ServiceMain
HttpExtensionProc
TerminateExtension
Static task
static1
Behavioral task
behavioral1
Sample
b038a917877b7a9024dda7620c7e54ff14c8449b5448d7d1a1c689deda9b24b1.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b038a917877b7a9024dda7620c7e54ff14c8449b5448d7d1a1c689deda9b24b1.dll
Resource
win10v2004-20220901-en
Target
b038a917877b7a9024dda7620c7e54ff14c8449b5448d7d1a1c689deda9b24b1
Size
199KB
MD5
3be2323db1bcc4c2608945b5734a2b8a
SHA1
e4d510da243b58c688d4bec1d7441d343a9de676
SHA256
b038a917877b7a9024dda7620c7e54ff14c8449b5448d7d1a1c689deda9b24b1
SHA512
49481ccafca7935090006070fdfe1bd1ef5f2361ca161874f57864f43e0d137bbb9125ceacc7a872c7f9739c2bc7c669f58acbe3c43e2461fd98d833836b3e96
SSDEEP
6144:2iihpSdQ1/eKaiVWzTJlUTIGaSUg1SLOTNpG9T8:cR8TMTIBSUgFTNEd
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
??3@YAXPAX@Z
_adjust_fdiv
malloc
_initterm
free
wcsncmp
_wcsupr
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
wcsstr
wcsncpy
atoi
iswspace
wcscpy
wcschr
swprintf
sprintf
setlocale
_wcsnicmp
_wtoi
isspace
wcslen
wcsrchr
_wcsicmp
_CxxThrowException
__CxxFrameHandler
qsort
?_ImpersonateIf@CImpersonateRemoteAccess@@AAEHPBG0K@Z
??1CImpersonationTokenCache@@QAE@XZ
?GetPhysicalPath@CWebServer@@QAEKPBGPAGKK@Z
?Read@CRegAccess@@QAEKPBGK@Z
??0CRegAccess@@QAE@KPBG@Z
?GetVPathAuthorization@CMetaDataMgr@@QAEKPBG@Z
??1CRegChangeEvent@@QAE@XZ
??0CRegChangeEvent@@QAE@PBGH@Z
?Reset@CRegChangeEvent@@QAEXXZ
?SystemExceptionTranslator@@YAXIPAU_EXCEPTION_POINTERS@@@Z
?Initialize@CImpersonationTokenCache@@QAEXPBGHHHKKK@Z
??0CImpersonationTokenCache@@QAE@PBG@Z
?ReInitializeIISScopes@CImpersonationTokenCache@@QAEXXZ
??0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z
?CheckError@CLocalGlobalPropertyList@@QAEJAAKPAPAG@Z
??0CLocalGlobalPropertyList@@QAE@PAVCEmptyPropertyList@@HPBGK@Z
?GetGlobalStaticPropertyList@@YGPAVCStaticPropertyList@@XZ
?GetBrowserCodepage@@YGKAAVCWebServer@@K@Z
?CIShutdown@@YGXXZ
?URLEscapeW@@YGXPBGAAVCVirtualString@@KH@Z
??1CFileMapView@@QAE@XZ
?Init@CFileMapView@@QAEXXZ
??0CFileMapView@@QAE@PBG@Z
?wcsipattern@@YGPAGPAGPBG@Z
?Release@CImpersonateRemoteAccess@@QAEXXZ
?GetCGIVariableW@CWebServer@@QAEHPBGAAV?$XArray@G@@AAK@Z
?GetLCIDFromString@@YGKPAG@Z
?HTMLEscapeW@@YGXPBGAAVCVirtualString@@K@Z
?WideCharToXArrayMultiByte@@YGKPBGKIAAV?$XArray@E@@@Z
??0CVirtualString@@QAE@I@Z
??1CVirtualString@@QAE@XZ
?MakeISearch@@YGJPAPAUISearchQueryHits@@PAVCDbRestriction@@PBG@Z
?GetStringDbRestriction@@YGPAVCDbRestriction@@PBGKPAUIColumnMapper@@K@Z
?MultiByteToXArrayWideChar@@YGKPBEKIAAV?$XArray@G@@@Z
?GrowBuffer@CVirtualString@@AAEXK@Z
??1CDbCmdTreeNode@@QAE@XZ
?LocaleToCodepage@@YGKK@Z
?IsRunningAsSystem@CImpersonateSystem@@SGHXZ
??0CMetaDataMgr@@QAE@HW4CiVRootTypeEnum@@KPBG@Z
?ExtensionHasScriptMap@CMetaDataMgr@@QAEHPBG@Z
??1CMetaDataMgr@@QAE@XZ
??1CImpersonateSystem@@QAE@XZ
??0CDbColumns@@QAE@I@Z
??0CDbColId@@QAE@XZ
?Add@CDbColumns@@QAEHABVCDbColId@@I@Z
??4CDbColId@@QAEAAV0@ABV0@@Z
??1CDbColumns@@QAE@XZ
??0CException@@QAE@XZ
_LoadBHIFilter@16
LoadTextFilter
?ciDelete@@YGXPAX@Z
?ciNew@@YGPAXI@Z
?Cleanup@CDbColId@@QAEXXZ
?MakePrivileged@CImpersonateSystem@@AAEXXZ
?DecodeURLEscapes@@YGXPAEAAKPAGK@Z
wsprintfW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
GetFileSize
CreateFileW
VirtualAlloc
GetStringTypeW
InitializeCriticalSection
DeleteCriticalSection
GetACP
GetLastError
GetModuleHandleW
FormatMessageW
SetThreadLocale
GetThreadLocale
WaitForSingleObject
Sleep
InterlockedDecrement
VirtualProtect
MultiByteToWideChar
GetFileAttributesExW
DisableThreadLibraryCalls
GetCurrentThread
GetThreadTimes
CoInitializeEx
CoUninitialize
CoTaskMemFree
ServiceMain
HttpExtensionProc
TerminateExtension
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ