DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
WMIPICMP.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
WMIPICMP.dll
Resource
win10v2004-20220812-en
Target
WMIPICMP.dll
Size
86KB
MD5
96f5664d91354834f444d33d9f6faa29
SHA1
5ab5e18d321504e792dcf5e91e8d77692e6293d7
SHA256
c5c1464fb80f2394b6652c22ec12d78f74bb851fd923055a15c432f8785871f2
SHA512
349dde4ec5dc6399e31f7211b9223f57d6460ff503f78eb56d922600d8c82262ca340efea8bb0a2f290da048e76de6134bd2e8f03ddad17fdae7caa911146017
SSDEEP
1536:LFd8wSkP4CQjU8MEGRa/FG8SJonFZpJFuCGcN816gX5XA:RdtP4CQ6NIgponXpJkON66gXxA
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
_lock
??1type_info@@UEAA@XZ
__C_specific_handler
_initterm
_amsg_exit
_XcptFilter
_CxxThrowException
_callnewh
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBDH@Z
memcpy
_unlock
wcschr
__dllonexit
iswspace
_vsnprintf
atol
sscanf_s
?terminate@@YAXXZ
malloc
free
swprintf_s
towupper
__RTtypeid
??8type_info@@QEBAHAEBV0@@Z
towlower
memmove
_onexit
_purecall
mbstowcs
_wcsicmp
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
__CxxFrameHandler3
memset
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
DeleteCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameW
LoadStringW
CoRevertToSelf
StringFromGUID2
CoGetCallContext
FreeAddrInfoW
WSAIoctl
closesocket
WSAStartup
WSACleanup
WSAGetLastError
socket
GetAddrInfoW
SysFreeString
VariantCopy
VariantChangeType
SafeArrayDestroy
VariantInit
SysAllocString
SafeArrayUnaccessData
SafeArrayCreate
SafeArrayAccessData
VariantClear
GetCurrentThread
GetCurrentProcess
TerminateProcess
OpenThreadToken
SetThreadToken
GetCurrentProcessId
GetCurrentThreadId
CloseHandle
Icmp6CreateFile
Icmp6ParseReplies
IcmpCloseHandle
IcmpCreateFile
Icmp6SendEcho2
IcmpParseReplies
IcmpSendEcho2
RegDeleteKeyExW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcessHeap
HeapCreate
LocalFree
QueryPerformanceCounter
GetTickCount
GetVersionExW
GetSystemTimeAsFileTime
MultiByteToWideChar
LCMapStringW
lstrlenA
lstrlenW
??0WmiUnsignedIntegerRangeNode@@QEAA@PEAGKHHHHKKPEAVWmiTreeNode@@1@Z
??1WmiUnsignedIntegerRangeNode@@UEAA@XZ
??0WmiSignedIntegerRangeNode@@QEAA@PEAGKHHHHJJPEAVWmiTreeNode@@1@Z
??1WmiSignedIntegerRangeNode@@UEAA@XZ
??0WmiStringRangeNode@@QEAA@PEAGKHHHH00PEAVWmiTreeNode@@1@Z
??1WmiStringRangeNode@@UEAA@XZ
?Print@WmiUnsignedIntegerRangeNode@@UEAAXXZ
?Copy@WmiUnsignedIntegerRangeNode@@UEAAPEAVWmiTreeNode@@XZ
?Print@WmiSignedIntegerNode@@UEAAXXZ
?Copy@WmiSignedIntegerNode@@UEAAPEAVWmiTreeNode@@XZ
??1WmiNullNode@@UEAA@XZ
??0WmiNullNode@@QEAA@PEAGKPEAVWmiTreeNode@@@Z
??1WmiUnsignedIntegerNode@@UEAA@XZ
?Copy@WmiUnsignedIntegerNode@@UEAAPEAVWmiTreeNode@@XZ
??0WmiUnsignedIntegerNode@@QEAA@PEAGKKPEAVWmiTreeNode@@@Z
??1WmiSignedIntegerNode@@UEAA@XZ
??0WmiSignedIntegerNode@@QEAA@PEAGJKPEAVWmiTreeNode@@@Z
?Print@WmiUnsignedIntegerNode@@UEAAXXZ
?Copy@WmiSignedIntegerRangeNode@@UEAAPEAVWmiTreeNode@@XZ
?Print@WmiSignedIntegerRangeNode@@UEAAXXZ
?Print@WmiStringRangeNode@@UEAAXXZ
?Copy@WmiStringRangeNode@@UEAAPEAVWmiTreeNode@@XZ
?Print@WmiStringNode@@UEAAXXZ
?Copy@WmiStringNode@@UEAAPEAVWmiTreeNode@@XZ
?CopyNode@WmiTreeNode@@UEAAPEAV1@XZ
??1WmiStringNode@@UEAA@XZ
??0WmiStringNode@@QEAA@PEAG0W4WmiValueFunction@WmiValueNode@@1KPEAVWmiTreeNode@@@Z
?Print@WmiNullNode@@UEAAXXZ
?Copy@WmiNullNode@@UEAAPEAVWmiTreeNode@@XZ
?Query@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAGAEAPEAUSQL_LEVEL_1_RPN_EXPRESSION@@@Z
??0QueryPreprocessor@@QEAA@XZ
??1QueryPreprocessor@@UEAA@XZ
?PreProcess@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAXPEAUSQL_LEVEL_1_RPN_EXPRESSION@@AEAPEAVWmiTreeNode@@@Z
?PreProcess@QueryPreprocessor@@QEAA?AW4QuadState@1@PEAXPEAUSQL_LEVEL_1_RPN_EXPRESSION@@PEAVWmiTreeNode@@KPEAPEAGAEAPEAVPartitionSet@@@Z
GetQFDN_Ipv6
GetFQDN_Ipv4
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ