14dd9c0c1faea9c71fefbb4c2ce1c68dc2b3482be8e0f9088871a40035129be5

Sharing

Copy URL Twitter E-mail

General

Target

14dd9c0c1faea9c71fefbb4c2ce1c68dc2b3482be8e0f9088871a40035129be5
Size

3.3MB
MD5

33abb149d45178d077e7ebbc9d6bd6a7
SHA1

af65c365f26f8893ced42712216617927be9e18f
SHA256

14dd9c0c1faea9c71fefbb4c2ce1c68dc2b3482be8e0f9088871a40035129be5
SHA512

8e232ff6094d79d25ce5915347fb5811173eab693c626aa1bb74e2ed204fe1bd1a39a782f0b0c9bdefd71c46db13e3d7b1e5849761e135817d75a187406ea7d9
SSDEEP

49152:UNuremqwBxNtJzcQrLUHEGuJs3PcsmlTVoefWqFmWq61wAUZrPr2FY2T3pCm:Ui5RzDXk0smXoe+XWq6OAUBPrcz

Score

1^/10

Malware Config

Signatures

Files

14dd9c0c1faea9c71fefbb4c2ce1c68dc2b3482be8e0f9088871a40035129be5
.dll regsvr32 windows:6 windows x86 arch:x86

579087b82cd0c2c03015610ddbd73bd1

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

31/05/2021, 06:43

Not After

17/09/2029, 06:43

Subject

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

Issuer

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Not Before

28/07/2022, 08:56

Not After

27/07/2033, 08:56

Subject

CN=Certum Timestamp 2022,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

19/05/2021, 05:32

Not After

18/05/2036, 05:32

Subject

CN=Certum Timestamping 2021 CA,O=Asseco Data Systems S.A.,C=PL

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

20/12/2022, 08:57

Not After

18/03/2025, 08:54

Subject

SERIALNUMBER=0104-01-157146,CN=FLEXTECH INC.,O=FLEXTECH INC.,STREET=Roppongi 6-10-1,L=Minato-ku,ST=Tokyo,C=JP,1.3.6.1.4.1.311.60.2.1.3=#13024a50,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:21:21:f1:57:eb:6f:44:91:49:92:21:d4:36:df:e7:56:26:40:a3:65:53:c7:b4:01:1f:4b:b9:18:bf:06:80
Signer

Actual PE Digest

83:21:21:f1:57:eb:6f:44:91:49:92:21:d4:36:df:e7:56:26:40:a3:65:53:c7:b4:01:1f:4b:b9:18:bf:06:80

Digest Algorithm

sha256

PE Digest Matches

false

25:43:d8:81:19:7a:0f:c4:01:41:b2:2b:30:7d:81:e4:2b:37:b2:ea
Signer

Actual PE Digest

25:43:d8:81:19:7a:0f:c4:01:41:b2:2b:30:7d:81:e4:2b:37:b2:ea

Digest Algorithm

sha1

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

H:\baidu\netdisk\pc-common\Output\YunBull\Bull140\Bull140U.pdb

Imports

minosagent

minos_agent_get_buildin_logdev
minos_agent_add_logdev
minos_agent_remove_logdev
minos_agent_global_cleanup
minos_agent_logdev_init
minos_agent_logdev_setopt
minos_agent_logdev_cleanup
minos_agent_log
minos_agent_random_logid
minos_agent_global_init

ws2_32

select
WSAGetLastError
closesocket
socket
recv
bind
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
accept
shutdown
htonl
listen
getaddrinfo
freeaddrinfo
ioctlsocket
gethostname
getnameinfo
send

kernel32

InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
EncodePointer
DecodePointer
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FindResourceExW
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
lstrcmpiW
FindResourceW
MultiByteToWideChar
LoadLibraryW
DeleteFileW
WriteFile
Sleep
GetTickCount
MoveFileExW
FileTimeToSystemTime
SystemTimeToFileTime
WideCharToMultiByte
SetLastError
GetCurrentThreadId
GetSystemTime
CloseHandle
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
SetThreadPriority
WaitForMultipleObjects
CreateToolhelp32Snapshot
FlushInstructionCache
Process32NextW
Module32FirstW
Module32NextW
VerSetConditionMask
GetCommandLineW
VerifyVersionInfoW
CreateFileW
GetFileInformationByHandle
GetLogicalDrives
GetVolumeInformationW
DuplicateHandle
GetCurrentProcess
GetCurrentProcessId
TerminateThread
GetExitCodeThread
OpenProcess
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
CreateMutexW
CreateDirectoryW
FindClose
FindFirstFileW
FindNextFileW
RemoveDirectoryW
ReadFile
SetEndOfFile
SetFilePointerEx
SetFileTime
GetLocalTime
GetPrivateProfileIntW
GetPrivateProfileStringW
ReadDirectoryChangesW
GetStdHandle
ExpandEnvironmentStringsW
FlushFileBuffers
SetFilePointer
OutputDebugStringW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FreeConsole
AllocConsole
WriteConsoleW
GetFileSize
SetConsoleScreenBufferSize
SetConsoleCtrlHandler
GetTempFileNameW
GetTempPathW
VirtualProtect
WriteProcessMemory
QueueUserWorkItem
InitializeCriticalSection
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
QueryPerformanceCounter
ExpandEnvironmentStringsA
FormatMessageA
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
TlsAlloc
VirtualAlloc
TlsSetValue
TlsFree
GetModuleHandleExW
FormatMessageW
GetFileType
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
VirtualFree
LoadLibraryExA
Process32FirstW
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
TlsGetValue

user32

LoadCursorW
DestroyWindow
IsWindow
ShowWindow
GetWindowLongW
SetWindowLongW
GetProcessWindowStation
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
DefWindowProcW
KillTimer
GetUserObjectInformationW
MessageBoxW
SetTimer
PostMessageW
CharNextW
UnregisterClassW
CharLowerBuffW

gdi32

GetStockObject

advapi32

CryptReleaseContext
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptCreateHash
CryptDestroyHash
CryptEnumProvidersW
CryptSignHashW
RegCloseKey
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
CryptDecrypt

shell32

SHGetSpecialFolderPathW
SHGetFolderPathW

ole32

CLSIDFromString
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
StringFromCLSID
CoLoadLibrary
StgCreateStorageEx
StgOpenStorageEx
CoCreateGuid
CoUninitialize
CoInitializeEx
CoCreateInstance

oleaut32

SysStringByteLen
VariantInit
VariantClear
VariantCopy
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
SysStringLen
VarCmp
SafeArrayCreate
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SysAllocStringLen
SysAllocString
SysFreeString
VarBstrCmp
SysAllocStringByteLen

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ

dbghelp

MiniDumpWriteDump

wininet

InternetSetOptionW
HttpEndRequestW
HttpSendRequestExA
HttpQueryInfoW
InternetOpenA
InternetCloseHandle
InternetConnectW
InternetReadFileExA
InternetWriteFile
InternetQueryOptionA
InternetSetOptionA
HttpSendRequestW
InternetSetStatusCallbackW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpQueryInfoA

winmm

timeKillEvent
timeSetEvent

rpcrt4

UuidToStringW
UuidFromStringA
UuidFromStringW

bcrypt

BCryptGenRandom

vcruntime140

strrchr
memchr
__RTDynamicCast
wcsrchr
wcschr
memset
memcpy
wcsstr
memmove
_purecall
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__std_type_info_destroy_list
strstr
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
__std_exception_copy
strchr
__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

realloc
calloc
free
_callnewh
malloc
_recalloc

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_execute_onexit_table
_register_onexit_function
_crt_atexit
strerror
_initialize_onexit_table
_initialize_narrow_environment
__sys_nerr
_configure_narrow_argv
raise
_cexit
signal
strerror_s
_initterm_e
_seh_filter_dll
_errno
_invalid_parameter_noinfo_noreturn
_initterm
_invalid_parameter_noinfo
_exit
terminate

api-ms-win-crt-convert-l1-1-0

strtoll
atoi
wcstombs
strtoul
strtol
_wtof
atol
_wtoi
_wtoi64

api-ms-win-crt-string-l1-1-0

_strdup
strcmp
_stricmp
_strnicmp
wcsncpy_s
strspn
strcspn
wcsnlen
wmemcpy_s
strncpy
tolower
_wcsicmp
_wcsdup
strnlen
iswdigit
strcpy_s
wcspbrk
wcsspn
wcscspn
isspace
iswspace
_wcslwr_s
strncmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfwprintf_s
_wfreopen_s
__acrt_iob_func
fseek
fputs
fopen
__stdio_common_vsnwprintf_s
_close
__stdio_common_vsscanf
ftell
feof
_read
_write
__stdio_common_vfprintf
fgets
_wopen
fflush
fputc
_lseeki64
_chsize_s
__stdio_common_vsprintf_s
__stdio_common_vsprintf
fwrite
_ftelli64
_fseeki64
ferror
_setmode
clearerr
setbuf
_fileno
fclose
_wfopen_s
__stdio_common_vswscanf
__stdio_common_vswprintf_s
_wfopen
__stdio_common_vswprintf
_open
fread
setvbuf

api-ms-win-crt-time-l1-1-0

_mktime64
_gmtime64_s
_localtime64_s
wcsftime
_time64
_gmtime64

api-ms-win-crt-locale-l1-1-0

_wsetlocale

api-ms-win-crt-filesystem-l1-1-0

_waccess_s
_wstat32
_fstat64i32
_stat64i32
_wmakepath_s
_stat64
_access
_wsplitpath_s

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-multibyte-l1-1-0

_mbsinc
_mbscmp
_ismbcspace
_mbsicmp
_mbslwr_s
_mbsstr

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

_except1

crypt32

CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore
CertCloseStore

Exports

Exports

??0CGeneralArrayWrapper@BULL@@QAE@PAUIGeneralArray@1@@Z
??0CGeneralArrayWrapper@BULL@@QAE@_N@Z
??0CGeneralBufferWrapper@BULL@@QAE@PAUIGeneralBuffer@1@@Z
??0CGeneralBufferWrapper@BULL@@QAE@_N@Z
??0CGeneralDataWrapper@BULL@@QAE@PAUIGeneralData@1@@Z
??0CGeneralDataWrapper@BULL@@QAE@_N@Z
??0CXMLFSWrapper@BULL@@QAE@PAUIXMLFS@1@@Z
??0CXMLFSWrapper@BULL@@QAE@_N@Z
??1CGeneralArrayWrapper@BULL@@UAE@XZ
??1CGeneralBufferWrapper@BULL@@UAE@XZ
??1CGeneralDataWrapper@BULL@@UAE@XZ
??1CXMLFSWrapper@BULL@@UAE@XZ
??4CGeneralArrayWrapper@BULL@@QAEAAV01@PAUIGeneralArray@1@@Z
??4CGeneralBufferWrapper@BULL@@QAEAAV01@PAUIGeneralBuffer@1@@Z
??4CGeneralDataWrapper@BULL@@QAEAAV01@PAUIGeneralData@1@@Z
??8CGeneralArrayWrapper@BULL@@QAE_NPAUIGeneralArray@1@@Z
??8CGeneralBufferWrapper@BULL@@QAE_NPAUIGeneralBuffer@1@@Z
??8CGeneralDataWrapper@BULL@@QAE_NPAUIGeneralData@1@@Z
??9CGeneralArrayWrapper@BULL@@QAE_NPAUIGeneralArray@1@@Z
??9CGeneralBufferWrapper@BULL@@QAE_NPAUIGeneralBuffer@1@@Z
??9CGeneralDataWrapper@BULL@@QAE_NPAUIGeneralData@1@@Z
??YCGeneralBufferWrapper@BULL@@QAEAAV01@PAUIGeneralBuffer@1@@Z
??_FCGeneralArrayWrapper@BULL@@QAEXXZ
??_FCGeneralBufferWrapper@BULL@@QAEXXZ
??_FCGeneralDataWrapper@BULL@@QAEXXZ
??_FCXMLFSWrapper@BULL@@QAEXXZ
?Add@CGeneralArrayWrapper@BULL@@QAEXC@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXD@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXE@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXF@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXG@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXH@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXI@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXJ@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXK@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXM@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXN@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralArray@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralData@2@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPAUIUnknown@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXU_GUID@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXU_SYSTEMTIME@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagPOINT@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagRECT@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEXUtagSIZE@@@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_J@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_K@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_N@Z
?Add@CGeneralArrayWrapper@BULL@@QAEX_W@Z
?Append@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?AppendNode@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?AssertOut@BULL@@YAJPB_WH_N0@Z
?Assign@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralArray@2@@Z
?Assign@CGeneralBufferWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?Assign@CGeneralDataWrapper@BULL@@QAEXPAUIGeneralData@2@@Z
?Attach@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?AttribEnumNext@CXMLFSWrapper@BULL@@QAEXXZ
?AttribEnumRelease@CXMLFSWrapper@BULL@@QAEXXZ
?AttribEnumReset@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?Base64Decode@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?Base64Decode_s@BULL@@YA?AVCGeneralBufferWrapper@1@PB_W@Z
?Base64Encode@BULL@@YAJPAUIGeneralBuffer@1@PAPA_WK@Z
?Base64Encode_s@BULL@@YAPB_WPAUIGeneralBuffer@1@K@Z
?Clear@CGeneralArrayWrapper@BULL@@QAEXXZ
?Clear@CGeneralBufferWrapper@BULL@@QAEXXZ
?Clear@CGeneralDataWrapper@BULL@@QAEXXZ
?ClearAllBookmarks@CXMLFSWrapper@BULL@@QAEXXZ
?Compare@CGeneralBufferWrapper@BULL@@QAE_NPAEK@Z
?CompareByPY@BULL@@YAJPA_W0PAH@Z
?CopyFrom@CGeneralBufferWrapper@BULL@@QAEXPAEK@Z
?CreateBookmark@CXMLFSWrapper@BULL@@QAEKXZ
?CreateGuid@BULL@@YA?AU_GUID@@XZ
?CreateObjectDebug@BULL@@YAJABU_GUID@@0PAPAX@Z
?CreateObjectFromDLL@BULL@@YAJABU_GUID@@0PA_WPAPAX@Z
?CreateObjectNative@BULL@@YAJABU_GUID@@0PAPAX@Z
?Detach@CGeneralBufferWrapper@BULL@@QAEPAEXZ
?DisableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?Dump@CGeneralArrayWrapper@BULL@@QAEPB_WXZ
?Dump@CGeneralDataWrapper@BULL@@QAEPB_WXZ
?DumpRefLeak@BULL@@YAJXZ
?EnableNamedObject@BULL@@YAJPA_WABU_GUID@@@Z
?FieldExists@CGeneralDataWrapper@BULL@@QAE_NPB_W@Z
?FindChild@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FindNextSibling@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FindPrevSibling@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?FlushLogFile@BULL@@YAJXZ
?ForEach@CXMLFSWrapper@BULL@@QAEXPB_WPAUIXMLFSJob@2@@Z
?FromDoc@CGeneralArrayWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?FromDoc@CGeneralDataWrapper@BULL@@QAEXPAUIGeneralBuffer@2@@Z
?FromFile@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?FromFile@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?FromXml@CGeneralArrayWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?FromXml@CGeneralDataWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W00PA_N@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAF@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAG@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAH@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAI@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAJ@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAK@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAM@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAN@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAU_GUID@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagPOINT@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagRECT@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PAUtagSIZE@@@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_J@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_K@Z
?Get@CXMLFSWrapper@BULL@@QAEXPB_W0PA_N@Z
?GetArray@CGeneralArrayWrapper@BULL@@QAE?AV12@I@Z
?GetArray@CGeneralDataWrapper@BULL@@QAE?AVCGeneralArrayWrapper@2@PB_W@Z
?GetArray@CGeneralDataWrapper@BULL@@QAE?AVCGeneralArrayWrapper@2@PB_WPAUIGeneralArray@2@@Z
?GetAttrib@CXMLFSWrapper@BULL@@QAEPB_WPB_W0@Z
?GetAttribAsBoolNumber@CXMLFSWrapper@BULL@@QAE_NPB_W0@Z
?GetAttribAsBoolString@CXMLFSWrapper@BULL@@QAE_NPB_W00@Z
?GetAttribAsDWord@CXMLFSWrapper@BULL@@QAEKPB_W0@Z
?GetAttribAsDouble@CXMLFSWrapper@BULL@@QAENPB_W0@Z
?GetAttribAsFloat@CXMLFSWrapper@BULL@@QAEMPB_W0@Z
?GetAttribAsGuid@CXMLFSWrapper@BULL@@QAE?AU_GUID@@PB_W0@Z
?GetAttribAsInt64@CXMLFSWrapper@BULL@@QAE_JPB_W0@Z
?GetAttribAsInt@CXMLFSWrapper@BULL@@QAEHPB_W0@Z
?GetAttribAsLong@CXMLFSWrapper@BULL@@QAEJPB_W0@Z
?GetAttribAsPoint@CXMLFSWrapper@BULL@@QAE?AUtagPOINT@@PB_W0@Z
?GetAttribAsRect@CXMLFSWrapper@BULL@@QAE?AUtagRECT@@PB_W0@Z
?GetAttribAsShort@CXMLFSWrapper@BULL@@QAEFPB_W0@Z
?GetAttribAsSize@CXMLFSWrapper@BULL@@QAE?AUtagSIZE@@PB_W0@Z
?GetAttribAsUint64@CXMLFSWrapper@BULL@@QAE_KPB_W0@Z
?GetAttribAsUint@CXMLFSWrapper@BULL@@QAEIPB_W0@Z
?GetAttribAsUlong@CXMLFSWrapper@BULL@@QAEKPB_W0@Z
?GetAttribAsUshort@CXMLFSWrapper@BULL@@QAEGPB_W0@Z
?GetAttribAsWord@CXMLFSWrapper@BULL@@QAEGPB_W0@Z
?GetAttribList@CXMLFSWrapper@BULL@@QAEPAUIGeneralData@2@PB_W@Z
?GetAttribName@CXMLFSWrapper@BULL@@QAEPB_WXZ
?GetBool@CGeneralArrayWrapper@BULL@@QAE_NI@Z
?GetBool@CGeneralDataWrapper@BULL@@QAE_NPB_W@Z
?GetBool@CGeneralDataWrapper@BULL@@QAE_NPB_W_N@Z
?GetBuffer@CGeneralArrayWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@I@Z
?GetBuffer@CGeneralBufferWrapper@BULL@@QAEPAEXZ
?GetBuffer@CGeneralDataWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@PB_W@Z
?GetBuffer@CGeneralDataWrapper@BULL@@QAE?AVCGeneralBufferWrapper@2@PB_WPAUIGeneralBuffer@2@@Z
?GetByte@CGeneralArrayWrapper@BULL@@QAEEI@Z
?GetByte@CGeneralDataWrapper@BULL@@QAEEPB_W@Z
?GetByte@CGeneralDataWrapper@BULL@@QAEEPB_WE@Z
?GetChar@CGeneralArrayWrapper@BULL@@QAECI@Z
?GetChar@CGeneralDataWrapper@BULL@@QAECPB_W@Z
?GetChar@CGeneralDataWrapper@BULL@@QAECPB_WC@Z
?GetChildrenCount@CXMLFSWrapper@BULL@@QAEJPB_W@Z
?GetCount@CGeneralArrayWrapper@BULL@@QAEIXZ
?GetDWord@CGeneralArrayWrapper@BULL@@QAEKI@Z
?GetDWord@CGeneralDataWrapper@BULL@@QAEKPB_W@Z
?GetDWord@CGeneralDataWrapper@BULL@@QAEKPB_WK@Z
?GetData@CGeneralArrayWrapper@BULL@@QAE?AVCGeneralDataWrapper@2@I@Z
?GetData@CGeneralDataWrapper@BULL@@QAE?AV12@PB_W@Z
?GetData@CGeneralDataWrapper@BULL@@QAE?AV12@PB_WPAUIGeneralData@2@@Z
?GetData@CXMLFSWrapper@BULL@@QAEPB_WPB_W@Z
?GetDouble@CGeneralArrayWrapper@BULL@@QAENI@Z
?GetDouble@CGeneralDataWrapper@BULL@@QAENPB_W@Z
?GetDouble@CGeneralDataWrapper@BULL@@QAENPB_WN@Z
?GetFieldCount@CGeneralDataWrapper@BULL@@QAEIXZ
?GetFieldIndex@CGeneralDataWrapper@BULL@@QAEIPB_W@Z
?GetFieldName@CGeneralDataWrapper@BULL@@QAEPB_WI@Z
?GetFieldType@CGeneralDataWrapper@BULL@@QAE?AW4EGeneralDataType@2@PB_W@Z
?GetFieldValue@CGeneralDataWrapper@BULL@@QAE?AUtagVARIANT@@PB_W@Z
?GetFloat@CGeneralArrayWrapper@BULL@@QAEMI@Z
?GetFloat@CGeneralDataWrapper@BULL@@QAEMPB_W@Z
?GetFloat@CGeneralDataWrapper@BULL@@QAEMPB_WM@Z
?GetGuid@CGeneralArrayWrapper@BULL@@QAE?AU_GUID@@I@Z
?GetGuid@CGeneralDataWrapper@BULL@@QAE?AU_GUID@@PB_W@Z
?GetGuid@CGeneralDataWrapper@BULL@@QAE?AU_GUID@@PB_WU3@@Z
?GetINode@CXMLFSWrapper@BULL@@QAEPAUIXMLDOMNode@@XZ
?GetInt64@CGeneralArrayWrapper@BULL@@QAE_JI@Z
?GetInt64@CGeneralDataWrapper@BULL@@QAE_JPB_W@Z
?GetInt64@CGeneralDataWrapper@BULL@@QAE_JPB_W_J@Z
?GetInt@CGeneralArrayWrapper@BULL@@QAEHI@Z
?GetInt@CGeneralDataWrapper@BULL@@QAEHPB_W@Z
?GetInt@CGeneralDataWrapper@BULL@@QAEHPB_WH@Z
?GetLength@CGeneralBufferWrapper@BULL@@QAEKXZ
?GetLogController@BULL@@YAJPAPAUILogController@1@@Z
?GetLong@CGeneralArrayWrapper@BULL@@QAEJI@Z
?GetLong@CGeneralDataWrapper@BULL@@QAEJPB_W@Z
?GetLong@CGeneralDataWrapper@BULL@@QAEJPB_WJ@Z
?GetModuleDesc@BULL@@YAJPA_W0PAPA_W@Z
?GetModuleName@BULL@@YAJPAUHINSTANCE__@@PAPA_W@Z
?GetModulePath@BULL@@YAJPAUHINSTANCE__@@PAPA_W@Z
?GetModuleVer@BULL@@YAJPAUHINSTANCE__@@PAPA_W1@Z
?GetModuleVer@BULL@@YAJPAUHINSTANCE__@@PA_K1@Z
?GetModuleVer@BULL@@YAJPA_WPAPA_W1@Z
?GetModuleVer@BULL@@YAJPA_WPA_K1@Z
?GetNamedObject@BULL@@YAJPA_WABU_GUID@@1PAPAX@Z
?GetNodeName@CXMLFSWrapper@BULL@@QAEPB_WXZ
?GetPoint@CGeneralArrayWrapper@BULL@@QAE?AUtagPOINT@@I@Z
?GetPoint@CGeneralDataWrapper@BULL@@QAE?AUtagPOINT@@PB_W@Z
?GetPoint@CGeneralDataWrapper@BULL@@QAE?AUtagPOINT@@PB_WU3@@Z
?GetRect@CGeneralArrayWrapper@BULL@@QAE?AUtagRECT@@I@Z
?GetRect@CGeneralDataWrapper@BULL@@QAE?AUtagRECT@@PB_W@Z
?GetRect@CGeneralDataWrapper@BULL@@QAE?AUtagRECT@@PB_WU3@@Z
?GetShort@CGeneralArrayWrapper@BULL@@QAEFI@Z
?GetShort@CGeneralDataWrapper@BULL@@QAEFPB_W@Z
?GetShort@CGeneralDataWrapper@BULL@@QAEFPB_WF@Z
?GetSize@CGeneralArrayWrapper@BULL@@QAE?AUtagSIZE@@I@Z
?GetSize@CGeneralDataWrapper@BULL@@QAE?AUtagSIZE@@PB_W@Z
?GetSize@CGeneralDataWrapper@BULL@@QAE?AUtagSIZE@@PB_WU3@@Z
?GetStr@CGeneralArrayWrapper@BULL@@QAEPB_WI@Z
?GetStr@CGeneralDataWrapper@BULL@@QAEPB_WPB_W0@Z
?GetStr@CGeneralDataWrapper@BULL@@QAEPB_WPB_W@Z
?GetTime@CGeneralArrayWrapper@BULL@@QAE?AU_SYSTEMTIME@@I@Z
?GetTime@CGeneralDataWrapper@BULL@@QAE?AU_SYSTEMTIME@@PB_W@Z
?GetTime@CGeneralDataWrapper@BULL@@QAE?AU_SYSTEMTIME@@PB_WU3@@Z
?GetType@CGeneralArrayWrapper@BULL@@QAE?AW4EGeneralDataType@2@I@Z
?GetUint64@CGeneralArrayWrapper@BULL@@QAE_KI@Z
?GetUint64@CGeneralDataWrapper@BULL@@QAE_KPB_W@Z
?GetUint64@CGeneralDataWrapper@BULL@@QAE_KPB_W_K@Z
?GetUint@CGeneralArrayWrapper@BULL@@QAEII@Z
?GetUint@CGeneralDataWrapper@BULL@@QAEIPB_W@Z
?GetUint@CGeneralDataWrapper@BULL@@QAEIPB_WI@Z
?GetValue@CGeneralArrayWrapper@BULL@@QAE?AUtagVARIANT@@I@Z
?GetWChar@CGeneralArrayWrapper@BULL@@QAE_WI@Z
?GetWChar@CGeneralDataWrapper@BULL@@QAE_WPB_W@Z
?GetWChar@CGeneralDataWrapper@BULL@@QAE_WPB_W_W@Z
?GetWord@CGeneralArrayWrapper@BULL@@QAEGI@Z
?GetWord@CGeneralDataWrapper@BULL@@QAEGPB_W@Z
?GetWord@CGeneralDataWrapper@BULL@@QAEGPB_WG@Z
?Go@CXMLFSWrapper@BULL@@QAEXK@Z
?GoByPath@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?GuidToString@BULL@@YAPA_WABU_GUID@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIC@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXID@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIE@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIF@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIG@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIH@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXII@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIJ@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIK@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIM@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIN@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralArray@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralBuffer@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIGeneralData@2@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPAUIUnknown@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIPB_W@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIU_GUID@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIU_SYSTEMTIME@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagPOINT@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagRECT@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXIUtagSIZE@@@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_J@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_K@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_N@Z
?Insert@CGeneralArrayWrapper@BULL@@QAEXI_W@Z
?InsertNode@CXMLFSWrapper@BULL@@QAEXPB_W00@Z
?KillTimer@BULL@@YAJK@Z
?KillTimer_s@BULL@@YAXK@Z
?LoadFromBSTR@CXMLFSWrapper@BULL@@QAEXPA_WPB_W@Z
?LoadFromFile@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?LoadModuleInfo@BULL@@YAJPB_W@Z
?LoadStringTable@BULL@@YAJPA_WH@Z
?LoadStringW@BULL@@YAPB_WH@Z
?MD5@BULL@@YAJPAUIGeneralBuffer@1@PAPAU21@@Z
?MD5@BULL@@YAJPA_WPAPAUIGeneralBuffer@1@@Z
?MD5_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@@Z
?MD5_s@BULL@@YA?AVCGeneralBufferWrapper@1@PB_W@Z
?MatchByPY@BULL@@YAJPA_W0PAH@Z
?MonitorRefLeak@BULL@@YAJPAXABU_GUID@@PB_W@Z
?MultiByteToWideChar@BULL@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@IPBD@Z
?MultiByteToWideChar@BULL@@YAJIPBDPAPA_W@Z
?ParseCmdline@BULL@@YAJPAPAUIGeneralArray@1@PA_W@Z
?PrivateLog@BULL@@YAJW4TPrivateLogCmd@1@PB_W1ZZ
?QueryObjectClsid@BULL@@YAJABU_GUID@@PAU2@@Z
?RC4@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RC4Decrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Decrypt_s@BULL@@YAPB_WPB_W0@Z
?RC4Encrypt@BULL@@YAJPA_W0PAPA_W@Z
?RC4Encrypt_s@BULL@@YAPB_WPB_W0@Z
?RC4_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RSADecrypt@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RSADecrypt_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RSAEncrypt@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?RSAEncrypt_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?RegisterObject@BULL@@YAJABU_GUID@@0P6GJPAX0PAPAX@ZPB_W@Z
?RegisterObject@BULL@@YAJABU_GUID@@0PB_W1@Z
?ReleaseBookmark@CXMLFSWrapper@BULL@@QAEXK@Z
?Remove@CGeneralArrayWrapper@BULL@@QAEXI@Z
?RemoveAttrib@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?RemoveField@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?RemoveNode@CXMLFSWrapper@BULL@@QAEXPB_W@Z
?Resize@CGeneralBufferWrapper@BULL@@QAEPAEK@Z
?SaveToBSTR@CXMLFSWrapper@BULL@@QAEPB_WPB_W@Z
?SaveToFile@CXMLFSWrapper@BULL@@QAEXPB_W0@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W0@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WC@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WD@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WE@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WF@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WG@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WH@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WI@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WJ@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WK@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WM@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WN@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralArray@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralBuffer@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIGeneralData@2@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WPAUIUnknown@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WU_GUID@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WU_SYSTEMTIME@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagPOINT@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagRECT@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_WUtagSIZE@@@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_J@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_K@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_N@Z
?Set@CGeneralDataWrapper@BULL@@QAEXPB_W_W@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W00_N0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WABU_GUID@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WF0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WI0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WJ0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WM0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WN0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagPOINT@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagRECT@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_WUtagSIZE@@0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_J0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_K0@Z
?Set@CXMLFSWrapper@BULL@@QAEXPB_W_N0@Z
?SetAttrib@CXMLFSWrapper@BULL@@QAEXPB_W00@Z
?SetAttribBoolNumber@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?SetAttribBoolString@CXMLFSWrapper@BULL@@QAEXPB_W00H0@Z
?SetAttribDWord@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?SetAttribDouble@CXMLFSWrapper@BULL@@QAEXPB_WN0@Z
?SetAttribFloat@CXMLFSWrapper@BULL@@QAEXPB_WM0@Z
?SetAttribGuid@CXMLFSWrapper@BULL@@QAEXPB_WABU_GUID@@0@Z
?SetAttribInt64@CXMLFSWrapper@BULL@@QAEXPB_W_J0@Z
?SetAttribInt@CXMLFSWrapper@BULL@@QAEXPB_WH0@Z
?SetAttribLong@CXMLFSWrapper@BULL@@QAEXPB_WJ0@Z
?SetAttribPoint@CXMLFSWrapper@BULL@@QAEXPB_WUtagPOINT@@0@Z
?SetAttribRect@CXMLFSWrapper@BULL@@QAEXPB_WUtagRECT@@0@Z
?SetAttribShort@CXMLFSWrapper@BULL@@QAEXPB_WF0@Z
?SetAttribSize@CXMLFSWrapper@BULL@@QAEXPB_WUtagSIZE@@0@Z
?SetAttribUint64@CXMLFSWrapper@BULL@@QAEXPB_W_K0@Z
?SetAttribUint@CXMLFSWrapper@BULL@@QAEXPB_WI0@Z
?SetAttribUlong@CXMLFSWrapper@BULL@@QAEXPB_WK0@Z
?SetAttribUshort@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?SetAttribWord@CXMLFSWrapper@BULL@@QAEXPB_WG0@Z
?SetData@CXMLFSWrapper@BULL@@QAEXPA_WPB_W@Z
?SetDefaultLangId@BULL@@YAJH@Z
?SetINode@CXMLFSWrapper@BULL@@QAEXPAUIXMLDOMNode@@@Z
?SetLogFile@BULL@@YAJPB_W@Z
?SetTimer@BULL@@YAJK_NPAUICallbackTimer@1@KPAK@Z
?SetTimer_s@BULL@@YAIK_NPAUICallbackTimer@1@K@Z
?Sign@BULL@@YAJPA_WPAUIGeneralArray@1@0PAUIGeneralBuffer@1@@Z
?Sign@BULL@@YAJPA_WPAUIGeneralBuffer@1@PAPA_W@Z
?Sign_s@BULL@@YAPB_WPB_WPAUIGeneralBuffer@1@@Z
?Sign_s@BULL@@YAXPB_WPAUIGeneralArray@1@0PAUIGeneralBuffer@1@@Z
?StringToGuidA@BULL@@YA?AU_GUID@@PBD@Z
?StringToGuidW@BULL@@YA?AU_GUID@@PB_W@Z
?StringToUuidA@BULL@@YA?AU_GUID@@PAD@Z
?StringToUuidW@BULL@@YA?AU_GUID@@PA_W@Z
?ToDoc@CGeneralArrayWrapper@BULL@@QAEPAUIGeneralBuffer@2@XZ
?ToDoc@CGeneralDataWrapper@BULL@@QAEPAUIGeneralBuffer@2@XZ
?ToFile@CGeneralArrayWrapper@BULL@@QAEXPB_W@Z
?ToFile@CGeneralDataWrapper@BULL@@QAEXPB_W@Z
?ToXml@CGeneralArrayWrapper@BULL@@QAEPAUIXMLDOMNode@@PAUIXMLDOMDocument@@PAU3@@Z
?ToXml@CGeneralDataWrapper@BULL@@QAEPAUIXMLDOMNode@@PAUIXMLDOMDocument@@PAU3@@Z
?TranformToPY@BULL@@YAJPA_WPAPA_W@Z
?TransFromString@CGeneralBufferWrapper@BULL@@QAEXPB_W@Z
?TransToString@CGeneralBufferWrapper@BULL@@QAEPB_WXZ
?UuidToStringW@BULL@@YAPA_WAAU_GUID@@@Z
?VerifyIEVer@BULL@@YAJEK@Z
?VerifySign@BULL@@YAJPA_WPAUIGeneralBuffer@1@0PAH@Z
?VerifySign@BULL@@YAJPA_WPAUIGeneralBuffer@1@PAH@Z
?VerifySign_s@BULL@@YA_NPB_WPAUIGeneralBuffer@1@0@Z
?VerifySign_s@BULL@@YA_NPB_WPAUIGeneralBuffer@1@@Z
?VerifyWinVer@BULL@@YAJEKKGG@Z
?VersionDecode@BULL@@YAJPAUIGeneralBuffer@1@0PAPAU21@@Z
?VersionDecode_s@BULL@@YA?AVCGeneralBufferWrapper@1@PAUIGeneralBuffer@1@0@Z
?WideCharToMultiByte@BULL@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@IPB_W@Z
?WideCharToMultiByte@BULL@@YAJIPB_WPAPAUIGeneralBuffer@1@@Z
?XLog@BULL@@YAJKKPB_WZZ
?XLogMonitor@BULL@@YAJ_KPB_W11111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11111@Z
?XLogMonitor@BULL@@YAJ_KPB_W1111@Z
?XLogMonitor@BULL@@YAJ_KPB_W111@Z
?XLogMonitor@BULL@@YAJ_KPB_W11@Z
?XLogMonitor@BULL@@YAJ_KPB_W1@Z
?XLogMonitor@BULL@@YAJ_KPB_W@Z
?XLogMultiline@BULL@@YAJKKPB_WZZ
?XLogTagMultiline@BULL@@YAJKKPB_W0ZZ
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W111@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W11@Z
?XLogTrace@BULL@@YAJPAUILogTrace@1@KPB_W1@Z
?XLogV@BULL@@YAXIPB_W0PAD@Z
?XLogWithTag@BULL@@YAJKKPB_W0ZZ
?_atoui64@@YA_KPBD@Z
?_atoui@@YAIPBD@Z
?_wtoui64@@YA_KPB_W@Z
?_wtoui@@YAIPB_W@Z
?tgz@BULL@@YAJPB_WPAUIGeneralArray@1@@Z
?untgz@BULL@@YAJPB_W0PAPAUIGeneralArray@1@1@Z
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_resolver_handles
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 732KB - Virtual size: 731KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 35KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.vmp0
Size: 591KB - Virtual size: 591KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 920B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

579087b82cd0c2c03015610ddbd73bd1

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27Certificate

Key Usages

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30Certificate

Extended Key Usages

Key Usages

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

29:c8:cb:43:1d:57:65:77:57:fb:47:fcCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

83:21:21:f1:57:eb:6f:44:91:49:92:21:d4:36:df:e7:56:26:40:a3:65:53:c7:b4:01:1f:4b:b9:18:bf:06:80Signer

25:43:d8:81:19:7a:0f:c4:01:41:b2:2b:30:7d:81:e4:2b:37:b2:eaSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

minosagent

ws2_32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcp140

dbghelp

wininet

winmm

rpcrt4

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

crypt32

Exports

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

1b:b5:8f:25:2a:df:23:00:49:28:c9:ae:3d:7e:ed:27
Certificate

2b:d4:ae:70:b9:d0:63:5b:2a:e9:84:c8:d6:74:aa:30
Certificate

e7:ff:69:c7:3b:35:ce:4b:91:26:d8:74:7c:68:a5:87
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

29:c8:cb:43:1d:57:65:77:57:fb:47:fc
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

83:21:21:f1:57:eb:6f:44:91:49:92:21:d4:36:df:e7:56:26:40:a3:65:53:c7:b4:01:1f:4b:b9:18:bf:06:80
Signer

25:43:d8:81:19:7a:0f:c4:01:41:b2:2b:30:7d:81:e4:2b:37:b2:ea
Signer

.text
Size: 1.7MB - Virtual size: 1.7MB

.rdata
Size: 732KB - Virtual size: 731KB

.data
Size: 35KB - Virtual size: 115KB

.tls
Size: 512B - Virtual size: 9B

.gfids
Size: 512B - Virtual size: 76B

.vmp0
Size: 591KB - Virtual size: 591KB

.reloc
Size: 95KB - Virtual size: 95KB

.rsrc
Size: 1024B - Virtual size: 920B