AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
Static task
static1
Behavioral task
behavioral1
Sample
8d358146ad859b3ce05de453737ef3a87611d208238e03e176984a69455acd8c.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8d358146ad859b3ce05de453737ef3a87611d208238e03e176984a69455acd8c.dll
Resource
win10v2004-20220901-en
Target
8d358146ad859b3ce05de453737ef3a87611d208238e03e176984a69455acd8c
Size
452KB
MD5
aa4f66af28d765b75d08df91d6462980
SHA1
abe5afa494bc48b9b30ae108dde5ceef55c965e0
SHA256
8d358146ad859b3ce05de453737ef3a87611d208238e03e176984a69455acd8c
SHA512
8c230ca5a6158be48febe58cfd2f4f021f24eab4f6b099f8f3885f439b2dd0a3da36b791dfc94f02d33fee0799b42b7a281ca6f196849346df054313034c7deb
SSDEEP
12288:7ZcfqnQsAqoCq3RH3M2W+2qQcbcMe7oWdT:7gZC0R8Ere7o6
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
InterlockedIncrement
InterlockedDecrement
SetEvent
FindCloseChangeNotification
FindNextChangeNotification
FindClose
CompareStringA
InterlockedExchange
GetModuleHandleA
CloseHandle
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
IsBadCodePtr
GetLongPathNameA
LoadLibraryExA
Sleep
WaitForSingleObject
FreeLibrary
SetProcessShutdownParameters
GetModuleFileNameA
ExitProcess
GetUserDefaultLCID
UnmapViewOfFile
MapViewOfFile
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetCurrentThreadId
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentProcessId
DebugBreak
ResetEvent
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
OpenDesktopW
EndDialog
TranslateMessage
MsgWaitForMultipleObjects
SetTimer
KillTimer
DestroyWindow
WaitForInputIdle
EnumDesktopWindows
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoUnmarshalInterface
CoCreateInstance
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
SafeArrayRedim
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
SysAllocString
SafeArrayDestroy
VariantInit
VariantClear
SafeArrayCopy
VariantCopy
SafeArrayGetElement
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
??1TFileFinder@XPRT@@UAE@XZ
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?Remove@TFile@XPRT@@SA_NPBG@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
??0TFileFinder@XPRT@@QAE@XZ
_XprtCompareString@8
_XprtHashString@4
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?IsLoaded@TLibrary@XPRT@@QBE_NXZ
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtDestroyThread@8
_XprtCreateThread@8
??0TPtrList@XPRT@@QAE@H@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtGetMicroseconds@0
?Empty@TBstr@XPRT@@QAEXXZ
?Remove@TBstr@XPRT@@QAEHG@Z
_XprtMemAlloc@4
_XprtUtf8ToString@16
xprt_strlen
_XprtMessageLoop@0
XML_SetProcessingInstructionHandler
XML_SetCharacterDataHandler
XML_SetElementHandler
XML_SetUserData
XML_ParserCreate
XML_GetBuffer
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_ErrorString
XML_GetErrorCode
XML_ParseBuffer
_XprtEntityEscape@8
??1TFile@XPRT@@UAE@XZ
?Read@TFile@XPRT@@UAEHPAXH@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
??0TFile@XPRT@@QAE@XZ
?Set@TTime@XPRT@@QAEXN@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Init@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtSeedRandom@8
_XprtGetMicroseconds64@0
xprt_memset
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??3TXprtAllocated@XPRT@@SAXPAX@Z
??1TLibrary@XPRT@@UAE@XZ
??2TXprtAllocated@XPRT@@SAPAXI@Z
_XprtAtomicIncrement@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
_XprtTlsSetValue@8
_XprtTlsGetValue@4
_XprtTlsReleaseKey@4
_XprtTlsRequestKey@0
XprtTrace
_XprtUrlEncode@8
xprt_strcmp
xprt_memmove
xprt_strlcpy
??0TBstr@XPRT@@QAE@GH@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
xprt_iswdigit
?IsOpen@TFile@XPRT@@QBE_NXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
XprtTrace2
?CanonicalizeSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtBinToBase64@16
?Load@TLibrary@XPRT@@QAE_NPBG@Z
??0TLibrary@XPRT@@QAE@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcsicmp
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
_XprtGetSystemInfo@0
_XprtMemFree@4
kSystemEncoding
_XprtGetMessageQueue@0
_XprtPostMessage@16
??0TBstr@XPRT@@QAE@PBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??1TBstr@XPRT@@QAE@XZ
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
_XprtPostQuitMessage@8
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TPtrArray@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
_XprtGetMilliseconds@0
_XprtInitialize@8
?Left@TBstr@XPRT@@QBE?AV12@H@Z
_XprtUninitialize@0
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
xprt_wcslen
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
_XprtCompareNormal@8
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
_XprtGenerateRandom@8
??1TPtrList@XPRT@@QAE@XZ
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
xprt_memcpy
_XprtStringLen@4
?Format@TBstr@XPRT@@QAAXPBGZZ
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
??1TPtrArray@XPRT@@QAE@XZ
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
xprt_ucslcpy
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_wcscmp
??0TBstr@XPRT@@QAE@PBDHPBG@Z
?Sleep@TThread@XPRT@@SAXI@Z
XML_ParserFree
_adjust_fdiv
_initterm
_onexit
__dllonexit
_wcsicmp
_getpid
memset
_vsnprintf
_except_handler3
setlocale
_snwprintf
qsort
strcmp
strcpy
strcat
malloc
free
strlen
wcsstr
strncmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE