?getDwgVersion@AcadVersionInfo@@YG?AW4MaintenanceReleaseVersion@AcDb@@PAW4AcDbDwgVersion@3@@Z
?releaseMinorVersion@AcadVersionInfo@@YAHXZ
respSdjhU3_x16
Static task
static1
Behavioral task
behavioral1
Sample
28bcbacfdf9d23e6f9a83871613f78b5350e6620ce661a18e2f53a017acd107d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
28bcbacfdf9d23e6f9a83871613f78b5350e6620ce661a18e2f53a017acd107d.exe
Resource
win10v2004-20220812-en
Target
28bcbacfdf9d23e6f9a83871613f78b5350e6620ce661a18e2f53a017acd107d
Size
169KB
MD5
0c5e1435a78c2a0848da2b06fbc065e0
SHA1
cb52cb45eb5141a359fb2f6846d0ed2d86cb9da3
SHA256
28bcbacfdf9d23e6f9a83871613f78b5350e6620ce661a18e2f53a017acd107d
SHA512
718f667990656261fc65f334f80e54169c917f48d861590be6d74ba4dd12581aba2ce3f62ced4ad864cef4d6a2efdd7669fdb94ee019cd71a33a7181efb961af
SSDEEP
3072:W1IPmLB8nsm8a8PD6YzZMnOpB+1hKaTLjvOfizduY8kib+r:e2w2sd/eYzZwOpU1saTLKfiZmkKq
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
?putRemoteFile@AcDbHostApplicationServices@@UBE?AW4ErrorStatus@Acad@@PB_W0@Z
?getRemoteFile@AcDbHostApplicationServices@@UBE?AW4ErrorStatus@Acad@@PB_WPA_WH@Z
?isRemoteFile@AcDbHostApplicationServices@@UBEHPB_WPA_W@Z
?isURL@AcDbHostApplicationServices@@UBEHPB_W@Z
?acadInternalServices@AcDbHostApplicationServices@@UAEPAVAcadInternalServices@@XZ
?getRegistryProductLCID@AcDbHostApplicationServices@@UAEKXZ
?getRegistryProductRootKey@AcDbHostApplicationServices@@UAEPB_WXZ
?versionString@AcDbHostApplicationServices@@UAEPB_WXZ
?launchBrowserDialog@AcDbHostApplicationServices@@UBEHPA_WPB_W111H@Z
?drawOleOwnerDrawItem@AcDbHostApplicationServices@@UAEXPAVCOleClientItem@@JJJJJ@Z
?getNewOleClientItem@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPAVCOleClientItem@@@Z
?serializeOleItem@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@PAVCOleClientItem@@PAVCArchive@@@Z
?_entToWorldTransform@AcDbHostApplicationServices@@UAEHQANPAUflagmat@@@Z
?getSubstituteFont@AcDbHostApplicationServices@@UAEHPAPA_WPA_WHH@Z
?alert@AcDbHostApplicationServices@@UBEXPB_W@Z
?releaseMinorVersion@AcDbHostApplicationServices@@UAEHXZ
?releaseMajorVersion@AcDbHostApplicationServices@@UAEHXZ
?releaseMajorMinorString@AcDbHostApplicationServices@@UAEPB_WXZ
?prodcode@AcDbHostApplicationServices@@UAE?BW4ProdIdCode@@XZ
?companyName@AcDbHostApplicationServices@@UAEPB_WXZ
?freeRawMem@AcHeapOperators@@CGXPAX@Z
?auditPrintReport@AcDbHostApplicationServices@@UBEXPAVAcDbAuditInfo@@PB_WH@Z
??0AcDbDatabase@@QAE@_N0@Z
?dxfIn@AcDbDatabase@@QAE?AW4ErrorStatus@Acad@@PB_W0@Z
?acdbReadDwgFile@@YG?AW4ErrorStatus@Acad@@PAVAcDbDatabase@@PB_WH1@Z
?acdbGetSummaryInfo@@YG?AW4ErrorStatus@Acad@@PAVAcDbDatabase@@AAPAVAcDbDatabaseSummaryInfo@@@Z
?plotSettingsValidator@AcDbHostApplicationServices@@UBEPAVAcDbPlotSettingsValidator@@XZ
?layoutManager@AcDbHostApplicationServices@@UBEPAVAcDbLayoutManager@@XZ
?loadApp@AcDbHostApplicationServices@@UAE_NPB_WW4LoadReasons@AcadApp@@_N2@Z
?getDefaultPlotCfgInfo@AcDbHostApplicationServices@@UAEXPA_W0@Z
?signingComplete@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@W423@PB_WPA_N@Z
?getPassword@AcDbHostApplicationServices@@UAE_NPB_WW4PasswordOptions@1@PA_WI@Z
?usedPasswordFromCacheMsg@AcDbHostApplicationServices@@UAEXPB_W@Z
?missingCryptoProviderMsg@AcDbHostApplicationServices@@UAEXXZ
?acdbStripMTextFormatting@@YAPA_WPB_WVAcDbObjectId@@H@Z
?product@AcDbHostApplicationServices@@UAEPB_WXZ
?program@AcDbHostApplicationServices@@UAEPB_WXZ
?createWorkingGlobals@AcDbHostApplicationServices@@UAEPAVAcDbGlobals@@XZ
?newClipBoundaryArray@AcDbHostApplicationServices@@UAEPAVClipBoundaryArray@@XZ
?newClipBoundaryPolygonal@AcDbHostApplicationServices@@UAEPAVAcDbAbstractClipBoundaryDefinition@@XZ
?newClipBoundaryRectangular@AcDbHostApplicationServices@@UAEPAVAcDbAbstractClipBoundaryDefinition@@XZ
?newProgressMeter@AcDbHostApplicationServices@@UAEPAVAcDbHostApplicationProgressMeter@@XZ
?getEnv@AcDbHostApplicationServices@@UAEPB_WPB_W@Z
?getTempPath@AcDbHostApplicationServices@@UAEIKPA_W@Z
?doFullCRCCheck@AcDbHostApplicationServices@@UAEHXZ
?enableMessageDisplay@AcDbHostApplicationServices@@UAEXH@Z
?readyToDisplayMessages@AcDbHostApplicationServices@@UAEHXZ
?displayString@AcDbHostApplicationServices@@UBEXPB_WH@Z
?displayChar@AcDbHostApplicationServices@@UBEX_W@Z
?userBreak@AcDbHostApplicationServices@@UBEH_N@Z
?fatalError@AcDbHostApplicationServices@@UAAXPB_WZZ
?getLocalRootFolder@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPB_W@Z
?getRoamableRootFolder@AcDbHostApplicationServices@@UAE?AW4ErrorStatus@Acad@@AAPB_W@Z
?isA@AcDbHostApplicationServices@@UBEPAVAcRxClass@@XZ
?comparedTo@AcRxObject@@UBE?AW4Ordering@AcRx@@PBV1@@Z
?isEqualTo@AcRxObject@@UBEHPBV1@@Z
?copyFrom@AcRxObject@@UAE?AW4ErrorStatus@Acad@@PBV1@@Z
?clone@AcRxObject@@UBEPAV1@XZ
?done@AcDbObjectIterator@@QBE_NXZ
?newAcRxClass@@YAPAVAcRxClass@@PB_W0HP6APAVAcRxObject@@XZ00@Z
acrx_abort
?description@AcDbMlineStyle@@QBEPB_WXZ
?patternName@AcDbHatch@@QBEPB_WXZ
?rbChain@AcDbXrecord@@QBE?AW4ErrorStatus@Acad@@PAPAUresbuf@@PAVAcDbDatabase@@@Z
?objectId@AcDbObject@@QBE?AVAcDbObjectId@@XZ
?comments@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPB_W@Z
?getName@AcDbSymbolTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPB_W@Z
?textStyle@AcDbMText@@QBE?AVAcDbObjectId@@XZ
?contents@AcDbMText@@QBEPA_WXZ
?prompt@AcDbAttributeDefinition@@QBEPA_WXZ
?tag@AcDbAttributeDefinition@@QBEPA_WXZ
?desc@AcDbAttributeDefinition@@SAPAVAcRxClass@@XZ
?textString@AcDbText@@QBEPA_WXZ
?tag@AcDbAttribute@@QBEPA_WXZ
?desc@AcDbAttribute@@SAPAVAcRxClass@@XZ
?acdbGroupCodeToType@@YA?AW4DwgDataType@AcDb@@F@Z
acutRelRb
?isErased@AcDbObjectId@@QBE_NXZ
?extensionDictionary@AcDbObject@@QBE?AVAcDbObjectId@@XZ
acdbCleanUp
acdbModelerEnd
?deleteAcRxClass@@YAXPAVAcRxClass@@@Z
acrxSysRegistry
?desc@AcRxDictionary@@SAPAVAcRxClass@@XZ
??0AcRxObject@@IAE@XZ
?desc@AcDbXrecord@@SAPAVAcRxClass@@XZ
?desc@AcDbBlockReference@@SAPAVAcRxClass@@XZ
?desc@AcDbSymbolTableRecord@@SAPAVAcRxClass@@XZ
?desc@AcDbMText@@SAPAVAcRxClass@@XZ
?desc@AcDbText@@SAPAVAcRxClass@@XZ
?desc@AcDbObject@@SAPAVAcRxClass@@XZ
?acrxBuildClassHierarchy@@YAXXZ
?acrxRegisterService@@YAPAXPB_W@Z
acdbValidateSetup
?acdbSetHostApplicationServices@@YA?AW4ErrorStatus@Acad@@PAVAcDbHostApplicationServices@@@Z
??1AcDbHostApplicationServices@@UAE@XZ
??0AcDbHostApplicationServices@@QAE@H@Z
?desc@AcDbMlineStyle@@SAPAVAcRxClass@@XZ
?desc@AcDbHatch@@SAPAVAcRxClass@@XZ
?acutNewString@@YA?AW4ErrorStatus@Acad@@PB_WAAPA_W@Z
?objectId@AcDbObjectIterator@@QAE?AVAcDbObjectId@@XZ
?step@AcDbObjectIterator@@QAEX_N0@Z
?start@AcDbObjectIterator@@QAEX_N@Z
?attributeIterator@AcDbBlockReference@@QBEPAVAcDbObjectIterator@@XZ
?x@AcRxObject@@QBEPAV1@PBVAcRxClass@@@Z
?acutDelBuffer@@YAXAAPAX@Z
?setWorkingDatabase@AcDbHostApplicationServices@@QAEXPAVAcDbDatabase@@@Z
s_pServices
?desc@AcDbBlockTable@@SAPAVAcRxClass@@XZ
?desc@AcDbBlockTableRecord@@SAPAVAcRxClass@@XZ
?desc@AcDbSymbolTable@@SAPAVAcRxClass@@XZ
?acdbOpenAcDbObject@@YG?AW4ErrorStatus@Acad@@AAPAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@PBVAcRxClass@@_N@Z
?newIterator@AcDbDictionary@@QBEPAVAcDbDictionaryIterator@@XZ
?done@AcDbSymbolTableIterator@@QBE_NXZ
?newIterator@AcDbBlockTable@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableIterator@@_N1@Z
?getRecordId@AcDbSymbolTableIterator@@QBE?AW4ErrorStatus@Acad@@AAVAcDbObjectId@@@Z
?step@AcDbSymbolTableIterator@@QAEX_N0@Z
?start@AcDbSymbolTableIterator@@QAEX_N0@Z
?newIterator@AcDbSymbolTable@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbSymbolTableIterator@@_N1@Z
?done@AcDbBlockTableRecordIterator@@QBE_NXZ
?namedObjectsDictionaryId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?isValid@AcDbObjectId@@QBE_NXZ
?viewportTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?regAppTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?UCSTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
??0AcDbFullSubentPath@@QAE@VAcDbObjectId@@VAcDbSubentId@@@Z
??1AcDbFullSubentPath@@QAE@XZ
?viewTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?dimStyleTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?linetypeTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?textStyleTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?layerTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?blockTableId@AcDbDatabase@@QAE?AVAcDbObjectId@@XZ
?close@AcDbObject@@QAE?AW4ErrorStatus@Acad@@XZ
?desc@AcDbDictionary@@SAPAVAcRxClass@@XZ
?acdbOpenAcDbObject@@YA?AW4ErrorStatus@Acad@@AAPAVAcDbObject@@VAcDbObjectId@@W4OpenMode@AcDb@@_N@Z
?getEntityId@AcDbBlockTableRecordIterator@@QBE?AW4ErrorStatus@Acad@@AAVAcDbObjectId@@@Z
?step@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?start@AcDbBlockTableRecordIterator@@QAEX_N0@Z
?newIterator@AcDbBlockTableRecord@@QBE?AW4ErrorStatus@Acad@@AAPAVAcDbBlockTableRecordIterator@@_N1@Z
?allocRawMem@AcHeapOperators@@CGPAXI@Z
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
WaitForSingleObject
CloseHandle
CreateThread
CreateEventW
GetModuleFileNameW
GetLastError
Sleep
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
SetEvent
RaiseException
GetTickCount
GetCurrentThreadId
InterlockedIncrement
InterlockedDecrement
LocalFree
FormatMessageW
ExpandEnvironmentStringsW
WaitForMultipleObjects
CreateMutexW
ReleaseMutex
GetCurrentProcessId
GetSystemTimeAsFileTime
SearchPathW
GetModuleHandleW
MultiByteToWideChar
UnregisterClassA
CharNextW
DispatchMessageW
TranslateMessage
GetMessageW
CharUpperW
PostThreadMessageW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
RegOpenKeyExW
CoRevokeClassObject
StringFromGUID2
CoUninitialize
CoInitialize
CoRegisterClassObject
CoCreateInstance
LoadTypeLi
SysStringLen
SysAllocStringLen
SysFreeString
RegisterTypeLi
SysAllocString
UnRegisterTypeLi
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?find_last_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_first_not_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??3@YAXPAX@Z
free
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
_wcsnicmp
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memmove_s
_purecall
wcsncpy_s
wcscat_s
wcscpy_s
??_V@YAXPAX@Z
wcsncmp
_wcslwr
_wcsdup
_wcsupr
_vswprintf
wcsncpy
iswalnum
iswdigit
iswalpha
_wcsncoll
_wcsnicoll
__CxxFrameHandler3
wcscspn
_wcsrev
_wcsicmp
_wcsicoll
wcscoll
memset
_unlock
_encode_pointer
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
memcpy
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
?getDwgVersion@AcadVersionInfo@@YG?AW4MaintenanceReleaseVersion@AcDb@@PAW4AcDbDwgVersion@3@@Z
?releaseMinorVersion@AcadVersionInfo@@YAHXZ
respSdjhU3_x16
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE