framedynos.pdb
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
framedynos.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
framedynos.dll
-
Size
261KB
-
MD5
c74c7f61d15d3a529cc61b13489f9f04
-
SHA1
b7ea683cf757ad440a6154a53b262f92f22c503b
-
SHA256
1a9164b1dd2783e99f00aeabdb357b30eab76364ea7e1836d7c59d899ca9362f
-
SHA512
60422b788d467ac1d1c552ef79076dd61bb9fb79fec226e9a2489ca64775492e5c2522fe83aedb9fdf881f28d917bbe78a204c1b4a3df926a481935a3c4edad3
-
SSDEEP
6144:Ic7KKUoKvD6gYijOkODwnIkVgap3kKJhNoycMNwk5s5DcnPke7:32/6gY4OdoWaJkShHw+KePke
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource framedynos.dll
Files
-
framedynos.dll.dll windows:10 windows x86 arch:x86
354c76a9723cf659bfacb419efa20fc4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
_vsnprintf
iswspace
_vsnwprintf
wcschr
_wtoi
_wcstoui64
_wtol
_ui64tow_s
_i64tow_s
memcmp
malloc
_except_handler4_common
_onexit
_wcsupr
_wrename
_wunlink
atol
_XcptFilter
sscanf_s
swscanf
swscanf_s
free
memmove_s
__CxxFrameHandler3
_vsnprintf_s
memcpy_s
__dllonexit
wcscspn
??0exception@@QAE@XZ
_wcsrev
_unlock
memmove
_wcslwr
wcsstr
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
wcsrchr
wcspbrk
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
memcpy
_CxxThrowException
iswdigit
_lock
_wtoi64
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_initterm
wcscoll
wcsspn
_purecall
_wcsicmp
_amsg_exit
memset
api-ms-win-core-synch-l1-1-0
SetEvent
WaitForSingleObject
ReleaseMutex
LeaveCriticalSection
OpenMutexW
AcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSection
CreateSemaphoreExW
ReleaseSRWLockExclusive
AcquireSRWLockShared
CreateEventW
CreateMutexExW
EnterCriticalSection
OpenSemaphoreW
InitializeCriticalSectionEx
ReleaseSRWLockShared
CreateMutexW
WaitForSingleObjectEx
ReleaseSemaphore
api-ms-win-core-processthreads-l1-1-0
TerminateProcess
GetCurrentThreadId
CreateThread
GetCurrentThread
GetCurrentProcess
OpenProcessToken
GetCurrentProcessId
OpenThreadToken
ExitProcess
api-ms-win-security-base-l1-1-0
InitializeAcl
AddAccessAllowedAceEx
ImpersonateSelf
GetLengthSid
GetTokenInformation
ImpersonateLoggedOnUser
RevertToSelf
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetLastError
RaiseException
GetLastError
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetVersionExA
GetLocalTime
GetSystemTimeAsFileTime
GetVersionExW
GetTickCount64
GetComputerNameExW
api-ms-win-core-file-l1-1-0
WriteFile
CompareFileTime
CreateFileW
GetFileSizeEx
FileTimeToLocalFileTime
SetFilePointer
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-com-l1-1-0
StringFromGUID2
CoCreateInstance
CoLockObjectExternal
CoGetCallContext
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
GetModuleHandleW
LoadLibraryExA
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA
api-ms-win-core-processenvironment-l1-1-0
ExpandEnvironmentStringsW
sspicli
GetUserNameExW
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-heap-l1-1-0
HeapFree
HeapReAlloc
HeapAlloc
GetProcessHeap
api-ms-win-core-console-l1-1-0
SetConsoleCtrlHandler
api-ms-win-core-heap-l2-1-0
LocalFree
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-localization-l1-2-0
FormatMessageW
LCMapStringW
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
DebugBreak
OutputDebugStringW
api-ms-win-core-threadpool-l1-2-0
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
api-ms-win-core-timezone-l1-1-0
SystemTimeToFileTime
GetTimeZoneInformation
FileTimeToSystemTime
api-ms-win-core-registry-l1-1-0
RegOpenCurrentUser
RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteKeyExW
RegQueryValueExW
RegDeleteValueW
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Exports
Exports
??0CAutoEvent@@QAE@XZ
??0CFrameworkQuery@@QAE@ABV0@@Z
??0CFrameworkQuery@@QAE@XZ
??0CFrameworkQueryEx@@QAE@ABV0@@Z
??0CFrameworkQueryEx@@QAE@XZ
??0CHPtrArray@@QAE@XZ
??0CHString@@QAE@ABV0@@Z
??0CHString@@QAE@GH@Z
??0CHString@@QAE@PBD@Z
??0CHString@@QAE@PBE@Z
??0CHString@@QAE@PBG@Z
??0CHString@@QAE@PBGH@Z
??0CHString@@QAE@XZ
??0CHStringArray@@QAE@XZ
??0CInstance@@QAE@ABV0@@Z
??0CInstance@@QAE@PAUIWbemClassObject@@PAVMethodContext@@@Z
??0CObjectPathParser@@QAE@W4ObjectParserFlags@@@Z
??0CRegistry@@QAE@ABV0@@Z
??0CRegistry@@QAE@XZ
??0CRegistrySearch@@QAE@ABV0@@Z
??0CRegistrySearch@@QAE@XZ
??0CThreadBase@@QAE@ABV0@@Z
??0CThreadBase@@QAE@W4THREAD_SAFETY_MECHANISM@0@@Z
??0CWbemGlueFactory@@QAE@ABV0@@Z
??0CWbemGlueFactory@@QAE@PAJ@Z
??0CWbemGlueFactory@@QAE@XZ
??0CWbemProviderGlue@@QAE@ABV0@@Z
??0CWbemProviderGlue@@QAE@PAJ@Z
??0CWbemProviderGlue@@QAE@XZ
??0CWinMsgEvent@@QAE@ABV0@@Z
??0CWinMsgEvent@@QAE@XZ
??0CreateMutexAsProcess@@QAE@PBG@Z
??0KeyRef@@QAE@PBGPBUtagVARIANT@@@Z
??0KeyRef@@QAE@XZ
??0MethodContext@@QAE@ABV0@@Z
??0MethodContext@@QAE@PAUIWbemContext@@PAVCWbemProviderGlue@@@Z
??0ParsedObjectPath@@QAE@XZ
??0Provider@@QAE@ABV0@@Z
??0Provider@@QAE@PBG0@Z
??0ProviderLog@@QAE@ABV0@@Z
??0ProviderLog@@QAE@XZ
??0WBEMTime@@QAE@ABJ@Z
??0WBEMTime@@QAE@ABU_FILETIME@@@Z
??0WBEMTime@@QAE@ABU_SYSTEMTIME@@@Z
??0WBEMTime@@QAE@ABUtm@@@Z
??0WBEMTime@@QAE@QAG@Z
??0WBEMTime@@QAE@XZ
??0WBEMTimeSpan@@QAE@ABJ@Z
??0WBEMTimeSpan@@QAE@ABU_FILETIME@@@Z
??0WBEMTimeSpan@@QAE@HHHHHHH@Z
??0WBEMTimeSpan@@QAE@QAG@Z
??0WBEMTimeSpan@@QAE@XZ
??1CAutoEvent@@QAE@XZ
??1CFrameworkQuery@@QAE@XZ
??1CFrameworkQueryEx@@QAE@XZ
??1CHPtrArray@@QAE@XZ
??1CHString@@QAE@XZ
??1CHStringArray@@QAE@XZ
??1CInstance@@UAE@XZ
??1CObjectPathParser@@QAE@XZ
??1CRegistry@@QAE@XZ
??1CRegistrySearch@@QAE@XZ
??1CThreadBase@@UAE@XZ
??1CWbemGlueFactory@@QAE@XZ
??1CWbemProviderGlue@@QAE@XZ
??1CWinMsgEvent@@QAE@XZ
??1CreateMutexAsProcess@@QAE@XZ
??1KeyRef@@QAE@XZ
??1MethodContext@@UAE@XZ
??1ParsedObjectPath@@QAE@XZ
??1Provider@@UAE@XZ
??1ProviderLog@@UAE@XZ
??4CAutoEvent@@QAEAAV0@ABV0@@Z
??4CFrameworkQuery@@QAEAAV0@ABV0@@Z
??4CFrameworkQueryEx@@QAEAAV0@ABV0@@Z
??4CHPtrArray@@QAEAAV0@ABV0@@Z
??4CHString@@QAEABV0@ABV0@@Z
??4CHString@@QAEABV0@D@Z
??4CHString@@QAEABV0@G@Z
??4CHString@@QAEABV0@PAV0@@Z
??4CHString@@QAEABV0@PBD@Z
??4CHString@@QAEABV0@PBE@Z
??4CHString@@QAEABV0@PBG@Z
??4CHStringArray@@QAEAAV0@ABV0@@Z
??4CInstance@@QAEAAV0@ABV0@@Z
??4CObjectPathParser@@QAEAAV0@ABV0@@Z
??4CRegistry@@QAEAAV0@ABV0@@Z
??4CRegistrySearch@@QAEAAV0@ABV0@@Z
??4CThreadBase@@QAEAAV0@ABV0@@Z
??4CWbemGlueFactory@@QAEAAV0@ABV0@@Z
??4CWbemProviderGlue@@QAEAAV0@ABV0@@Z
??4CWinMsgEvent@@QAEAAV0@ABV0@@Z
??4CreateMutexAsProcess@@QAEAAV0@ABV0@@Z
??4KeyRef@@QAEAAU0@ABU0@@Z
??4MethodContext@@QAEAAV0@ABV0@@Z
??4ParsedObjectPath@@QAEAAU0@ABU0@@Z
??4Provider@@QAEAAV0@ABV0@@Z
??4ProviderLog@@QAEAAV0@ABV0@@Z
??4WBEMTime@@QAEAAV0@$$QAV0@@Z
??4WBEMTime@@QAEAAV0@ABV0@@Z
??4WBEMTime@@QAEABV0@ABJ@Z
??4WBEMTime@@QAEABV0@ABU_FILETIME@@@Z
??4WBEMTime@@QAEABV0@ABU_SYSTEMTIME@@@Z
??4WBEMTime@@QAEABV0@ABUtm@@@Z
??4WBEMTime@@QAEABV0@QAG@Z
??4WBEMTimeSpan@@QAEAAV0@$$QAV0@@Z
??4WBEMTimeSpan@@QAEAAV0@ABV0@@Z
??4WBEMTimeSpan@@QAEABV0@ABJ@Z
??4WBEMTimeSpan@@QAEABV0@ABU_FILETIME@@@Z
??4WBEMTimeSpan@@QAEABV0@QAG@Z
??8WBEMTime@@QBEHABV0@@Z
??8WBEMTimeSpan@@QBEHABV0@@Z
??9WBEMTime@@QBEHABV0@@Z
??9WBEMTimeSpan@@QBEHABV0@@Z
??ACHPtrArray@@QAEAAPAXH@Z
??ACHPtrArray@@QBEPAXH@Z
??ACHString@@QBEGH@Z
??ACHStringArray@@QAEAAVCHString@@H@Z
??ACHStringArray@@QBE?AVCHString@@H@Z
??BCHString@@QBEPBGXZ
??GWBEMTime@@QAE?AVWBEMTimeSpan@@ABV0@@Z
??GWBEMTime@@QBE?AV0@ABVWBEMTimeSpan@@@Z
??GWBEMTimeSpan@@QBE?AV0@ABV0@@Z
??H@YG?AVCHString@@ABV0@0@Z
??H@YG?AVCHString@@ABV0@G@Z
??H@YG?AVCHString@@ABV0@PBG@Z
??H@YG?AVCHString@@GABV0@@Z
??H@YG?AVCHString@@PBGABV0@@Z
??HWBEMTime@@QBE?AV0@ABVWBEMTimeSpan@@@Z
??HWBEMTimeSpan@@QBE?AV0@ABV0@@Z
??MWBEMTime@@QBEHABV0@@Z
??MWBEMTimeSpan@@QBEHABV0@@Z
??NWBEMTime@@QBEHABV0@@Z
??NWBEMTimeSpan@@QBEHABV0@@Z
??OWBEMTime@@QBEHABV0@@Z
??OWBEMTimeSpan@@QBEHABV0@@Z
??PWBEMTime@@QBEHABV0@@Z
??PWBEMTimeSpan@@QBEHABV0@@Z
??YCHString@@QAEABV0@ABV0@@Z
??YCHString@@QAEABV0@D@Z
??YCHString@@QAEABV0@G@Z
??YCHString@@QAEABV0@PBG@Z
??YWBEMTime@@QAEABV0@ABVWBEMTimeSpan@@@Z
??YWBEMTimeSpan@@QAEABV0@ABV0@@Z
??ZWBEMTime@@QAEABV0@ABVWBEMTimeSpan@@@Z
??ZWBEMTimeSpan@@QAEABV0@ABV0@@Z
??_7CFrameworkQueryEx@@6B@
??_7CInstance@@6B@
??_7CThreadBase@@6B@
??_7CWbemGlueFactory@@6B@
??_7CWbemProviderGlue@@6BIWbemProviderInit@@@
??_7CWbemProviderGlue@@6BIWbemServices@@@
??_7CWinMsgEvent@@6B@
??_7MethodContext@@6B@
??_7Provider@@6B@
??_7ProviderLog@@6B@
??_FCObjectPathParser@@QAEXXZ
??_FCThreadBase@@QAEXXZ
?Add@CHPtrArray@@QAEHPAX@Z
?Add@CHStringArray@@QAEHPBG@Z
?AddFlushPtr@CWbemProviderGlue@@AAEXPAX@Z
?AddKeyRef@ParsedObjectPath@@QAEHPAUKeyRef@@@Z
?AddKeyRef@ParsedObjectPath@@QAEHPBGPBUtagVARIANT@@@Z
?AddKeyRefEx@ParsedObjectPath@@QAEHPBGPBUtagVARIANT@@@Z
?AddNamespace@ParsedObjectPath@@QAEHPBG@Z
?AddProviderToMap@CWbemProviderGlue@@CGPAVProvider@@PBG0PAV2@@Z
?AddRef@CInstance@@QAEJXZ
?AddRef@CThreadBase@@QAEJXZ
?AddRef@CWbemGlueFactory@@UAGKXZ
?AddRef@CWbemProviderGlue@@UAGKXZ
?AddRef@MethodContext@@QAEJXZ
?AddToFactoryMap@CWbemProviderGlue@@KGXPBVCWbemGlueFactory@@PAJ@Z
?AllPropertiesAreRequired@CFrameworkQuery@@QAE_NXZ
?AllocBeforeWrite@CHString@@IAEXH@Z
?AllocBuffer@CHString@@IAEXH@Z
?AllocCopy@CHString@@IBEXAAV1@HHH@Z
?AllocSysString@CHString@@QBEPAGXZ
?Append@CHPtrArray@@QAEHABV1@@Z
?Append@CHStringArray@@QAEHABV1@@Z
?AssignCopy@CHString@@IAEXHPBG@Z
?BeginRead@CThreadBase@@QAEHK@Z
?BeginWrite@CThreadBase@@QAEHK@Z
?CancelAsyncCall@CWbemProviderGlue@@UAGJPAUIWbemObjectSink@@@Z
?CancelAsyncRequest@CWbemProviderGlue@@UAGJJ@Z
?CheckAndAddToList@CRegistrySearch@@AAEXPAVCRegistry@@VCHString@@1AAVCHPtrArray@@11H@Z
?CheckFileSize@ProviderLog@@AAEXAAT_LARGE_INTEGER@@ABVCHString@@@Z
?CheckImpersonationLevel@CWbemProviderGlue@@CGJXZ
?Clear@WBEMTime@@QAEXXZ
?Clear@WBEMTimeSpan@@QAEXXZ
?ClearKeys@ParsedObjectPath@@QAEXXZ
?Close@CRegistry@@QAEXXZ
?CloseSubKey@CRegistry@@AAEXXZ
?Collate@CHString@@QBEHPBG@Z
?Commit@CInstance@@QAEJXZ
?Commit@Provider@@IAEJPAVCInstance@@_N@Z
?Compare@CHString@@QBEHPBG@Z
?CompareNoCase@CHString@@QBEHPBG@Z
?ConcatCopy@CHString@@IAEXHPBGH0@Z
?ConcatInPlace@CHString@@IAEXHPBG@Z
?Copy@CHPtrArray@@QAEXABV1@@Z
?Copy@CHStringArray@@QAEXABV1@@Z
?CopyBeforeWrite@CHString@@IAEXXZ
?Create@CWbemGlueFactory@@SGPAV1@PAJ@Z
?Create@CWbemGlueFactory@@SGPAV1@XZ
?CreateClassEnum@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIEnumWbemClassObject@@@Z
?CreateClassEnumAsync@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?CreateInstance@CWbemGlueFactory@@UAGJPAUIUnknown@@ABU_GUID@@PAPAX@Z
?CreateInstanceEnum@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIEnumWbemClassObject@@@Z
?CreateInstanceEnum@Provider@@AAEJPAVMethodContext@@J@Z
?CreateInstanceEnumAsync@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?CreateMsgProvider@CWinMsgEvent@@CGXXZ
?CreateMsgWindow@CWinMsgEvent@@CGPAUHWND__@@XZ
?CreateNewInstance@Provider@@IAEPAVCInstance@@PAVMethodContext@@@Z
?CreateOpen@CRegistry@@QAEJPAUHKEY__@@PBGPAGKKPAU_SECURITY_ATTRIBUTES@@PAK@Z
?CtrlHandlerRoutine@CWinMsgEvent@@CGHK@Z
?DecrementMapCount@CWbemProviderGlue@@KGJPAJ@Z
?DecrementMapCount@CWbemProviderGlue@@KGJPBVCWbemGlueFactory@@@Z
?DecrementObjectCount@CWbemProviderGlue@@SGJXZ
?DeleteClass@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIWbemCallResult@@@Z
?DeleteClassAsync@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?DeleteCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBG@Z
?DeleteCurrentKeyValue@CRegistry@@QAEKPBG@Z
?DeleteInstance@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIWbemCallResult@@@Z
?DeleteInstance@Provider@@AAEJPAUParsedObjectPath@@JPAVMethodContext@@@Z
?DeleteInstance@Provider@@MAEJABVCInstance@@J@Z
?DeleteInstanceAsync@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?DeleteKey@CRegistry@@QAEJPAVCHString@@@Z
?DeleteValue@CRegistry@@QAEJPBG@Z
?Destroy@CWbemGlueFactory@@QAEXXZ
?DestroyMsgWindow@CWinMsgEvent@@CGXXZ
?ElementAt@CHPtrArray@@QAEAAPAXH@Z
?ElementAt@CHStringArray@@QAEAAVCHString@@H@Z
?Empty@CHString@@QAEXXZ
?Empty@CObjectPathParser@@AAEXXZ
?EndRead@CThreadBase@@QAEXXZ
?EndWrite@CThreadBase@@QAEXXZ
?EnumerateAndGetValues@CRegistry@@QAEJAAKAAPAGAAPAE@Z
?EnumerateInstances@Provider@@MAEJPAVMethodContext@@J@Z
?ExecMethod@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAUIWbemClassObject@@PAPAU3@PAPAUIWbemCallResult@@@Z
?ExecMethod@Provider@@AAEJPAUParsedObjectPath@@PAGJPAVCInstance@@2PAVMethodContext@@@Z
?ExecMethod@Provider@@MAEJABVCInstance@@QAGPAV2@2J@Z
?ExecMethodAsync@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAUIWbemClassObject@@PAUIWbemObjectSink@@@Z
?ExecNotificationQuery@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAPAUIEnumWbemClassObject@@@Z
?ExecNotificationQueryAsync@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?ExecQuery@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAPAUIEnumWbemClassObject@@@Z
?ExecQuery@Provider@@MAEJPAVMethodContext@@AAVCFrameworkQuery@@J@Z
?ExecQueryAsync@CWbemProviderGlue@@UAGJQAG0JPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?ExecuteQuery@Provider@@AAEJPAVMethodContext@@AAVCFrameworkQuery@@J@Z
?FillInstance@CWbemProviderGlue@@SGJPAVCInstance@@PBG@Z
?FillInstance@CWbemProviderGlue@@SGJPAVMethodContext@@PAVCInstance@@@Z
?Find@CHString@@QBEHG@Z
?Find@CHString@@QBEHPBG@Z
?FindOneOf@CHString@@QBEHPBG@Z
?Flush@Provider@@MAEXXZ
?FlushAll@CWbemProviderGlue@@AAEXXZ
?Format@CHString@@QAAXIZZ
?Format@CHString@@QAAXPBGZZ
?FormatMessageW@CHString@@QAAXIZZ
?FormatMessageW@CHString@@QAAXPBGZZ
?FormatV@CHString@@QAEXPBGPAD@Z
?FrameworkLogin@CWbemProviderGlue@@SGXPBGPAVProvider@@0@Z
?FrameworkLoginDLL@CWbemProviderGlue@@SGHPBG@Z
?FrameworkLoginDLL@CWbemProviderGlue@@SGHPBGPAJ@Z
?FrameworkLogoff@CWbemProviderGlue@@SGXPBG0@Z
?FrameworkLogoffDLL@CWbemProviderGlue@@SGHPBG@Z
?FrameworkLogoffDLL@CWbemProviderGlue@@SGHPBGPAJ@Z
?Free@CObjectPathParser@@QAEXPAUParsedObjectPath@@@Z
?FreeExtra@CHPtrArray@@QAEXXZ
?FreeExtra@CHString@@QAEXXZ
?FreeExtra@CHStringArray@@QAEXXZ
?FreeSearchList@CRegistrySearch@@QAEHHAAVCHPtrArray@@@Z
?GetAllDerivedInstances@CWbemProviderGlue@@SGJPBGPAV?$TRefPointerCollection@VCInstance@@@@PAVMethodContext@@0@Z
?GetAllDerivedInstancesAsynch@CWbemProviderGlue@@SGJPBGPAVProvider@@P6GJ1PAVCInstance@@PAVMethodContext@@PAX@Z034@Z
?GetAllInstances@CWbemProviderGlue@@SGJPBGPAV?$TRefPointerCollection@VCInstance@@@@0PAVMethodContext@@@Z
?GetAllInstancesAsynch@CWbemProviderGlue@@SGJPBGPAVProvider@@P6GJ1PAVCInstance@@PAVMethodContext@@PAX@Z034@Z
?GetAllocLength@CHString@@QBEHXZ
?GetAt@CHPtrArray@@QBEPAXH@Z
?GetAt@CHString@@QBEGH@Z
?GetAt@CHStringArray@@QBE?AVCHString@@H@Z
?GetBSTR@WBEMTime@@QBEPAGXZ
?GetBSTR@WBEMTimeSpan@@QBEPAGXZ
?GetBuffer@CHString@@QAEPAGH@Z
?GetBufferSetLength@CHString@@QAEPAGH@Z
?GetByte@CInstance@@QBE_NPBGAAE@Z
?GetCHString@CInstance@@QBE_NPBGAAVCHString@@@Z
?GetCSDVersion@CWbemProviderGlue@@SGPBGXZ
?GetClassNameW@CRegistry@@QAEPAGXZ
?GetClassObjectInterface@CInstance@@QAEPAUIWbemClassObject@@XZ
?GetClassObjectInterface@Provider@@AAEPAUIWbemClassObject@@PAVMethodContext@@@Z
?GetComputerNameW@CWbemProviderGlue@@CGXAAVCHString@@@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGPAEPAK@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentBinaryKeyValue@CRegistry@@QAEKPBGPAEPAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHString@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPAUHKEY__@@PBGAAVCHStringArray@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAK@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentKeyValue@CRegistry@@QAEKPBGAAVCHStringArray@@@Z
?GetCurrentRawKeyValue@CRegistry@@AAEKPAUHKEY__@@PBGPAXPAK3@Z
?GetCurrentRawSubKeyValue@CRegistry@@AAEKPBGPAXPAK2@Z
?GetCurrentSubKeyCount@CRegistry@@QAEKXZ
?GetCurrentSubKeyName@CRegistry@@QAEKAAVCHString@@@Z
?GetCurrentSubKeyPath@CRegistry@@QAEKAAVCHString@@@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAK@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGAAVCHString@@@Z
?GetCurrentSubKeyValue@CRegistry@@QAEKPBGPAXPAK@Z
?GetDMTF@WBEMTime@@QBEPAGH@Z
?GetDMTFNonNtfs@WBEMTime@@QBEPAGXZ
?GetDOUBLE@CInstance@@QBE_NPBGAAN@Z
?GetDWORD@CInstance@@QBE_NPBGAAK@Z
?GetData@CHPtrArray@@QAEPAPAXXZ
?GetData@CHPtrArray@@QBEPAPBXXZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
?GetData@CHStringArray@@QAEPAVCHString@@XZ
?GetData@CHStringArray@@QBEPBVCHString@@XZ
?GetDateTime@CInstance@@QBE_NPBGAAVWBEMTime@@@Z
?GetEmbeddedObject@CInstance@@QBE_NPBGPAPAV1@PAVMethodContext@@@Z
?GetEmptyInstance@CWbemProviderGlue@@SGJPAVMethodContext@@PBGPAPAVCInstance@@1@Z
?GetEmptyInstance@CWbemProviderGlue@@SGJPBGPAPAVCInstance@@0@Z
?GetFILETIME@WBEMTime@@QBEHPAU_FILETIME@@@Z
?GetFILETIME@WBEMTimeSpan@@QBEHPAU_FILETIME@@@Z
?GetIWBEMContext@MethodContext@@UAEPAUIWbemContext@@XZ
?GetInstanceByPath@CWbemProviderGlue@@SGJPBGPAPAVCInstance@@PAVMethodContext@@@Z
?GetInstanceFromCIMOM@CWbemProviderGlue@@CGJPBG0PAVMethodContext@@PAPAVCInstance@@@Z
?GetInstanceKeysByPath@CWbemProviderGlue@@SGJPBGPAPAVCInstance@@PAVMethodContext@@@Z
?GetInstancePropertiesByPath@CWbemProviderGlue@@SGJPBGPAPAVCInstance@@PAVMethodContext@@AAVCHStringArray@@@Z
?GetInstancesByQuery@CWbemProviderGlue@@SGJPBGPAV?$TRefPointerCollection@VCInstance@@@@PAVMethodContext@@0@Z
?GetInstancesByQueryAsynch@CWbemProviderGlue@@SGJPBGPAVProvider@@P6GJ1PAVCInstance@@PAVMethodContext@@PAX@Z034@Z
?GetKeyString@ParsedObjectPath@@QAEPAGXZ
?GetLength@CHString@@QBEHXZ
?GetLocalComputerName@Provider@@IAEABVCHString@@XZ
?GetLocalInstancePath@Provider@@IAE_NPBVCInstance@@AAVCHString@@@Z
?GetLocalOffsetForDate@WBEMTime@@SGJABJ@Z
?GetLocalOffsetForDate@WBEMTime@@SGJPBU_FILETIME@@@Z
?GetLocalOffsetForDate@WBEMTime@@SGJPBU_SYSTEMTIME@@@Z
?GetLocalOffsetForDate@WBEMTime@@SGJPBUtm@@@Z
?GetLongestClassStringSize@CRegistry@@QAEKXZ
?GetLongestSubKeySize@CRegistry@@QAEKXZ
?GetLongestValueData@CRegistry@@QAEKXZ
?GetLongestValueName@CRegistry@@QAEKXZ
?GetMapCountPtr@CWbemProviderGlue@@KGPAJPBVCWbemGlueFactory@@@Z
?GetMethodContext@CInstance@@QBEPAVMethodContext@@XZ
?GetNamespace@CFrameworkQuery@@IAEABVCHString@@XZ
?GetNamespace@Provider@@IAEABVCHString@@XZ
?GetNamespaceConnection@CWbemProviderGlue@@SGPAUIWbemServices@@PBG@Z
?GetNamespaceConnection@CWbemProviderGlue@@SGPAUIWbemServices@@PBGPAVMethodContext@@@Z
?GetNamespacePart@ParsedObjectPath@@QAEPAGXZ
?GetOSMajorVersion@CWbemProviderGlue@@SGKXZ
?GetObject@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIWbemClassObject@@PAPAUIWbemCallResult@@@Z
?GetObject@Provider@@AAEJPAUParsedObjectPath@@PAVMethodContext@@J@Z
?GetObject@Provider@@MAEJPAVCInstance@@J@Z
?GetObject@Provider@@MAEJPAVCInstance@@JAAVCFrameworkQuery@@@Z
?GetObjectAsync@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?GetParentNamespacePart@ParsedObjectPath@@QAEPAGXZ
?GetPlatform@CWbemProviderGlue@@SGKXZ
?GetPropertyBitMask@CFrameworkQueryEx@@QAEXABVCHPtrArray@@PAX@Z
?GetProviderGlue@MethodContext@@AAEPAVCWbemProviderGlue@@XZ
?GetProviderName@Provider@@IAEABVCHString@@XZ
?GetQuery@CFrameworkQuery@@QAEABVCHString@@XZ
?GetQueryClassName@CFrameworkQuery@@QAEPAGXZ
?GetRelativePath@CObjectPathParser@@SGPAGPAG@Z
?GetRequiredProperties@CFrameworkQuery@@QAEXAAVCHStringArray@@@Z
?GetSYSTEMTIME@WBEMTime@@QBEHPAU_SYSTEMTIME@@@Z
?GetSize@CHPtrArray@@QBEHXZ
?GetSize@CHStringArray@@QBEHXZ
?GetStatus@CInstance@@QBE_NPBGAA_NAAG@Z
?GetStatusObject@CWbemProviderGlue@@CGPAUIWbemClassObject@@PAVMethodContext@@PBG@Z
?GetStatusObject@MethodContext@@QAEPAUIWbemClassObject@@XZ
?GetStringArray@CInstance@@QBE_NPBGAAPAUtagSAFEARRAY@@@Z
?GetStructtm@WBEMTime@@QBEHPAUtm@@@Z
?GetTime@WBEMTime@@QBE_KXZ
?GetTime@WBEMTimeSpan@@QBE_KXZ
?GetTimeSpan@CInstance@@QBE_NPBGAAVWBEMTimeSpan@@@Z
?GetUpperBound@CHPtrArray@@QBEHXZ
?GetUpperBound@CHStringArray@@QBEHXZ
?GetValueCount@CRegistry@@QAEKXZ
?GetValuesForProp@CFrameworkQuery@@QAEJPBGAAV?$vector@V_bstr_t@@V?$allocator@V_bstr_t@@@std@@@std@@@Z
?GetValuesForProp@CFrameworkQuery@@QAEJPBGAAVCHStringArray@@@Z
?GetValuesForProp@CFrameworkQueryEx@@QAEJPBGAAV?$vector@HV?$allocator@H@std@@@std@@@Z
?GetValuesForProp@CFrameworkQueryEx@@QAEJPBGAAV?$vector@V_variant_t@@V?$allocator@V_variant_t@@@std@@@std@@@Z
?GetVariant@CInstance@@QBE_NPBGAAUtagVARIANT@@@Z
?GetWBEMINT16@CInstance@@QBE_NPBGAAF@Z
?GetWBEMINT64@CInstance@@QBE_NPBGAAVCHString@@@Z
?GetWBEMINT64@CInstance@@QBE_NPBGAA_J@Z
?GetWBEMINT64@CInstance@@QBE_NPBGAA_K@Z
?GetWCHAR@CInstance@@QBE_NPBGPAPAG@Z
?GetWORD@CInstance@@QBE_NPBGAAG@Z
?Getbool@CInstance@@QBE_NPBGAA_N@Z
?GethKey@CRegistry@@QAEPAUHKEY__@@XZ
?Gettime_t@WBEMTime@@QBEHPAJ@Z
?Gettime_t@WBEMTimeSpan@@QBEHPAJ@Z
?IncrementMapCount@CWbemProviderGlue@@KGJPAJ@Z
?IncrementMapCount@CWbemProviderGlue@@KGJPBVCWbemGlueFactory@@@Z
?IncrementObjectCount@CWbemProviderGlue@@SGXXZ
?Init2@CFrameworkQuery@@QAEXPAUIWbemClassObject@@@Z
?Init@CFrameworkQuery@@QAEJPAUParsedObjectPath@@PAUIWbemContext@@PBGAAVCHString@@@Z
?Init@CFrameworkQuery@@QAEJQAG0JAAVCHString@@@Z
?Init@CHString@@IAEXXZ
?Init@CWbemProviderGlue@@CGXXZ
?InitComputerName@Provider@@CGXXZ
?InitEx@CFrameworkQueryEx@@UAEJQAG0JAAVCHString@@@Z
?Initialize@CWbemProviderGlue@@UAGJPAGJ00PAUIWbemServices@@PAUIWbemContext@@PAUIWbemProviderInitSink@@@Z
?InsertAt@CHPtrArray@@QAEXHPAV1@@Z
?InsertAt@CHPtrArray@@QAEXHPAXH@Z
?InsertAt@CHStringArray@@QAEXHPAV1@@Z
?InsertAt@CHStringArray@@QAEXHPBGH@Z
?InternalGetNamespaceConnection@CWbemProviderGlue@@AAGPAUIWbemServices@@PBG@Z
?Is3TokenOR@CFrameworkQueryEx@@QAEHPBG0AAUtagVARIANT@@1@Z
?IsClass@ParsedObjectPath@@QAEHXZ
?IsDerivedFrom@CWbemProviderGlue@@SG_NPBG0PAVMethodContext@@0@Z
?IsEmpty@CHString@@QBEHXZ
?IsExtended@CFrameworkQueryEx@@UAE_NXZ
?IsInList@CFrameworkQuery@@IAEKABVCHStringArray@@PBG@Z
?IsInstance@ParsedObjectPath@@QAEHXZ
?IsLocal@ParsedObjectPath@@QAEHPBG@Z
?IsLoggingOn@ProviderLog@@QAE?AW4LogLevel@1@PAVCHString@@@Z
?IsNTokenAnd@CFrameworkQueryEx@@QAEHAAVCHStringArray@@AAVCHPtrArray@@@Z
?IsNull@CInstance@@QBE_NPBG@Z
?IsObject@ParsedObjectPath@@QAEHXZ
?IsOk@WBEMTime@@QBE_NXZ
?IsOk@WBEMTimeSpan@@QBE_NXZ
?IsPropertyRequired@CFrameworkQuery@@QAE_NPBG@Z
?IsReference@CFrameworkQuery@@IAEHPBG@Z
?IsRelative@ParsedObjectPath@@QAEHPBG0@Z
?KeysOnly@CFrameworkQuery@@QAE_NXZ
?Left@CHString@@QBE?AV1@H@Z
?LoadStringW@CHString@@IAEHIPAGI@Z
?LoadStringW@CHString@@QAEHI@Z
?LocalLogMessage@ProviderLog@@QAAXPBGHW4LogLevel@1@0ZZ
?LocalLogMessage@ProviderLog@@QAEXPBG0HW4LogLevel@1@@Z
?LocateKeyByNameOrValueName@CRegistrySearch@@QAEHPAUHKEY__@@PBG1PAPBGKAAVCHString@@3@Z
?Lock@CThreadBase@@AAEXXZ
?LockBuffer@CHString@@QAEPAGXZ
?LockFactoryMap@CWbemProviderGlue@@CGXXZ
?LockProviderMap@CWbemProviderGlue@@CGXXZ
?LockServer@CWbemGlueFactory@@UAGJH@Z
?LogError@CInstance@@IBEXPBG00J@Z
?MakeLocalPath@Provider@@IAE?AVCHString@@ABV2@@Z
?MakeLower@CHString@@QAEXXZ
?MakeReverse@CHString@@QAEXXZ
?MakeUpper@CHString@@QAEXXZ
?Mid@CHString@@QBE?AV1@H@Z
?Mid@CHString@@QBE?AV1@HH@Z
?MsgWndProc@CWinMsgEvent@@CGJPAUHWND__@@IIJ@Z
?NextSubKey@CRegistry@@QAEKXZ
?NextToken@CObjectPathParser@@AAEHXZ
?NormalizePath@@YGKPBG00KAAVCHString@@@Z
?NullOutUnsetProperties@CWbemProviderGlue@@AAEJPAUIWbemClassObject@@PAPAU2@ABUtagVARIANT@@@Z
?OnFinalRelease@CThreadBase@@MAEXXZ
?Open@CRegistry@@QAEJPAUHKEY__@@PBGK@Z
?OpenAndEnumerateSubKeys@CRegistry@@QAEJPAUHKEY__@@PBGK@Z
?OpenCurrentUser@CRegistry@@QAEKPBGK@Z
?OpenLocalMachineKeyAndReadValue@CRegistry@@QAEJPBG0AAVCHString@@@Z
?OpenNamespace@CWbemProviderGlue@@UAGJQAGJPAUIWbemContext@@PAPAUIWbemServices@@PAPAUIWbemCallResult@@@Z
?OpenSubKey@CRegistry@@AAEKXZ
?Parse@CObjectPathParser@@QAEHPBGPAPAUParsedObjectPath@@@Z
?PreProcessPutInstanceParms@CWbemProviderGlue@@AAEJPAUIWbemClassObject@@PAPAU2@PAUIWbemContext@@@Z
?PrepareToReOpen@CRegistry@@AAEXXZ
?PutClass@CWbemProviderGlue@@UAGJPAUIWbemClassObject@@JPAUIWbemContext@@PAPAUIWbemCallResult@@@Z
?PutClassAsync@CWbemProviderGlue@@UAGJPAUIWbemClassObject@@JPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?PutInstance@CWbemProviderGlue@@UAGJPAUIWbemClassObject@@JPAUIWbemContext@@PAPAUIWbemCallResult@@@Z
?PutInstance@Provider@@AAEJPAUIWbemClassObject@@JPAVMethodContext@@@Z
?PutInstance@Provider@@MAEJABVCInstance@@J@Z
?PutInstanceAsync@CWbemProviderGlue@@UAGJPAUIWbemClassObject@@JPAUIWbemContext@@PAUIWbemObjectSink@@@Z
?QueryInterface@CWbemGlueFactory@@UAGJABU_GUID@@PAPAX@Z
?QueryInterface@CWbemProviderGlue@@UAGJABU_GUID@@PAPAX@Z
?QueryObjectSink@CWbemProviderGlue@@UAGJJPAPAUIWbemObjectSink@@@Z
?QueryPostProcess@MethodContext@@UAEXXZ
?RegisterForMessage@CWinMsgEvent@@IAEXIH@Z
?Release@CHString@@QAEXXZ
?Release@CHString@@SGXPAUCHStringData@@@Z
?Release@CInstance@@QAEJXZ
?Release@CThreadBase@@QAEJXZ
?Release@CWbemGlueFactory@@UAGKXZ
?Release@CWbemProviderGlue@@UAGKXZ
?Release@MethodContext@@QAEJXZ
?ReleaseBuffer@CHString@@QAEXH@Z
?RemoveAll@CHPtrArray@@QAEXXZ
?RemoveAll@CHStringArray@@QAEXXZ
?RemoveAt@CHPtrArray@@QAEXHH@Z
?RemoveAt@CHStringArray@@QAEXHH@Z
?RemoveFromFactoryMap@CWbemProviderGlue@@KGXPBVCWbemGlueFactory@@@Z
?Reset@CFrameworkQuery@@AAEXXZ
?ReverseFind@CHString@@QBEHG@Z
?RewindSubKeys@CRegistry@@QAEXXZ
?Right@CHString@@QBE?AV1@H@Z
?SafeStrlen@CHString@@KGHPBG@Z
?SearchAndBuildList@CRegistrySearch@@QAEHVCHString@@AAVCHPtrArray@@00HPAUHKEY__@@@Z
?SearchMapForProvider@CWbemProviderGlue@@CGPAVProvider@@PBG0@Z
?SetAt@CHPtrArray@@QAEXHPAX@Z
?SetAt@CHString@@QAEXHG@Z
?SetAt@CHStringArray@@QAEXHPBG@Z
?SetAtGrow@CHPtrArray@@QAEXHPAX@Z
?SetAtGrow@CHStringArray@@QAEXHPBG@Z
?SetByte@CInstance@@QAE_NPBGE@Z
?SetCHString@CInstance@@QAE_NPBG0@Z
?SetCHString@CInstance@@QAE_NPBGABVCHString@@@Z
?SetCHString@CInstance@@QAE_NPBGPBD@Z
?SetCHStringResourceHandle@@YGXPAUHINSTANCE__@@@Z
Sections
.text Size: 238KB - Virtual size: 237KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 156B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ