Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
Static task
static1
Behavioral task
behavioral1
Sample
0ede40f105deb66dba287d3ad297a8e1.dll
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ede40f105deb66dba287d3ad297a8e1.dll
Resource
win10v2004-20231215-en
Target
0ede40f105deb66dba287d3ad297a8e1
Size
248KB
MD5
0ede40f105deb66dba287d3ad297a8e1
SHA1
05920a69451ee002fad218fcf8ab71f1182c19d1
SHA256
612632a9ee019a6652d1af0edcb7ecba8c43c13d17371e4f1acd7691da762bc8
SHA512
37c1428ea4e2638748bddac671620e2b5ac5b8d73a6e57fc29ccc8f559cd02530288ed456a4ac6164ea8c54d556de4380f8f5bd77a695143aca0527ac80050b3
SSDEEP
3072:fYClhrGEN4ucaZa6EDjD4eNcxAZOwpIXrai55jvsRcFXtNq2d02DGmw/EaHvLd:tyaEb4eNcmvMNrsRidNMhNPZ
Checks for missing Authenticode signature.
resource |
---|
0ede40f105deb66dba287d3ad297a8e1 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
FreeLibrary
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
CloseHandle
GetSystemDirectoryA
LoadLibraryA
GetLastError
SetLastError
GetWindowsDirectoryA
ExitProcess
VirtualQuery
GetCurrentProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
UnmapViewOfFile
MapViewOfFile
GetCurrentThreadId
InterlockedCompareExchange
ResetEvent
SetEvent
SetTimer
KillTimer
WaitForInputIdle
MsgWaitForMultipleObjects
TranslateMessage
DestroyWindow
OpenDesktopW
EnumDesktopWindows
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
StringFromCLSID
CoRegisterMessageFilter
CoInitializeEx
CoUnmarshalInterface
CreateStreamOnHGlobal
CoMarshalInterface
CoUninitialize
VariantChangeTypeEx
SafeArrayRedim
SafeArrayPutElement
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayCopy
SafeArrayDestroy
VariantClear
VariantCopy
SysAllocString
VariantInit
SafeArrayLock
SafeArrayCreate
SafeArrayUnlock
xprt_strlcpy
?Assign@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
xprt_strcmp
xprt_memmove
?Mid@TBstr@XPRT@@QBE?AV12@H@Z
?Mid@TBstr@XPRT@@QBE?AV12@HH@Z
?Find@TBstr@XPRT@@QBEHGH@Z
?GetLength@TBstr@XPRT@@QBEHXZ
??1TBstr@XPRT@@QAE@XZ
?GetAt@TBstr@XPRT@@QBEGH@Z
?Add@TPtrArray@XPRT@@QAEHPAX@Z
xprt_ucslcpy
_XprtStringLen@4
?TestAccess@TFile@XPRT@@SA_NPBGI@Z
?SetCount@TPtrArray@XPRT@@QAE_NHH@Z
?GetDigestSize@TMdXDigest@XPRT@@UBEHXZ
?Finish@TMdXDigest@XPRT@@UAEHPAEH@Z
??0TMessageDigest@XPRT@@QAE@XZ
?Transform@TMd5Digest@XPRT@@EAEXQAIQBE@Z
?Append@TBstr@XPRT@@QAEAAV12@G@Z
?Update@TMessageDigest@XPRT@@QAEXPBEH@Z
xprt_memcpy
xprt_strlen
?Unlock@TSpinLock@XPRT@@QAEXXZ
XprtTrace
?Lock@TSpinLock@XPRT@@QAEXXZ
??0TPtrArray@XPRT@@QAE@XZ
??1TPtrArray@XPRT@@QAE@XZ
?Left@TBstr@XPRT@@QBE?AV12@H@Z
?Empty@TBstr@XPRT@@QAEXXZ
??0TBstr@XPRT@@QAE@GH@Z
?TrimRight@TBstr@XPRT@@QAEAAV12@XZ
?TrimLeft@TBstr@XPRT@@QAEAAV12@XZ
?Append@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?RemoveKey@TPtrFromPtrMap@XPRT@@QAE_NPAX@Z
?SetOptimalLoad@TPtrFromPtrMap@XPRT@@QAEXMMM_N@Z
?SetAtGrow@TPtrArray@XPRT@@QAEXHPAX@Z
?FreeDataChain@SPlex@XPRT@@QAEXXZ
?Create@SPlex@XPRT@@SGPAU12@AAPAU12@II@Z
?Lock@TCritSec@XPRT@@QAEXXZ
?Unlock@TCritSec@XPRT@@QAEXXZ
?Init@TCritSec@XPRT@@QAEXXZ
_XprtMemAlloc@4
_XprtGetSystemInfo@0
XprtTrace2
_XprtBinToBase64@16
kSystemEncoding
?Append@TBstr@XPRT@@QAEAAV12@PBDPBG@Z
?Assign@TBstr@XPRT@@QAEAAV12@ABV12@@Z
?GetEncodedString@TBstr@XPRT@@QBEPBDPBG@Z
?GetString@TBstr@XPRT@@QBEPBGXZ
??0TBstr@XPRT@@QAE@PBDPBG@Z
?Compare@TBstr@XPRT@@QBEHPBG@Z
_XprtPostQuitMessage@8
??0TBstr@XPRT@@QAE@PBG@Z
?GetStartPosition@TPtrFromPtrMap@XPRT@@QBEPAU__POSITION@2@XZ
_XprtMemFree@4
?DirSpecFromFullSpec@TFile@XPRT@@SA?AVTBstr@2@PBG@Z
?AppendFileNameToSpec@TFile@XPRT@@SA?AVTBstr@2@PBG0@Z
?GetNextAssoc@TPtrFromPtrMap@XPRT@@QBEXAAPAU__POSITION@2@AAPAX1@Z
?SetAt@TPtrFromPtrMap@XPRT@@QAEPAU__POSITION@2@PAX0@Z
?Lookup@TPtrFromPtrMap@XPRT@@QBE_NPAXAAPAX@Z
??0TPtrFromPtrMap@XPRT@@QAE@H@Z
_XprtHashString@4
_XprtCompareString@8
_XprtFreeString@4
_XprtAllocString@4
?RemoveAll@TPtrFromPtrMap@XPRT@@QAEXXZ
??1TPtrFromPtrMap@XPRT@@QAE@XZ
??0TBstr@XPRT@@QAE@ABV01@@Z
?Assign@TBstr@XPRT@@QAEAAV12@PBG@Z
_XprtCreateThread@8
_XprtInitialize@8
_XprtUninitialize@0
_XprtDestroyThread@8
_XprtAtomicDecrement@4
_XprtAtomicIncrement@4
?Sleep@TThread@XPRT@@SAXI@Z
?Term@TCritSec@XPRT@@QAEXXZ
xprt_memset
?Format@TBstr@XPRT@@QAAXPBGZZ
_XprtGetMilliseconds@0
?IsEmpty@TBstr@XPRT@@QBE_NXZ
_XprtGetMessageQueue@0
_XprtMessageLoop@0
?Detach@TBstr@XPRT@@QAEPAGXZ
??0TBstr@XPRT@@QAE@XZ
??ATPtrFromPtrMap@XPRT@@QAEAAPAXPAX@Z
?Attach@TBstr@XPRT@@QAEXPAG@Z
xprt_iswdigit
_adjust_fdiv
malloc
_initterm
free
_onexit
__dllonexit
_vsnprintf
_getpid
memset
_except_handler3
_purecall
qsort
strcmp
setlocale
_snwprintf
??3@YAXPAX@Z
??2@YAPAXI@Z
_wcslwr
RegCloseKey
Shutdown
StartHostManagerThread
StopHostManagerThread
gSMEnableTracingPtr
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE