??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
?GetNormalizedPathImpl@detail@@YGHABU?$AvgMutableStringRefBase@_W$0A@@@PB_WIPAVIPathTreeTableRoot@1@_N33@Z
Static task
static1
Behavioral task
behavioral1
Sample
fc7a9522bc037c0a7da54e1cbdbb9d47a06b1caeba7adb3fd734f102a42a2e57.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fc7a9522bc037c0a7da54e1cbdbb9d47a06b1caeba7adb3fd734f102a42a2e57.exe
Resource
win10v2004-20220812-en
Target
fc7a9522bc037c0a7da54e1cbdbb9d47a06b1caeba7adb3fd734f102a42a2e57
Size
374KB
MD5
1bfdb1bc95bcfd7da4d8f5034b71d2e7
SHA1
275b5aac0f9401d6158176293a278d335a7cfaf5
SHA256
fc7a9522bc037c0a7da54e1cbdbb9d47a06b1caeba7adb3fd734f102a42a2e57
SHA512
b9b383cc77477bd4a8c1fe3024e5e09f34cd1899f798726b9f3d0022047fc9d539bff59f542b818135105d9b28a74aea7db9f714ffbb2a6bcb50170dc27f65e6
SSDEEP
6144:jL+cC9tRwYKtkMP3/6bYPqzAeOzq03teZ9yyf2lQ/mpFM3kakBCrGINAtALDoP7o:jzC9tVKtkayQqf03AZHfWQmpO3VeUVNG
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
GetDiskFreeSpaceExW
SetCurrentDirectoryW
GetLastError
GetModuleFileNameW
QueryDosDeviceW
GetLogicalDrives
GetSystemPowerStatus
GetSystemTimeAsFileTime
QueryPerformanceCounter
HeapSetInformation
InterlockedCompareExchange
Sleep
InterlockedExchange
DecodePointer
EncodePointer
GetVolumeInformationW
FindFirstVolumeW
FindNextVolumeW
GetDriveTypeW
FindVolumeClose
SetLastError
GetTickCount
CancelIo
DeviceIoControl
GetOverlappedResult
CreateFileW
WaitForMultipleObjects
CreateProcessW
GetCurrentProcessId
CloseHandle
GetCurrentThreadId
CreateEventW
SetUnhandledExceptionFilter
StartServiceCtrlDispatcherW
SetServiceStatus
CloseServiceHandle
OpenSCManagerW
OpenServiceW
ChangeServiceConfig2W
RegisterServiceCtrlHandlerExW
RtlFreeHeap
RtlReAllocateHeap
RtlAllocateHeap
ZwWaitForSingleObject
RtlNtStatusToDosError
ZwQueryVirtualMemory
RtlAddVectoredExceptionHandler
RtlRemoveVectoredExceptionHandler
ZwWaitForMultipleObjects
ZwDuplicateObject
ZwClose
RtlInitUnicodeString
ZwCreateEvent
ZwSetEvent
ZwTerminateProcess
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
RtlAcquirePebLock
RtlReleasePebLock
RtlCreateUserProcess
ZwResumeThread
memmove
memset
memcpy
_chkstk
_aulldvrm
?GetFullPath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PB_WIPAI@Z
?GetTempDirPath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PAI@Z
?GetDirectoryPathFromFilenamePath@AvgBasPath@@YGHAAU_AVG_UTF16CHAR_STR@@PB_WIPAI@Z
?IsPathRooted@AvgBasPath@@YG_NPB_WI@Z
?GetValue@AvgUtf16CharHeapBuffer@@QBGPB_WXZ
?GetSize@AvgUtf16CharHeapBuffer@@QBGIXZ
??1AvgUtf16CharHeapBuffer@@QAE@XZ
??0AvgUtf16CharHeapBuffer@@QAE@XZ
?AvgBasGetStackFrameModulePath@@YGHAAV?$IAvgString@_W$0A@@@ABUAvgBasStackFrameX86@@@Z
?Initialize@AvgWinGlobalSymlinks@@QAGHW4SymlinksType@1@@Z
??1AvgWinGlobalSymlinks@@QAE@XZ
??0AvgWinGlobalSymlinks@@QAE@XZ
?AvgCompareStringNoCase@@YGHW4AvgCodePage@@PB_W1II@Z
?AvgConvertString2Number@@YGHAAHPB_WIHPAPB_W@Z
??1AvgSpinLockLocker@@QAE@XZ
??0AvgSpinLockLocker@@QAE@PAUAvgSpinLock@@_N@Z
?AvgDestroySysMini@@YGXXZ
?AvgInitializeSysMini@@YGHXZ
?InitializeEnvironment@AvgEnvironment@@YGHXZ
?DestroyEnvironment@AvgEnvironment@@YGXXZ
?Destroy@AvgBasWaitable@@UAGHXZ
?Assign@AvgUtf16CharHeapBuffer@@QAGHPB_WI@Z
?Set@AvgBasEvent@@QAGHXZ
?AvgKernel32IsFnLoaded_UnhandledExceptionFilter@@YG_NXZ
?AvgKernel32_SetUnhandledExceptionFilter@@YGP6GJPAU_EXCEPTION_POINTERS@@@ZP6GJ0@Z@Z
?AvgWinIsProcessBeingDebugged@@YG_NXZ
?AvgKernel32_UnhandledExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?GetPathRootLength@AvgBasPath@@YGIPB_WI@Z
?Append@AvgUtf16CharHeapBuffer@@QAGHPB_WI@Z
?Append@AvgUtf16CharHeapBuffer@@QAGH_W@Z
??AAvgUtf16CharHeapBuffer@@QAGAA_WI@Z
?ReserveElements@AvgUtf16CharHeapBuffer@@QAGHI@Z
?GetDirectoryItem@AvgBasFs@@YGHAAVItem@1@PB_W@Z
?GetName@Item@AvgBasFs@@QBGPB_WXZ
??1Item@AvgBasFs@@QAE@XZ
??0Item@AvgBasFs@@QAE@XZ
?FreeResource@AvgBasWaitable@@IAGHXZ
?Release@AvgBasCriticalSection@@QAGHXZ
?Acquire@AvgBasCriticalSection@@QAGHXZ
?Create@AvgBasCriticalSection@@QAGHXZ
??1AvgBasCriticalSection@@QAE@XZ
??0AvgBasCriticalSection@@QAE@XZ
?GetCurrentModuleHandle@AvgProcess@@YGPAXXZ
?Destroy@AvgBasCriticalSection@@QAGHXZ
?Assign@AvgGuidUtils@@YGXAAU_AvgGuid@@QBE@Z
?GetCurrentProcessId@AvgProcess@@YGKXZ
?IsWow64Process@AvgProcess@@YGHKAA_N@Z
?IsWindowsVista@OsInfo@AvgEnvironment@@YG_NXZ
?IsEmpty@AvgUtf16CharHeapBuffer@@QBG_NXZ
?ConvertValueToSymlink@AvgWinGlobalSymlinks@@SGHAAVAvgUtf16CharHeapBuffer@@PB_W@Z
?ConvertSymlinkToValue@AvgWinGlobalSymlinks@@QAGHAAVAvgUtf16CharHeapBuffer@@W4SymlinksType@1@PB_WI@Z
?ConvertDosLetterToSymlink@AvgWinGlobalSymlinks@@QAGHAAVAvgUtf16CharHeapBuffer@@_W@Z
?AvgCopyString@@YGHPA_WIPB_WI@Z
?GetOsInfoData@AvgEnvironment@@YGABUOsInfoData@1@XZ
?GetHandle@AvgBasWaitable@@IBGPAXXZ
?AvgCreateErrorCodeFromWin32@@YGHW4_AvgErrorCodeSeverity@@K@Z
?Create@AvgBasEvent@@QAGHW4ResetType@1@_N@Z
?Wait@AvgBasEvent@@QAGHH@Z
??0AvgBasObjectFactoryImpl@detail@@QAE@XZ
??1AvgBasObjectFactoryImpl@detail@@QAE@XZ
?Initialize@AvgBasObjectFactoryImpl@detail@@QAGHPBUAvgBasObjectFactoryMapping@@I@Z
?SetProgramPath@AvgBasObjectFactoryImpl@detail@@QAGHPB_W@Z
?GetAvgObject@AvgBasObjectFactoryImpl@detail@@QAGHABU_AvgGuid@@PAPAX@Z
?UnloadSharedLibraries@AvgBasObjectFactoryImpl@detail@@QAGX_N@Z
?AvgKernel32ForceInitialize@@YGXXZ
?Sleep@AvgBasThread@@SGHH@Z
?GetSpecialFolder@AvgEnvironment@@YGHW4SpecialFolder@1@AAV?$IAvgString@_W$0A@@@@Z
?GetMaxPathLength@AvgEnvironment@@YGHAAIPB_W@Z
?IsWindowsVistaOrHigher@OsInfo@AvgEnvironment@@YG_NXZ
??0AvgBasSharedLibraryLoader@@QAE@PB_W@Z
??1AvgBasSharedLibraryLoader@@UAE@XZ
?Load@AvgBasSharedLibraryLoader@@QAGHPB_W@Z
?Unload@AvgBasSharedLibraryLoader@@UAGXXZ
?AttachTo@AvgBasSharedLibraryLoader@@QAGHPBDPCRAX@Z
??0AvgBasWinRegistryHandle@@QAE@W4AvgBasWinRegistryRootType@@@Z
??1AvgBasWinRegistryHandle@@QAE@XZ
?OpenKeyIfExists@AvgBasWinRegistryHandle@@QAGHABU?$AvgStringRefBase@_W$0A@@@@Z
?IsWow64ViewModeSupported@AvgBasWinRegistryHandle@@SG_NXZ
?SetViewMode@AvgBasWinRegistryHandle@@QAGHV?$AvgFlags@W4AvgBasWinRegistryViewModeValues@@@@@Z
?GetStringValue@AvgBasWinRegistryHandle@@QAGHAAV?$IAvgString@_W$0A@@@ABU?$AvgStringRefBase@_W$0A@@@@Z
?CloseKey@AvgBasWinRegistryHandle@@QAGXXZ
?AvgPrintV@@YGHPB_WPAD@Z
?AvgCompareString@@YGHPB_W0II@Z
?AvgFormatStringV@@YGHW4AvgCodePage@@PA_WIPB_WPAIPAD@Z
?DirectoryExists@AvgBasFs@@YGHPB_W@Z
?AvgFindSubStringFromRight@@YGPB_WPB_W0II@Z
?AvgCreateErrorCodeFromWin32@@YGHK@Z
?Create@AvgBasMutex@@QAGH_N@Z
?Acquire@AvgBasMutex@@QAGHH@Z
?Release@AvgBasMutex@@QAGHXZ
?AvgGetStringSizeInElements@@YGIPB_W@Z
?GetString@AvgGuidUtils@@YGHABU_AvgGuid@@AAU_AVG_UTF16CHAR_STR@@@Z
?GetModuleDirectory@AvgModule@@YGHPAXAAU_AVG_UTF16CHAR_STR@@PAI@Z
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
__CxxFrameHandler3
_onexit
_lock
__dllonexit
_unlock
??2@YAPAXI@Z
getchar
swprintf_s
_set_invalid_parameter_handler
_invoke_watson
??3@YAXPAX@Z
_purecall
??_V@YAXPAX@Z
_CxxThrowException
MessageBoxW
RegisterDeviceNotificationW
UnregisterDeviceNotification
??0_Mutex@std@@QAE@W4_Uninitialized@1@@Z
??4_Init_locks@std@@QAEAAV01@ABV01@@Z
?GetNormalizedPathImpl@detail@@YGHABU?$AvgMutableStringRefBase@_W$0A@@@PB_WIPAVIPathTreeTableRoot@1@_N33@Z
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE