DefaultLocationCpl.pdb
Static task
static1
Behavioral task
behavioral1
Sample
defaultlocationcpl.dll
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
defaultlocationcpl.dll
Resource
win10v2004-20240426-en
General
-
Target
defaultlocationcpl.dll
-
Size
215KB
-
MD5
73cb55d2e8099d24fd077c990ffe3ddb
-
SHA1
30f028495e4373d0aa0bbdaf7aa76b1df0a9e622
-
SHA256
876beb70ad1589ba113609f978fb84ff15b69792770c8f32751ab754185bb112
-
SHA512
45a80aab671aa30899c2054a61c884112d7d94b43bcf7d847d6d0ee48577849bd676dd109507840371a22c8d864f7c46b2d3c03c9a3465862fc62b6543971d32
-
SSDEEP
3072:ezHbhq0/DDq77mQYah/m3xCvPXbylCmLJuKPKrjdW8casEOjLOoKptU5:u7h5aPYaRmaP2lCmdJK9OMg0
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource defaultlocationcpl.dll
Files
-
defaultlocationcpl.dll.dll windows:6 windows x86 arch:x86
d6b6ff8960202123ac5d342a2ec51caf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
wcscpy_s
memcpy_s
memmove_s
_vsnwprintf
memset
wcstok
free
malloc
_onexit
_lock
__dllonexit
_unlock
_except_handler4_common
_amsg_exit
_initterm
_XcptFilter
ntdll
WinSqmEndSession
WinSqmSetDWORD
WinSqmStartSession
WinSqmAddToStream
EtwLogTraceEvent
kernel32
HeapAlloc
GetProcessHeap
HeapFree
DisableThreadLibraryCalls
InterlockedIncrement
InterlockedDecrement
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetLastError
ExpandEnvironmentStringsW
SizeofResource
LockResource
LoadResource
ReleaseActCtx
CreateActCtxW
GetModuleHandleW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
FileTimeToSystemTime
GetSystemTime
SystemTimeToFileTime
DeactivateActCtx
FindResourceW
FindResourceExW
SetLastError
lstrlenW
CompareStringOrdinal
GetProcAddress
LoadLibraryW
GetModuleFileNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVersionExA
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
GetUserGeoID
GetLocaleInfoW
CompareStringW
EnumSystemGeoID
GetGeoInfoW
ActivateActCtx
advapi32
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegOpenCurrentUser
shlwapi
ord256
ord199
ord494
ord24
ord156
ord174
ord204
ord158
ord176
ord172
ord219
ord538
SHStrDupW
ord514
ord618
shell32
SHBindToObject
ord18
SHParseDisplayName
ord155
ord25
ShellExecuteW
ShellExecuteExW
ole32
CoGetObject
StringFromGUID2
PropVariantClear
CoCreateInstance
oleaut32
SysFreeString
BSTR_UserFree
BSTR_UserUnmarshal
BSTR_UserSize
SysStringLen
VarBstrCmp
SysAllocString
BSTR_UserMarshal
user32
RegisterWindowMessageW
DestroyWindow
IsWindow
DefWindowProcW
GetWindowLongW
SetWindowLongW
CreateWindowExW
GetFocus
RegisterClassExW
SendMessageW
wvsprintfW
GetAncestor
IsIconic
LoadImageW
UnregisterClassA
dui70
?ForceThemeChange@XProvider@DirectUI@@UAGJIJ@Z
?GetHostedElementID@XProvider@DirectUI@@UAGJPAG@Z
?FindElementWithShortcutAndDoDefaultAction@XProvider@DirectUI@@UAGHGH@Z
?CanSetFocus@XProvider@DirectUI@@UAGJPA_N@Z
?Navigate@XProvider@DirectUI@@UAGJHPA_N@Z
?SetFocus@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?IsDescendent@XProvider@DirectUI@@UAGJPAVElement@2@PA_N@Z
?GetDesiredSize@XProvider@DirectUI@@UAGJHHPAUtagSIZE@@@Z
?SetParameter@XProvider@DirectUI@@UAGJABU_GUID@@PAX@Z
??1XProvider@DirectUI@@UAE@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?CreateDUI@XProvider@DirectUI@@UAGJPAVIXElementCP@2@PAPAUHWND__@@@Z
?SetHandleEnterKey@XProvider@DirectUI@@IAEX_N@Z
?Create@XResourceProvider@DirectUI@@SGJPAUHINSTANCE__@@PBG11PAPAV12@@Z
?Initialize@XProvider@DirectUI@@QAEJPAVElement@2@PAVIXProviderCP@2@@Z
?QueryInterface@XProvider@DirectUI@@UAGJABU_GUID@@PAPAX@Z
UnInitThread
InitThread
UnInitProcessPriv
InitProcessPriv
?Init@NavReference@DirectUI@@QAEXPAVElement@2@PAUtagRECT@@@Z
?GetAtom@Value@DirectUI@@QAEGXZ
?Register@Element@DirectUI@@SGJXZ
?GetClassInfoPtr@Element@DirectUI@@SGPAUIClassInfo@2@XZ
?GetValue@Element@DirectUI@@QAEPAVValue@2@PBUPropertyInfo@2@HPAUUpdateCache@2@@Z
?GetString@Value@DirectUI@@QAEPBGXZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
?GetExpanded@Expandable@DirectUI@@QAE_NXZ
?SelectionChange@Combobox@DirectUI@@SG?AVUID@@XZ
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetDefaultButtonTracking@XProvider@DirectUI@@UAGJ_N@Z
?SetXMLFromResource@DUIXmlParser@DirectUI@@QAEJIPAUHINSTANCE__@@0@Z
?GetParent@Element@DirectUI@@QAEPAV12@XZ
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
?SortChildren@Element@DirectUI@@QAEJP6AHPBX0@Z@Z
?GetID@Element@DirectUI@@QAEGXZ
?Initialize@Element@DirectUI@@QAEJIPAV12@PAK@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?Release@Value@DirectUI@@QAEXXZ
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
StrToID
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?SetExpanded@Expandable@DirectUI@@QAEJ_N@Z
??1Element@DirectUI@@UAE@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@Element@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@Element@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ClickDefaultButton@XProvider@DirectUI@@UAGHXZ
?SetRegisteredDefaultButton@XProvider@DirectUI@@UAGJPAVElement@2@@Z
?SetButtonClassAcceptsEnterKey@XProvider@DirectUI@@UAGJ_N@Z
?AddRef@XProvider@DirectUI@@UAGKXZ
?GetRoot@XProvider@DirectUI@@IAEPAVElement@2@XZ
??0XProvider@DirectUI@@QAE@XZ
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?GetAtomZero@Value@DirectUI@@SGPAV12@XZ
?GetStringNull@Value@DirectUI@@SGPAV12@XZ
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?GetUnset@Value@DirectUI@@SGPAV12@XZ
?Create@DUIXmlParser@DirectUI@@SGJPAPAV12@P6GPAVValue@2@PBGPAX@Z2P6GX11H2@Z2@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?OnUnHosted@Element@DirectUI@@MAEXPAV12@@Z
?OnHosted@Element@DirectUI@@MAEXPAV12@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?MessageCallback@Element@DirectUI@@UAEIPAUtagGMSG@@@Z
?SetKeyFocus@Element@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?SetActive@Element@DirectUI@@QAEJH@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@Element@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@Element@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@Element@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??0Element@DirectUI@@QAE@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
??1ClassInfoBase@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
??0ClassInfoBase@DirectUI@@QAE@XZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
rpcrt4
NdrOleAllocate
NdrOleFree
NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
IUnknown_QueryInterface_Proxy
IUnknown_AddRef_Proxy
IUnknown_Release_Proxy
CStdStubBuffer_QueryInterface
CStdStubBuffer_AddRef
CStdStubBuffer_Connect
CStdStubBuffer_Disconnect
CStdStubBuffer_Invoke
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_CountRefs
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_DebugServerRelease
NdrDllGetClassObject
propsys
InitPropVariantFromFileTime
InitPropVariantFromCLSID
PropVariantToBSTR
PropVariantToString
PropVariantToDouble
Exports
Exports
DllCanUnloadNow
DllGetClassObject
RequestDLPPermissionsInternalA
RequestDLPPermissionsInternalW
Sections
.text Size: 85KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 51B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ