CreateNBVSSInterface
DeleteNBVSSInterface
Static task
static1
Behavioral task
behavioral1
Sample
e3c3c19b3adfffaa45d567cfc50dedf3083ea6ea046c9fd61599fde271dc33ea.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e3c3c19b3adfffaa45d567cfc50dedf3083ea6ea046c9fd61599fde271dc33ea.dll
Resource
win10v2004-20220812-en
Target
e3c3c19b3adfffaa45d567cfc50dedf3083ea6ea046c9fd61599fde271dc33ea
Size
264KB
MD5
61a29a3f79f657dd260dd6e81749e350
SHA1
92efb41e3e7c66efdb193c63a5f7b08db42d65eb
SHA256
e3c3c19b3adfffaa45d567cfc50dedf3083ea6ea046c9fd61599fde271dc33ea
SHA512
cd7b2d97e02fe7c59705320bd91c218efe0092c044c475e6f6fc551c68ab49780fa8bdf51ba417ba7f6d4b82a0b55d70962db3eb33cb78adb25412c3ebc90b7f
SSDEEP
6144:AoUj22J+0XUg+sZZQNPoBtpk1ZZ9pslGBFjBXKfTyFqNayyyyyyyyyyyyyyyyyyu:AoUj22J+0XUTwioBtpk1ZZ9ps0KfTyF0
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PathIsDirectoryW
CreateSemaphoreW
ReleaseSemaphore
WaitForSingleObject
GetCurrentProcess
SetLastError
CloseHandle
Sleep
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
FileTimeToSystemTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
SetFileTime
SetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
WriteFile
ReadFile
CreateFileW
GetVolumeInformationW
GetModuleFileNameW
GetWindowsDirectoryW
GetSystemDirectoryW
GetShortPathNameW
GetTempFileNameW
DeleteFileW
GetTempPathW
GetVersionExW
LocalAlloc
FormatMessageW
LocalFree
CopyFileW
LoadLibraryW
FreeLibrary
ExpandEnvironmentStringsW
MoveFileW
GetFileAttributesW
GetDriveTypeW
GetModuleHandleW
GetProcAddress
GetDiskFreeSpaceW
WideCharToMultiByte
CompareStringW
MultiByteToWideChar
IsBadStringPtrA
IsBadStringPtrW
IsBadReadPtr
IsBadWritePtr
SetFilePointer
BackupRead
BackupWrite
BackupSeek
CreateEventW
ResetEvent
SetEvent
FindNextFileW
FindClose
FindFirstFileW
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
WaitForMultipleObjects
ExitProcess
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SystemTimeToFileTime
GetLogicalDriveStringsW
GetLocalTime
GetFileSize
FindWindowW
UnregisterClassW
UnregisterClassA
OpenServiceW
QueryServiceConfigW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegDeleteKeyW
CloseServiceHandle
OpenSCManagerW
QueryServiceStatus
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegQueryValueExW
RegOpenKeyExW
CoInitialize
CoUninitialize
CoTaskMemFree
StringFromCLSID
CoCreateGuid
SysAllocString
SysFreeString
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?_Xran@_String_base@std@@QBEXXZ
?_Nomemory@std@@YAXXZ
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IPBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?_Register@facet@locale@std@@QAEXXZ
?_Incref@facet@locale@std@@QAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Id_cnt@id@locale@std@@0HA
??1_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@G@std@@2V0locale@2@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?clear@ios_base@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??1locale@std@@QAE@XZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?is@?$ctype@G@std@@QBE_NFG@Z
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?OnPreRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnPostRestore@CVssWriter@@UAG_NPAVIVssWriterComponents@@@Z
?OnVSSShutdown@CVssWriter@@UAG_NXZ
??0CVssWriter@@QAE@XZ
??1CVssWriter@@UAE@XZ
?OnVSSApplicationStartup@CVssWriter@@UAG_NXZ
?OnContinueIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?OnBackOffIOOnVolume@CVssWriter@@UAG_NPAGU_GUID@@1@Z
?Initialize@CVssWriter@@QAGJU_GUID@@PBGW4VSS_USAGE_TYPE@@W4VSS_SOURCE_TYPE@@W4_VSS_APPLICATION_LEVEL@@KW4VSS_ALTERNATE_WRITER_STATE@@_N1@Z
?Unsubscribe@CVssWriter@@QAGJXZ
?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
?Subscribe@CVssWriter@@QAGJK@Z
realloc
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
_initterm
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
memset
_callnewh
malloc
iswascii
?swprintf@@YAHPAGIPBGZZ
_mbsinc
_mbsupr
_wsplitpath
_wfullpath
wcsftime
mktime
swscanf
localtime
floor
isspace
strncpy
_wtoi
iswdigit
wcsncmp
vswprintf
wcspbrk
wcsstr
_wcsicmp
wcscmp
wcscpy
wcscat
wcsncpy
wcsrchr
memmove
wcschr
_wcsrev
_wcslwr
_wcsupr
??_V@YAXPAX@Z
wcslen
_wcsnicmp
clock
_purecall
??3@YAXPAX@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_CxxThrowException
__CxxFrameHandler
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
free
_except_handler3
_mbsrchr
iswspace
PlaySoundW
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
SHGetSpecialFolderLocation
ShellExecuteW
SHGetMalloc
SHGetDesktopFolder
SHGetFileInfoW
SHGetPathFromIDListW
CreateNBVSSInterface
DeleteNBVSSInterface
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE