CreateNBVSSInterface
DeleteNBVSSInterface
Static task
static1
Behavioral task
behavioral1
Sample
ff9d16d6cdfefaee104f319846d075b92b6340834371e93f1dda092dd7ce7bcc.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff9d16d6cdfefaee104f319846d075b92b6340834371e93f1dda092dd7ce7bcc.dll
Resource
win10v2004-20220812-en
Target
ff9d16d6cdfefaee104f319846d075b92b6340834371e93f1dda092dd7ce7bcc
Size
312KB
MD5
4fd2a0ec490474dfb06fdc62f954f7c0
SHA1
8a4075d9f03740788037ce259e2499b779c05f82
SHA256
ff9d16d6cdfefaee104f319846d075b92b6340834371e93f1dda092dd7ce7bcc
SHA512
0f679dd460580c5f18107fd1bd0809b301e70390249e3705b4315b463363a5c937579cb15783c16b090e158231dc94506c566fdb6ab34e870ac41194b6e42b37
SSDEEP
6144:rEOiiQY0lHbcyYGInbU4xEwcYZyDEULBFj0qi3z2ccRPGkk2ldKL:rEOiiQY0lHbrrZ4xEwcYZyDEUriD2zLE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PathIsDirectoryW
CreateSemaphoreW
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcess
SetLastError
CloseHandle
Sleep
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetFileTime
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
WriteFile
ReadFile
CreateFileW
GetVolumeInformationW
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetShortPathNameW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetVersionExW
LocalAlloc
FormatMessageW
LocalFree
CopyFileW
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
MoveFileW
GetFileAttributesW
GetDriveTypeW
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceW
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
IsBadStringPtrA
IsBadStringPtrW
IsBadReadPtr
IsBadWritePtr
SetFilePointer
BackupRead
BackupWrite
BackupSeek
CreateEventW
ResetEvent
SetEvent
FindNextFileW
FindClose
FindFirstFileW
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SystemTimeToFileTime
GetLogicalDriveStringsW
GetLocalTime
GetFileSize
FindWindowW
UnregisterClassW
UnregisterClassA
OpenServiceW
QueryServiceConfigW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
CloseServiceHandle
OpenSCManagerW
QueryServiceStatus
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateGuid
SysAllocString
SysFreeString
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?_Xran@_String_base@std@@QBEXXZ
?_Nomemory@std@@YAXXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?OnPreRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnVSSShutdown@CVssWriter@@UAG_NXZ
??0CVssWriter@@QAE@XZ
??1CVssWriter@@UAE@XZ
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?OnContinueIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnBackOffIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?Initialize@CVssWriter@@QAGJU_GUID@@PBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N@Z
?Unsubscribe@CVssWriter@@QAGJXZ
?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
?Subscribe@CVssWriter@@QAGJK@Z
realloc
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
memset
_callnewh
malloc
iswascii
?swprintf@@YAHPAGIPBGZZ
_mbsinc
_mbsupr
_wsplitpath
_wfullpath
wcsftime
mktime
swscanf
localtime
floor
isspace
strncpy
_wtoi
iswdigit
wcsncmp
vswprintf
wcspbrk
wcsstr
_wcsicmp
wcscmp
wcscpy
wcscat
wcsncpy
wcsrchr
memmove
wcschr
_wcsrev
_wcslwr
_wcsupr
??_V@YAXPAX@Z
wcslen
_wcsnicmp
clock
_purecall
??3@YAXPAX@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_CxxThrowException
__CxxFrameHandler
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
free
_except_handler3
_mbsrchr
iswspace
PlaySoundW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SHGetSpecialFolderLocation
ShellExecuteW
SHGetMalloc
SHGetDesktopFolder
SHGetFileInfoW
SHGetPathFromIDListW
CreateNBVSSInterface
DeleteNBVSSInterface
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE