickCount
GetVersionExW
GetSystemDirectoryW
GetSystemTimeAsFileTime
GetTickCount64
MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte
CompareStringW
SHDeleteKeyW
SHGetValueW
SHSetValueW
SHCopyKeyW
ord290
GetCommandLineW
SetEnvironmentVariableW
ExpandEnvironmentStringsW
GetEnvironmentVariableW
SearchPathW
LoadLibraryW
CharNextW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
OpenProcess
IsProcessorFeaturePresent
SetProcessMitigationPolicy
ChangeServiceConfig2W
RoOriginateError
RoOriginateErrorW
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
LocalFree
GetFileInformationByHandleEx
CopyFileW
QueryPerformanceCounter
InitializeSListHead
ApiSetQueryApiSetPresence
SHStrDupW
ord1
ord184
?GetFilterHostProcessPoolManager@CSearchServiceObj@@SGJPAPAUIFilterHostProcessPoolManager@@@Z
??1CSearchServiceObj@@QAE@XZ
??0CSearchServiceObj@@QAE@XZ
?Cleanup@CSearchServiceObj@@SGXXZ
?GetFileChangeClientManagerInstance@@YA?AV?$shared_ptr@UIFileChangeClientManager@ChangeTracking@Windows@@@std@@XZ
StrStrIW
StrCmpNICW
PathCchSkipRoot
MoveFileW
GetSystemPowerStatus
RegisterWaitForSingleObject
ControlService
QueryServiceStatus
EnumDependentServicesW
SetThreadDescription
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetTimeFormatW
RegSetKeyValueW
RoRegisterActivationFactories
RoGetActivationFactory
RoRevokeActivationFactories
WindowsIsStringEmpty
WindowsStringHasEmbeddedNull
WindowsCreateStringReference
WindowsGetStringRawBuffer
WindowsCreateString
WindowsDeleteString
DecodePointer
EncodePointer
RegisterServiceCtrlHandlerExW
StartServiceCtrlDispatcherW
SetServiceStatus
UnregisterWaitEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
LCIDToLocaleName
I_RpcBindingInqLocalClientPID
QueryFullProcessImageNameW
SHCreateMemStream
QueryUnbiasedInterruptTime
RoGetAgileReference
GetApplicationUserModelIdFromToken
ResolveDelayLoadedAPI
DelayLoadFailureHook
ord437
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ