e74ab0ad1775c1464300058cd2bd1e75f2e1abe36646dcb927dc018d5fbc1088

Sharing

Copy URL

Twitter E-mail

General

Target

e74ab0ad1775c1464300058cd2bd1e75f2e1abe36646dcb927dc018d5fbc1088
Size

3.3MB
MD5

755a75db1327d3a19fb8b9b1a1e6d730
SHA1

f982923b11bdabe27c9f3cc11cdb00a2a4b3709a
SHA256

e74ab0ad1775c1464300058cd2bd1e75f2e1abe36646dcb927dc018d5fbc1088
SHA512

64be4bcf854dd85a4552d5db59830b07e078addd7ce11fbfa1995c8b25463ef26e110a4d9247727c52609dc44260801802198d68cd164aa88720d5297748e1cd
SSDEEP

49152:DucCrMzcHipTP0aVy+cTiPA+uo8TWh6UU3JxpHIWkU1Zwnlmd+:8P2tVyfbnoV6UCZHIxR

Score

1^/10

Malware Config

Signatures

Files

e74ab0ad1775c1464300058cd2bd1e75f2e1abe36646dcb927dc018d5fbc1088
.dll regsvr32 windows:6 windows x86 arch:x86

a5c34b0723b481d1608f2f8a32a2dd62

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31-05-2021 06:43

Not After

17-09-2029 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

02-11-2023 08:32

Not After

30-10-2034 08:32

Subject

CN=Certum Timestamp 2023,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19-05-2021 05:32

Not After

18-05-2036 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20-12-2022 08:57

Not After

18-03-2025 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20-12-2022 08:57

Not After

18-03-2025 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

23:5d:12:ae:24:4e:ed:bd:06:99:bf:e1:b5:a9:df:c6:14:1d:27:3a:97:62:2c:21:5e:20:89:ea:bf:a8:f5:b6
Signer

Actual PE Digest

23:5d:12:ae:24:4e:ed:bd:06:99:bf:e1:b5:a9:df:c6:14:1d:27:3a:97:62:2c:21:5e:20:89:ea:bf:a8:f5:b6

Digest Algorithm

sha256

PE Digest Matches

false

cc:d5:f8:d0:d8:ea:de:94:ba:fe:8c:5d:c2:d5:87:7c:ca:72:46:10
Signer

Actual PE Digest

cc:d5:f8:d0:d8:ea:de:94:ba:fe:8c:5d:c2:d5:87:7c:ca:72:46:10

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\baidu\netdisk\pc-common\Output\YunBull\Bull140\Bull140U.pdb

Imports

minosagent

minos_agent_get_buildin_logdev
minos_agent_add_logdev
minos_agent_remove_logdev
minos_agent_global_cleanup
minos_agent_logdev_init
minos_agent_logdev_setopt
minos_agent_logdev_cleanup
minos_agent_log
minos_agent_random_logid
minos_agent_global_init

ws2_32

select
WSAGetLastError
closesocket
socket
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
shutdown
accept
htonl
listen
getaddrinfo
freeaddrinfo
ioctlsocket
gethostname
getnameinfo
send

kernel32

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
EncodePointer
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
lstrcmpiW
FindResourceW
MultiByteToWideChar
LoadLibraryW
DeleteFileW
WriteFile
Sleep
GetTickCount
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
WideCharToMultiByte
SetLastError
GetCurrentThreadId
GetSystemTime
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
SetThreadPriority
WaitForMultipleObjects
CreateToolhelp32Snapshot
FlushInstructionCache
Process32NextW
Module32FirstW
Module32NextW
VerSetConditionMask
GetCommandLineW
VerifyVersionInfoW
CreateFileW
GetFileInformationByHandle
GetLogicalDrives
GetVolumeInformationW
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
TerminateThread
GetExitCodeThread
OpenProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
ReadFile
SetEndOfFile
SetFilePointerEx
SetFileTime
GetLocalTime
GetPrivateProfileIntW
GetPrivateProfileStringW
ReadDirectoryChangesW
GetStdHandle
ExpandEnvironmentStringsW
FlushFileBuffers
SetFilePointer
OutputDebugStringW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FreeConsole
AllocConsole
WriteConsoleW
GetFileSize
SetConsoleScreenBufferSize
SetConsoleCtrlHandler
GetTempFileNameW
GetTempPathW
VirtualProtect
WriteProcessMemory
QueueUserWorkItem
InitializeCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
QueryPerformanceCounter
ExpandEnvironmentStringsA
FormatMessageA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
VirtualAlloc
TlsSetValue
TlsFree
GetModuleHandleExW
FormatMessageW
GetFileType
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
VirtualFree
LoadLibraryExA
Process32FirstW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
TlsGetValue

user32

DestroyWindow
IsWindow
GetWindowLongW
SetWindowLongW
LoadCursorW
ShowWindow
CharLowerBuffW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
KillTimer
GetProcessWindowStation
GetUserObjectInformationW
SetTimer
PostMessageW
CharNextW
UnregisterClassW
MessageBoxW
CreateWindowExW

gdi32

GetStockObject

advapi32

CryptReleaseContext
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptCreateHash
CryptDestroyHash
CryptEnumProvidersW
CryptSignHashW
RegCloseKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CryptDecrypt

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
CoLoadLibrary
StgCreateStorageEx
StgOpenStorageEx
CoCreateGuid
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysStringByteLen
SysAllocStringByteLen
VariantClear
VariantCopy
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarCmp
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SysAllocStringLen
SysAllocString
SysFreeString
VarBstrCmp
VariantInit

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

dbghelp

MiniDumpWriteDump

wininet

InternetSetStatusCallbackW
HttpQueryInfoA
HttpEndRequestW
InternetOpenA
InternetCloseHandle
InternetConnectW
InternetReadFileExA
InternetWriteFile
InternetQueryOptionA
InternetSetOptionA
InternetSetOptionW
HttpSendRequestExA
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW

winmm

timeKillEvent
timeSetEvent

rpcrt4

UuidToStringW
UuidFromStringA
RpcStringFreeW
UuidFromStringW

bcrypt

BCryptGenRandom

vcruntime140

memchr
__RTDynamicCast
wcsrchr
wcschr
memset
memcpy
wcsstr
memmove
_purecall
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__std_type_info_destroy_list
strchr
strstr
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_exception_copy
strrchr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

realloc
calloc
free
_callnewh
malloc
_recalloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_execute_onexit_table
_register_onexit_function
_crt_atexit
strerror
_initialize_onexit_table
_initialize_narrow_environment
__sys_nerr
_configure_narrow_argv
raise
_cexit
signal
strerror_s
_initterm_e
_seh_filter_dll
_errno
_invalid_parameter_noinfo_noreturn
_initterm
_invalid_parameter_noinfo
_exit
terminate

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
wcstombs
strtoul
strtol
_wtof
atol
_wtoi
_wtoi64

api-ms-win-crt-string-l1-1-0

_strdup
strcmp
_stricmp
_strnicmp
wcsncpy_s
strspn
strcspn
wcsnlen
wmemcpy_s
strncpy
tolower
_wcsicmp
_wcsdup
strnlen
iswdigit
strcpy_s
wcspbrk
wcsspn
wcscspn
isspace
iswspace
_wcslwr_s
strncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf_s
_wfreopen_s
__acrt_iob_func
fseek
fputs
fopen
__stdio_common_vsnwprintf_s
_close
__stdio_common_vsscanf
ftell
feof
_read
_write
__stdio_common_vfprintf
fgets
_wopen
fflush
fputc
_lseeki64
_chsize_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fwrite
_ftelli64
_fseeki64
ferror
_setmode
clearerr
setbuf
_fileno
fclose
_wfopen_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
_wfopen
__stdio_common_vswprintf
_open
fread
setvbuf

api-ms-win-crt-time-l1-1-0

_mktime64
_gmtime64_s
_localtime64_s
wcsftime
_time64
_gmtime64

api-ms-win-crt-locale-l1-1-0

_wsetlocale

api-ms-win-crt-filesystem-l1-1-0

_waccess_s
_wstat32
_fstat64i32
_stat64i32
_wmakepath_s
_stat64
_access
_wsplitpath_s

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbscmp
_ismbcspace
_mbsicmp
_mbslwr_s
_mbsstr

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_except1

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore

Exports

Exports

??0CGeneralArrayWrapper@BULL@@QAE@PAUIGeneralArray@1@@Z
??0CGeneralArrayWrapper@BULL@@QAE@_N@Z
??0CGeneralBufferWrapper@BULL@@QAE@PAUIGeneralBuffer@1@@Z
??0CGeneralBufferWrapper@BULL@@QAE@_N@Z
??0CGeneralDataWrapper@BULL@@QAE@PAUIGeneralData@1@@Z
??0CGeneralDataWrapper@BULL@@QAE@_N@Z
??0CXMLFSWrapper@BULL@@QAE@PAUIXMLFS@1@@Z
??0CXMLFSWrapper@BULL@@QAE@_N@Z
??1CGeneralArrayWrapper@BULL@@UAE@XZ
??1CGeneralBufferWrapper@BULL@@UAE@XZ
??1CGeneralDataWrapper@BULL@@UAE@XZ
??1CXMLFSWrapper@BULL@@UAE@XZ
??4CGeneralArrayWrapper@BULL@@QAEAAV01@PAUIGeneralArray@1@@Z
??4CGeneralBufferWrapper@BULL@@QAEAAV01@PAUIGeneralBuffer@1@@Z
??4CGeneralDataWrapper@BULL@@QAEAAV01@PAUIGeneralData@1@@Z
??8CGeneralArrayWrapper@BULL@@QAE_NPAUIGeneralArray@1@@Z
??8CGeneralBufferWrapper@BULL@@QAE_NPAUIGeneralBuffer@1@@Z
??8CGeneralDataWrapper@BULL@@QAE_NPAUIGeneralData@1@@Z
??9CGeneralArrayWrapper@BULL@@QAE_NPAUIGeneralArray@1@@Z
??9CGeneralBufferWrapper@BULL@@QAE_NPAUIGeneralBuffer@1@@Z
??9CGeneralDataWrapper@BULL@@QAE_NPAUIGeneralData@1@@Z
??YCGeneralBufferWrapper@BULL@@QAEAAV01@PAUIGeneralBuffer@1@@Z
??_FCGeneralArrayWrapper@BULL@@QAEXXZ
??_FCGeneralBufferWrapper@BULL@@QAEXXZ
??_FCGeneralDataWrapper@BULL@@QAEXXZ
??_FCXMLFSWrapper@BULL@@QAEXXZ
?Add@CGeneralArrayWrapper@BULL@@QAEXC@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXD@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXE@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXF@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXG@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXH@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXI@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXJ@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXK@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXM@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXN@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralArray@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralData@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIUnknown@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXU_GUID@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXU_SYSTEMTIME@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagPOINT@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagRECT@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagSIZE@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_J@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_K@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_N@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_W@Z
?Append@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?AppendNode@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z
?Assign@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralArray@2@@Z
?Assign@CGeneralBufferWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?Assign@CGeneralDataWrapper@BULL@@QAEXPAUIGeneralData@2@@Z
?Attach@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?AttribEnumNext@CXMLFSWrapper@BULL@@QAEXXZ
?AttribEnumRelease@CXMLFSWrapper@BULL@@QAEXXZ
?AttribEnumReset@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?Base64Decode_s@BULL@@YA?AVCGeneralBufferWrapper@1@PB_W@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?Base64Encode_s@BULL@@YAPB_WPAUIGeneralBuffer@1@K@Z
?Clear@CGeneralArrayWrapper@BULL@@QAEXXZ
?Clear@CGeneralBufferWrapper@BULL@@QAEXXZ
?Clear@CGeneralDataWrapper@BULL@@QAEXXZ
?ClearAllBookmarks@CXMLFSWrapper@BULL@@QAEXXZ
?Compare@CGeneralBufferWrapper@BULL@@QAE_NPAEK@Z
?CompareByPY@BULL@@YAJPA_W0PAH@Z
?CopyFrom@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?CreateBookmark@CXMLFSWrapper@BULL@@QAEKXZ
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?CreateObjectDebug@BULL@@YAJABU_GUID@@0PAPAX@Z
?CreateObjectFromDLL@BULL@@YAJABU_GUID@@0PA_WPAPAX@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z
?Detach@CGeneralBufferWrapper@BULL@@QAEPAEXZ
?DisableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?Dump@CGeneralArrayWrapper@BULL@@QAEPB_WXZ
?Dump@CGeneralDataWrapper@BULL@@QAEPB_WXZ
?DumpRefLeak@BULL@@YAJXZ
?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?FieldExists@CGeneralDataWrapper@BULL@@QAE_NPB_W@Z
?FindChild@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FindNextSibling@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FindPrevSibling@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FlushLogFile@BULL@@YAJXZ
?ForEach@CXMLFSWrapper@BULL@@QAEXPB_WPAUIXMLFSJob@2@@Z
?FromDoc@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?FromDoc@CGeneralDataWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?FromFile@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?FromFile@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?FromXml@CGeneralArrayWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?FromXml@CGeneralDataWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W00PA_N@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAF@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAG@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAH@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAI@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAJ@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAK@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAM@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAN@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAU_GUID@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagPOINT@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagRECT@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagSIZE@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_J@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_K@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_N@Z
?GetArray@CGeneralArrayWrapper@BULL@@QAE?AV12@I@Z
?GetArray@CGeneralDataWrapper@BULL@@QAE?AVCGeneralArrayWrapper@2@PB_W@Z
?GetArray@CGeneralDataWrapper@BULL@@QAE?AVCGeneralArrayWrapper@2@PB_WPAUIGeneralArray@2@@Z
?GetAttrib@CXMLFSWrapper@BULL@@QAEPB_WPB_W0@Z
?GetAttribAsBoolNumber@CXMLFSWrapper@BULL@@QAE_NPB_W0@Z
?GetAttribAsBoolString@CXMLFSWrapper@BULL@@QAE_NPB_W00@Z
?GetAttribAsDWord@CXMLFSWrapper@BULL@@QAEKPB_W0@Z
?GetAttribAsDouble@CXMLFSWrapper@BULL@@QAENPB_W0@Z
?GetAttribAsFloat@CXMLFSWrapper@BULL@@QAEMPB_W0@Z
?GetAttribAsGuid@CXMLFSWrapper@BULL@@QAE?AU_GUID@@PB_W0@Z
?GetAttribAsInt64@CXMLFSWrapper@BULL@@QAE_JPB_W0@Z
?GetAttribAsInt@CXMLFSWrapper@BULL@@QAEHPB_W0@Z
?GetAttribAsLong@CXMLFSWrapper@BULL@@QAEJPB_W0@Z
?GetAttribAsPoint@CXMLFSWrapper@BULL@@QAE?AUtagPOINT@@PB_W0@Z
?GetAttribAsRect@CXMLFSWrapper@BULL@@QAE?AUtagRECT@@PB_W0@Z
?GetAttribAsShort@CXMLFSWrapper@BULL@@QAEFPB_W0@Z
?GetAttribAsSize@CXMLFSWrapper@BULL@@QAE?AUtagSIZE@@PB_W0@Z
?GetAttribAsUint64@CXMLFSWrapper@BULL@@QAE_KPB_W0@Z
?GetAttribAsUint@CXMLFSWrapper@BULL@@QAEIPB_W0@Z
?GetAttribAsUlong@CXMLFSWrapper@BULL@@QAEKPB_W0@Z
?GetAttribAsUshort@CXMLFSWrapper@BULL@@QAEGPB_W0@Z
?GetAttribAsWord@CXMLFSWrapper@BULL@@QAEGPB_W0@Z
?GetAttribList@CXMLFSWrapper@BULL@@QAEPAUIGeneralData@2@PB_W@Z
?GetAttribName@CXMLFSWrapper@BULL@@QAEPB_WXZ
?GetBool@CGeneralArrayWrapper@BULL@@QAE_NI@Z
?GetBool@CGeneralDataWrapper@BULL@@QAE_NPB_W@Z
?GetBool@CGeneralDataWrapper@BULL@@QAE_NPB_W_N@Z
?GetBuffer@CGeneralArrayWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@I@Z
?GetBuffer@CGeneralBufferWrapper@BULL@@QAEPAEXZ
?GetBuffer@CGeneralDataWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@PB_W@Z
?GetBuffer@CGeneralDataWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@PB_WPAUIGeneralBuffer@2@@Z
?GetByte@CGeneralArrayWrapper@BULL@@QAEEI@Z
?GetByte@CGeneralDataWrapper@BULL@@QAEEPB_W@Z
?GetByte@CGeneralDataWrapper@BULL@@QAEEPB_WE@Z
?GetChar@CGeneralArrayWrapper@BULL@@QAECI@Z
?GetChar@CGeneralDataWrapper@BULL@@QAECPB_W@Z
?GetChar@CGeneralDataWrapper@BULL@@QAECPB_WC@Z
?GetChildrenCount@CXMLFSWrapper@BULL@@QAEJPB_W@Z
?GetCount@CGeneralArrayWrapper@BULL@@QAEIXZ
?GetDWord@CGeneralArrayWrapper@BULL@@QAEKI@Z
?GetDWord@CGeneralDataWrapper@BULL@@QAEKPB_W@Z
?GetDWord@CGeneralDataWrapper@BULL@@QAEKPB_WK@Z
?GetData@CGeneralArrayWrapper@BULL@@QAE?AVCGeneralDataWrapper@2@I@Z
?GetData@CGeneralDataWrapper@BULL@@QAE?AV12@PB_W@Z
?GetData@CGeneralDataWrapper@BULL@@QAE?AV12@PB_WPAUIGeneralData@2@@Z
?GetData@CXMLFSWrapper@BULL@@QAEPB_WPB_W@Z
?GetDouble@CGeneralArrayWrapper@BULL@@QAENI@Z
?GetDouble@CGeneralDataWrapper@BULL@@QAENPB_W@Z
?GetDouble@CGeneralDataWrapper@BULL@@QAENPB_WN@Z
?GetFieldCount@CGeneralDataWrapper@BULL@@QAEIXZ
?GetFieldIndex@CGeneralDataWrapper@BULL@@QAEIPB_W@Z
?GetFieldName@CGeneralDataWrapper@BULL@@QAEPB_WI@Z
?GetFieldType@CGeneralDataWrapper@BULL@@QAE?AW4EGeneralDataType@2@PB_W@Z
?GetFieldValue@CGeneralDataWrapper@BULL@@QAE?AUtagVARIANT@@PB_W@Z
?GetFloat@CGeneralArrayWrapper@BULL@@QAEMI@Z
?GetFloat@CGeneralDataWrapper@BULL@@QAEMPB_W@Z
?GetFloat@CGeneralDataWrapper@BULL@@QAEMPB_WM@Z
?GetGuid@CGeneralArrayWrapper@BULL@@QAE?AU_GUID@@I@Z
?GetGuid@CGeneralDataWrapper@BULL@@QAE?AU_GUID@@PB_W@Z
?GetGuid@CGeneralDataWrapper@BULL@@QAE?AU_GUID@@PB_WU3@@Z
?GetINode@CXMLFSWrapper@BULL@@QAEPAUIXMLDOMNode@@XZ
?GetInt64@CGeneralArrayWrapper@BULL@@QAE_JI@Z
?GetInt64@CGeneralDataWrapper@BULL@@QAE_JPB_W@Z
?GetInt64@CGeneralDataWrapper@BULL@@QAE_JPB_W_J@Z
?GetInt@CGeneralArrayWrapper@BULL@@QAEHI@Z
?GetInt@CGeneralDataWrapper@BULL@@QAEHPB_W@Z
?GetInt@CGeneralDataWrapper@BULL@@QAEHPB_WH@Z
?GetLength@CGeneralBufferWrapper@BULL@@QAEKXZ
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?GetLong@CGeneralArrayWrapper@BULL@@QAEJI@Z
?GetLong@CGeneralDataWrapper@BULL@@QAEJPB_W@Z
?GetLong@CGeneralDataWrapper@BULL@@QAEJPB_WJ@Z
?GetModuleDesc@BULL@@YAJPA_W0PAPA_W@Z
?GetModuleName@BULL@@YAJPAUHINSTANCE__@@PAPA_W@Z
?GetModulePath@BULL@@YAJPAUHINSTANCE__@@PAPA_W@Z
?GetModuleVer@BULL@@YAJPAUHINSTANCE__@@PAPA_W1@Z
?GetModuleVer@BULL@@YAJPAUHINSTANCE__@@PA_K1@Z
?GetModuleVer@BULL@@YAJPA_WPAPA_W1@Z
?GetModuleVer@BULL@@YAJPA_WPA_K1@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?GetNodeName@CXMLFSWrapper@BULL@@QAEPB_WXZ
?GetPoint@CGeneralArrayWrapper@BULL@@QAE?AUtagPOINT@@I@Z
?GetPoint@CGeneralDataWrapper@BULL@@QAE?AUtagPOINT@@PB_W@Z
?GetPoint@CGeneralDataWrapper@BULL@@QAE?AUtagPOINT@@PB_WU3@@Z
?GetRect@CGeneralArrayWrapper@BULL@@QAE?AUtagRECT@@I@Z
?GetRect@CGeneralDataWrapper@BULL@@QAE?AUtagRECT@@PB_W@Z
?GetRect@CGeneralDataWrapper@BULL@@QAE?AUtagRECT@@PB_WU3@@Z
?GetShort@CGeneralArrayWrapper@BULL@@QAEFI@Z
?GetShort@CGeneralDataWrapper@BULL@@QAEFPB_W@Z
?GetShort@CGeneralDataWrapper@BULL@@QAEFPB_WF@Z
?GetSize@CGeneralArrayWrapper@BULL@@QAE?AUtagSIZE@@I@Z
?GetSize@CGeneralDataWrapper@BULL@@QAE?AUtagSIZE@@PB_W@Z
?GetSize@CGeneralDataWrapper@BULL@@QAE?AUtagSIZE@@PB_WU3@@Z
?GetStr@CGeneralArrayWrapper@BULL@@QAEPB_WI@Z
?GetStr@CGeneralDataWrapper@BULL@@QAEPB_WPB_W0@Z
?GetStr@CGeneralDataWrapper@BULL@@QAEPB_WPB_W@Z
?GetTime@CGeneralArrayWrapper@BULL@@QAE?AU_SYSTEMTIME@@I@Z
?GetTime@CGeneralDataWrapper@BULL@@QAE?AU_SYSTEMTIME@@PB_W@Z
?GetTime@CGeneralDataWrapper@BULL@@QAE?AU_SYSTEMTIME@@PB_WU3@@Z
?GetType@CGeneralArrayWrapper@BULL@@QAE?AW4EGeneralDataType@2@I@Z
?GetUint64@CGeneralArrayWrapper@BULL@@QAE_KI@Z
?GetUint64@CGeneralDataWrapper@BULL@@QAE_KPB_W@Z
?GetUint64@CGeneralDataWrapper@BULL@@QAE_KPB_W_K@Z
?GetUint@CGeneralArrayWrapper@BULL@@QAEII@Z
?GetUint@CGeneralDataWrapper@BULL@@QAEIPB_W@Z
?GetUint@CGeneralDataWrapper@BULL@@QAEIPB_WI@Z
?GetValue@CGeneralArrayWrapper@BULL@@QAE?AUtagVARIANT@@I@Z
?GetWChar@CGeneralArrayWrapper@BULL@@QAE_WI@Z
?GetWChar@CGeneralDataWrapper@BULL@@QAE_WPB_W@Z
?GetWChar@CGeneralDataWrapper@BULL@@QAE_WPB_W_W@Z
?GetWord@CGeneralArrayWrapper@BULL@@QAEGI@Z
?GetWord@CGeneralDataWrapper@BULL@@QAEGPB_W@Z
?GetWord@CGeneralDataWrapper@BULL@@QAEGPB_WG@Z
?Go@CXMLFSWrapper@BULL@@QAEXK@Z
?GoByPath@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?GuidToString@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@ABU_GUID@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIC@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXID@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIE@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIF@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIG@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIH@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXII@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIJ@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIK@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIM@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIN@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralArray@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralBuffer@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralData@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIUnknown@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPB_W@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIU_GUID@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIU_SYSTEMTIME@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagPOINT@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagRECT@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagSIZE@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_J@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_K@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_N@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_W@Z
?InsertNode@CXMLFSWrapper@BULL@@QAEXPB_W00@Z
?KillTimer@BULL@@YAJK@Z
?KillTimer_s@BULL@@YAXK@Z
?LoadFromBSTR@CXMLFSWrapper@BULL@@QAEXPA_WPB_W@Z
?LoadFromFile@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?LoadModuleInfo@BULL@@YAJPB_W@Z
?LoadStringTable@BULL@@YAJPA_WH@Z
?LoadStringW@BULL@@YAPB_WH@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?MD5@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?MD5_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@@Z
?MD5_s@BULL@@YA?AVCGeneralBufferWrapper@1@PB_W@Z
?MatchByPY@BULL@@YAJPA_W0PAH@Z
?MonitorRefLeak@BULL@@YAJPAXABU_GUID@@PB_W@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?MultiByteToWideChar@BULL@@YAJIPBDPAPA_W@Z
?ParseCmdline@BULL@@YAJPAPAUIGeneralArray@1@PA_W@Z
?PrivateLog@BULL@@YAJW4TPrivateLogCmd@1@PB_W1ZZ
?QueryObjectClsid@BULL@@YAJABU_GUID@@PAU2@@Z
?RC4@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RC4Decrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Decrypt_s@BULL@@YAPB_WPB_W0@Z
?RC4Encrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Encrypt_s@BULL@@YAPB_WPB_W0@Z
?RC4_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RSADecrypt@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RSADecrypt_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RSAEncrypt@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RSAEncrypt_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?RegisterObject@BULL@@YAJABU_GUID@@0PB_W1@Z
?ReleaseBookmark@CXMLFSWrapper@BULL@@QAEXK@Z
?Remove@CGeneralArrayWrapper@BULL@@QAEXI@Z
?RemoveAttrib@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?RemoveField@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?RemoveNode@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?Resize@CGeneralBufferWrapper@BULL@@QAEPAEK@Z
?SaveToBSTR@CXMLFSWrapper@BULL@@QAEPB_WPB_W@Z
?SaveToFile@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W0@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WC@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WD@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WE@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WF@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WG@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WH@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WI@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WJ@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WK@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WM@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WN@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralArray@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralBuffer@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralData@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIUnknown@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WU_GUID@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WU_SYSTEMTIME@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagPOINT@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagRECT@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagSIZE@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_J@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_K@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_N@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_W@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W00_N0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WABU_GUID@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WF0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WI0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WJ0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WM0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WN0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagPOINT@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagRECT@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagSIZE@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_J0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_K0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_N0@Z
?SetAttrib@CXMLFSWrapper@BULL@@QAEXPB_W00@Z
?SetAttribBoolNumber@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?SetAttribBoolString@CXMLFSWrapper@BULL@@QAEXPB_W00H0@Z
?SetAttribDWord@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?SetAttribDouble@CXMLFSWrapper@BULL@@QAEXPB_WN0@Z
?SetAttribFloat@CXMLFSWrapper@BULL@@QAEXPB_WM0@Z
?SetAttribGuid@CXMLFSWrapper@BULL@@QAEXPB_WABU_GUID@@0@Z
?SetAttribInt64@CXMLFSWrapper@BULL@@QAEXPB_W_J0@Z
?SetAttribInt@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?SetAttribLong@CXMLFSWrapper@BULL@@QAEXPB_WJ0@Z
?SetAttribPoint@CXMLFSWrapper@BULL@@QAEXPB_WUtagPOINT@@0@Z
?SetAttribRect@CXMLFSWrapper@BULL@@QAEXPB_WUtagRECT@@0@Z
?SetAttribShort@CXMLFSWrapper@BULL@@QAEXPB_WF0@Z
?SetAttribSize@CXMLFSWrapper@BULL@@QAEXPB_WUtagSIZE@@0@Z
?SetAttribUint64@CXMLFSWrapper@BULL@@QAEXPB_W_K0@Z
?SetAttribUint@CXMLFSWrapper@BULL@@QAEXPB_WI0@Z
?SetAttribUlong@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?SetAttribUshort@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?SetAttribWord@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?SetData@CXMLFSWrapper@BULL@@QAEXPA_WPB_W@Z
?SetDefaultLangId@BULL@@YAJH@Z
?SetINode@CXMLFSWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?SetLogFile@BULL@@YAJPB_W@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?SetTimer_s@BULL@@YAIK_NPAUICallbackTimer@1@K@Z
?Sign@BULL@@YAJPA_WPAUIGeneralArray@1@0PAUIGeneralBuffer@1@@Z
?Sign@BULL@@YAJPA_WPAUIGeneralBuffer@1@PAPA_W@Z
?Sign_s@BULL@@YAPB_WPB_WPAUIGeneralBuffer@1@@Z
?Sign_s@BULL@@YAXPB_WPAUIGeneralArray@1@0PAUIGeneralBuffer@1@@Z
?StringToGuidA@BULL@@YA?AU_GUID@@PBD@Z
?StringToGuidW@BULL@@YA?AU_GUID@@PB_W@Z
?StringToUuidA@BULL@@YA?AU_GUID@@PAD@Z
?StringToUuidW@BULL@@YA?AU_GUID@@PA_W@Z
?ToDoc@CGeneralArrayWrapper@BULL@@QAEPAUIGeneralBuffer@2@XZ
?ToDoc@CGeneralDataWrapper@BULL@@QAEPAUIGeneralBuffer@2@XZ
?ToFile@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?ToFile@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?ToXml@CGeneralArrayWrapper@BULL@@QAEPAUIXMLDOMNode@@PAUIXMLDOMDocument@@PAU3@@Z
?ToXml@CGeneralDataWrapper@BULL@@QAEPAUIXMLDOMNode@@PAUIXMLDOMDocument@@PAU3@@Z
?TranformToPY@BULL@@YAJPA_WPAPA_W@Z
?TransFromString@CGeneralBufferWrapper@BULL@@QAEXPB_W@Z
?TransToString@CGeneralBufferWrapper@BULL@@QAEPB_WXZ
?UuidToStringW@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@AAU_GUID@@@Z
?VerifyIEVer@BULL@@YAJEK@Z
?VerifySign@BULL@@YAJPA_WPAUIGeneralBuffer@1@0PAH@Z
?VerifySign@BULL@@YAJPA_WPAUIGeneralBuffer@1@PAH@Z
?VerifySign_s@BULL@@YA_NPB_WPAUIGeneralBuffer@1@0@Z
?VerifySign_s@BULL@@YA_NPB_WPAUIGeneralBuffer@1@@Z
?VerifyWinVer@BULL@@YAJEKKGG@Z
?VersionDecode@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?VersionDecode_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?WideCharToMultiByte@BULL@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@IPB_W@Z
?WideCharToMultiByte@BULL@@YAJIPB_WPAPAUIGeneralBuffer@1@@Z
?XLog@BULL@@YAJKKPB_WZZ
?XLogMonitor@BULL@@YAJ_KPB_W11111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11@Z
?XLogMonitor@BULL@@YAJ_KPB_W1@Z
?XLogMonitor@BULL@@YAJ_KPB_W@Z
?XLogMultiline@BULL@@YAJKKPB_WZZ
?XLogTagMultiline@BULL@@YAJKKPB_W0ZZ
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?XLogWithTag@BULL@@YAJKKPB_W0ZZ
?_atoui64@@YA_KPBD@Z
?_atoui@@YAIPBD@Z
?_wtoui64@@YA_KPB_W@Z
?_wtoui@@YAIPB_W@Z
?tgz@BULL@@YAJPB_WPAUIGeneralArray@1@@Z
?untgz@BULL@@YAJPB_W0PAPAUIGeneralArray@1@1@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_resolver_handles
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 732KB - Virtual size: 732KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 596KB - Virtual size: 595KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a5c34b0723b481d1608f2f8a32a2dd62

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

23:5d:12:ae:24:4e:ed:bd:06:99:bf:e1:b5:a9:df:c6:14:1d:27:3a:97:62:2c:21:5e:20:89:ea:bf:a8:f5:b6Signer

cc:d5:f8:d0:d8:ea:de:94:ba:fe:8c:5d:c2:d5:87:7c:ca:72:46:10Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

minosagent

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

dbghelp

wininet

winmm

rpcrt4

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

crypt32

Exports

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

09:c5:cc:f8:bb:66:7d:71:37:aa:c1:59:80:06:cb:31
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

23:5d:12:ae:24:4e:ed:bd:06:99:bf:e1:b5:a9:df:c6:14:1d:27:3a:97:62:2c:21:5e:20:89:ea:bf:a8:f5:b6
Signer

cc:d5:f8:d0:d8:ea:de:94:ba:fe:8c:5d:c2:d5:87:7c:ca:72:46:10
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 732KB - Virtual size: 732KB

.data
Size: 35KB - Virtual size: 115KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.vmp0
Size: 596KB - Virtual size: 595KB

.reloc
Size: 95KB - Virtual size: 95KB

.rsrc
Size: 1024B - Virtual size: 920B