Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
Static task
static1
Behavioral task
behavioral1
Sample
8b76e0aec4198663528f60ba37b5bf05f484e9e56351d1aecb9f15164bf08901.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8b76e0aec4198663528f60ba37b5bf05f484e9e56351d1aecb9f15164bf08901.dll
Resource
win10v2004-20220901-en
Target
8b76e0aec4198663528f60ba37b5bf05f484e9e56351d1aecb9f15164bf08901
Size
188KB
MD5
8e6e8e73252cdc679fb1a8472c5f4573
SHA1
a942e250bc08bd9d1d36e25e63a735ec915401f7
SHA256
8b76e0aec4198663528f60ba37b5bf05f484e9e56351d1aecb9f15164bf08901
SHA512
df67364dfa93f83a5097f8af48aaa220cc2b72d39753f0baf052fb87f5d00d23ff3d5f0f5df7a0fb3ec2244e77f5f40be73384e67f4a3664a7e0a5e8421efc8a
SSDEEP
3072:qYClhrGEN4ucaZa6EDjD4eNcxAZOwpIXrai5VMr9j67v2y10DdkC9UqFaU7pu8An:2yaEb4eNcmvMN8r9samC9UaXfnCt
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
GetWindowsDirectoryA
ExitProcess
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
SetTimer
KillTimer
WaitForInputIdle
MsgWaitForMultipleObjects
TranslateMessage
DestroyWindow
OpenDesktopW
EnumDesktopWindows
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoInitializeEx
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoUninitialize
VariantChangeTypeEx
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantCopy
SysAllocString
VariantInit
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
xprt_strlcpy
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
??1TBstr@XPRT@@QAE@XZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_ucslcpy
_XprtStringLen@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
?Unlock@TSpinLock@XPRT@@QAEXXZ
XprtTrace
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@GH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
_XprtMemAlloc@4
_XprtGetSystemInfo@0
XprtTrace2
_XprtBinToBase64@16
kSystemEncoding
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
_XprtPostQuitMessage@8
??0TBstr@XPRT@@QAE@PBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtMemFree@4
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtHashString@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtCreateThread@8
_XprtInitialize@8
_XprtUninitialize@0
_XprtDestroyThread@8
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?Sleep@TThread@XPRT@@SAXI@Z
?Term@TCritSec@XPRT@@QAEXXZ
xprt_memset
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtGetMessageQueue@0
_XprtMessageLoop@0
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
xprt_iswdigit
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_vsnprintf
_getpid
memset
_except_handler3
_purecall
qsort
strcmp
setlocale
_snwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
RegCloseKey
Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE