AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
Static task
static1
Behavioral task
behavioral1
Sample
881ebe8135f3cd52a9724af3442062728d288fe15cb10f2e6f9356a6bf5f0ecd.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
881ebe8135f3cd52a9724af3442062728d288fe15cb10f2e6f9356a6bf5f0ecd.dll
Resource
win10v2004-20221111-en
Target
881ebe8135f3cd52a9724af3442062728d288fe15cb10f2e6f9356a6bf5f0ecd
Size
356KB
MD5
02f061cfe00fd2b8a5fa8dbc78cc1c90
SHA1
c02338155d5ba4277918f6ae9ca9ae9f36fb43d9
SHA256
881ebe8135f3cd52a9724af3442062728d288fe15cb10f2e6f9356a6bf5f0ecd
SHA512
b0a7bdff3c78ff80856d793989f41d046cd54d955bf045ae732a7f966e24aab79a7348581eb574f33a53699b4227d5ca784c281fe780d5022f7d4819e34c8276
SSDEEP
6144:shvcfqnQszD/4qx2CqkYnRH3hcr2iP+WHfqQcbYAJ1EBACoGMnh6m4LoW:sZcfqnQsAqoCq3RH3M2W+2qQcbcMn1kV
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
InterlockedIncrement
InterlockedDecrement
SetEvent
FindCloseChangeNotification
FindNextChangeNotification
FindClose
CompareStringA
InterlockedExchange
GetModuleHandleA
CloseHandle
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
IsBadCodePtr
GetLongPathNameA
LoadLibraryExA
Sleep
WaitForSingleObject
FreeLibrary
SetProcessShutdownParameters
GetModuleFileNameA
ExitProcess
GetUserDefaultLCID
UnmapViewOfFile
MapViewOfFile
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetCurrentThreadId
InterlockedCompareExchange
IsDebuggerPresent
GetCurrentProcessId
DebugBreak
ResetEvent
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegOpenKeyExA
OpenDesktopW
EndDialog
TranslateMessage
MsgWaitForMultipleObjects
SetTimer
KillTimer
DestroyWindow
WaitForInputIdle
EnumDesktopWindows
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoUnmarshalInterface
CoCreateInstance
CoInitialize
CoUninitialize
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
CoRevokeClassObject
CoRegisterClassObject
CreateStreamOnHGlobal
SafeArrayRedim
SafeArrayPutElement
SafeArrayUnaccessData
SafeArrayUnlock
SafeArrayCreate
SafeArrayLock
VariantChangeTypeEx
SysAllocString
SafeArrayDestroy
VariantInit
VariantClear
SafeArrayCopy
VariantCopy
SafeArrayGetElement
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
??1TFileFinder@XPRT@@UAE@XZ
?FindNext@TFileFinder@XPRT@@QAE_NI@Z
?Remove@TFile@XPRT@@SA_NPBG@Z
?GetFileSpec@TFileFinder@XPRT@@QBE?AVTBstr@2@XZ
?Find@TFileFinder@XPRT@@QAE_NPBGI@Z
??0TFileFinder@XPRT@@QAE@XZ
_XprtCompareString@8
_XprtHashString@4
?GetInfo@TFile@XPRT@@SA_NPBGAAVTFileInfo@2@@Z
?IsLoaded@TLibrary@XPRT@@QBE_NXZ
?GetProcAddress@TLibrary@XPRT@@QBEP6GHXZPBD@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?Find@TBstr@XPRT@@QBEHPBGH@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtDestroyThread@8
_XprtCreateThread@8
??0TPtrList@XPRT@@QAE@H@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
_XprtGetMicroseconds@0
?Empty@TBstr@XPRT@@QAEXXZ
?Remove@TBstr@XPRT@@QAEHG@Z
_XprtMemAlloc@4
_XprtUtf8ToString@16
xprt_strlen
_XprtMessageLoop@0
XML_SetProcessingInstructionHandler
XML_SetCharacterDataHandler
XML_SetElementHandler
XML_SetUserData
XML_ParserCreate
XML_GetBuffer
XML_GetCurrentColumnNumber
XML_GetCurrentLineNumber
XML_ErrorString
XML_GetErrorCode
XML_ParseBuffer
_XprtEntityEscape@8
??1TFile@XPRT@@UAE@XZ
?Read@TFile@XPRT@@UAEHPAXH@Z
?Open@TFile@XPRT@@QAE_NPBGI_N@Z
??0TFile@XPRT@@QAE@XZ
?Set@TTime@XPRT@@QAEXN@Z
?Delete@TBstr@XPRT@@QAEHHH@Z
?RemoveAll@TPtrList@XPRT@@QAEXXZ
?AddHead@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
?MakeLower@TBstr@XPRT@@QAEAAV12@XZ
?FileNameFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?ToInt@TBstr@XPRT@@QBEHH@Z
?Init@TCritSec@XPRT@@QAEXXZ
?Term@TCritSec@XPRT@@QAEXXZ
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
_XprtSeedRandom@8
_XprtGetMicroseconds64@0
xprt_memset
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
??3TXprtAllocated@XPRT@@SAXPAX@Z
??1TLibrary@XPRT@@UAE@XZ
??2TXprtAllocated@XPRT@@SAPAXI@Z
_XprtAtomicIncrement@4
?Init@TFileInfo@XPRT@@IAEXPBGI_JABVTTime@2@22@Z
_XprtTlsSetValue@8
_XprtTlsGetValue@4
_XprtTlsReleaseKey@4
_XprtTlsRequestKey@0
XprtTrace
_XprtUrlEncode@8
xprt_strcmp
xprt_memmove
xprt_strlcpy
??0TBstr@XPRT@@QAE@GH@Z
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Lock@TSpinLock@XPRT@@QAEXXZ
?Unlock@TSpinLock@XPRT@@QAEXXZ
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?FindOneOf@TBstr@XPRT@@QBEHPBG@Z
xprt_iswdigit
?IsOpen@TFile@XPRT@@QBE_NXZ
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
XprtTrace2
?CanonicalizeSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtBinToBase64@16
?Load@TLibrary@XPRT@@QAE_NPBG@Z
??0TLibrary@XPRT@@QAE@XZ
?TrimRight@TBstr@XPRT@@QAEAAV12@G@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@G@Z
xprt_wcsicmp
?RemoveTrailingSeparator@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
_XprtRequestMessageId@0
_XprtRegisterMessageCallback@8
_XprtGetSystemInfo@0
_XprtMemFree@4
kSystemEncoding
_XprtGetMessageQueue@0
_XprtPostMessage@16
??0TBstr@XPRT@@QAE@PBG@Z
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
?Attach@TBstr@XPRT@@QAEXPAG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
??1TBstr@XPRT@@QAE@XZ
_XprtUnregisterMessageCallback@4
_XprtReleaseMessageId@4
_XprtPostQuitMessage@8
?Compare@TBstr@XPRT@@QBEHPBG@Z
?Append@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TPtrArray@XPRT@@QAE@XZ
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
_XprtGetMilliseconds@0
_XprtInitialize@8
?Left@TBstr@XPRT@@QBE?AV12@H@Z
_XprtUninitialize@0
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
xprt_wcslen
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
?GetAt@TBstr@XPRT@@QBEGH@Z
_XprtCompareNormal@8
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
_XprtGenerateRandom@8
??1TPtrList@XPRT@@QAE@XZ
?RemoveHead@TPtrList@XPRT@@QAEPAXXZ
?AddTail@TPtrList@XPRT@@QAEPAU__POSITION@2@PAX@Z
xprt_memcpy
_XprtStringLen@4
?Format@TBstr@XPRT@@QAAXPBGZZ
?Add@TPtrArray@XPRT@@QAEHPAX@Z
?RemoveAt@TPtrArray@XPRT@@QAEXHH@Z
??1TPtrArray@XPRT@@QAE@XZ
?InsertAt@TPtrArray@XPRT@@QAEXHPAXH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
_XprtAtomicDecrement@4
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
xprt_ucslcpy
??0TBstr@XPRT@@QAE@PBDPBG@Z
??0TBstr@XPRT@@QAE@ABV01@@Z
?ReverseFind@TBstr@XPRT@@QBEHG@Z
?GetLength@TBstr@XPRT@@QBEHXZ
?Right@TBstr@XPRT@@QBE?AV12@H@Z
?CompareNoCase@TBstr@XPRT@@QBEHPBG@Z
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?IsEmpty@TBstr@XPRT@@QBE_NXZ
xprt_wcscmp
??0TBstr@XPRT@@QAE@PBDHPBG@Z
?Sleep@TThread@XPRT@@SAXI@Z
XML_ParserFree
_adjust_fdiv
_initterm
_onexit
__dllonexit
_wcsicmp
_getpid
memset
_vsnprintf
_except_handler3
setlocale
_snwprintf
qsort
strcmp
strcpy
strcat
malloc
free
strlen
wcsstr
strncmp
_purecall
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
AOLLaunchEntry
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
EEGetModuleInterop
EETrace
ServiceHostEntry
gSMEnableTracingPtr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE