ExecutePhase1
RestorePhase1
Static task
static1
Behavioral task
behavioral1
Sample
84e15ae136e5ccf2c87de8944adcc578ebe7f1c50bfb6e9f7677b13a9c83f0e4.dll
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
84e15ae136e5ccf2c87de8944adcc578ebe7f1c50bfb6e9f7677b13a9c83f0e4.dll
Resource
win10v2004-20220901-en
Target
84e15ae136e5ccf2c87de8944adcc578ebe7f1c50bfb6e9f7677b13a9c83f0e4
Size
415KB
MD5
7d3cb18f9d17128980a0abd58e3858fe
SHA1
dab52df8fb7e2fb6dba9bc87f256f3de1f736daa
SHA256
84e15ae136e5ccf2c87de8944adcc578ebe7f1c50bfb6e9f7677b13a9c83f0e4
SHA512
14eefa93588dd060933b1078d45dd53ef18327ffdca7d3b36b27e2ae8f841d9afeaebd0e8ac3c969fad10d10b054b9ef4c7f40006f28badd5dbc89f9e0dc9d8b
SSDEEP
6144:/amOtiqDOeVit1/1AMYLspTW1tILfPAYQ809I:ADZVit1+MKcW1Pv809I
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
??1CRegAutoUpdate@@QAE@XZ
?IsDeploymentCIDSet@CCIDListManager@@QAEHXZ
??4String@@QAEABV0@ABV0@@Z
?GetNextCID@CCIDListManager@@QAE?AVString@@XZ
?InitCIDLoop@CCIDListManager@@QAEXXZ
?IsTestCIDSet@CCIDListManager@@QAEHH@Z
??1CRegBase@@QAE@XZ
?SetException@CRegAutoUpdate@@QAEXK@Z
??0CRegAutoUpdate@@QAE@_N@Z
?Log@@YAXKPBDZZ
??1String@@QAE@XZ
?InitManager@CCIDListManager@@QAEH_N@Z
??0String@@QAE@XZ
?Format@String@@QAAXPBDZZ
?GetBuffer@String@@QBEPBDXZ
?ParseXMLDocument@phase1xml@@QAEHPAV?$RT_List@PAVCRelease@@PAV1@@@ABVString@@@Z
?DeletePreviousRegistryEntries@@YAXABVString@@@Z
?IsEmpty@String@@QBE_NXZ
??1phase1xml@@UAE@XZ
??0String@@QAE@ABV0@@Z
?GetPreviousXMLDoc@phase1xml@@QAEHXZ
?IsNewConfiguration@phase1xml@@QAEHPAV?$RT_List@PAVCRelease@@PAV1@@@ABVString@@@Z
?GetXMLDoc@phase1xml@@QAEHPBVCConfig@@@Z
??0phase1xml@@QAE@ABVString@@0@Z
?GetAction@AutoUpdateObject@@QBEHXZ
?GetName@AutoUpdateObject@@QBEPBDXZ
??1CRegConfig@@QAE@XZ
?SetConfigCounter@CRegConfig@@QAEXPBDK@Z
?atodw@@YAKPBD@Z
??BString@@QBEPBDXZ
?SetNextPendingUpdate@CRegConfig@@QAEH_J@Z
??0CRegConfig@@QAE@_N@Z
?IsVersionNewer@@YA_NPBD0@Z
?GetFullVersion@AutoUpdateObject@@QBEPBDXZ
??4CComponent@@QAEAAV0@ABV0@@Z
??0CComponent@@QAE@XZ
??0CRelease@@QAE@XZ
??4CRelease@@QAEAAV0@ABV0@@Z
??0CRelease@@QAE@ABV0@@Z
?GetLanguage@AutoUpdateObject@@QBEPBDXZ
?SetCertificateID@CRelease@@QAEXPBD@Z
?GetCertificateID@CRelease@@QAEPBDXZ
??8String@@QBEHPBD@Z
?IsLocalInstall@CRegAutoUpdate@@QAE_NXZ
?IsMergeOptionSet@CRegConfig@@QAE_NXZ
??1CRegProductForComponent@@QAE@XZ
??1CRegComponent@@QAE@XZ
?GetComponentVersion@CRegProductForComponent@@QAEPBDXZ
??0CRegProductForComponent@@QAE@PBD0_N1@Z
?GetComponentList@CRegComponent@@QAE_NAAV?$RT_List@VString@@AAV1@@@@Z
??0CRegComponent@@QAE@_N@Z
?IsShared@CRegProductForComponent@@QAE_NXZ
?InitValues@CComponent@@QAEXJPBD00000@Z
?GetLanguage@CRegProductForComponent@@QAEPBDXZ
?GetBuildAndVersion@CRegProductForComponent@@QAEXPAD0@Z
?GetFlag@CRegConfig@@QAE_NPBD@Z
??1CInterruptionEvent@@UAE@XZ
??1CCIDListManager@@UAE@XZ
??0CInterruptionEvent@@QAE@XZ
??0CCIDListManager@@QAE@XZ
??1CRegInProgress@@QAE@XZ
?Set@RT_RESULT@@QAEHHABVString@@0000@Z
?result@@3PAVRT_RESULT@@A
?StopPooling@CInterruptionEvent@@QAEHXZ
?IsEndOfTheListReached@CCIDListManager@@QAEHXZ
?GetConfigCounter@CRegConfig@@QAEKPBD@Z
?IsITRaised@CInterruptionEvent@@QAEHXZ
?GetProductFilePath@CRegInProgress@@QAEPBDXZ
??0CRegInProgress@@QAE@_N@Z
?StartPooling@CInterruptionEvent@@QAEHXZ
?Create@CInterruptionEvent@@QAEHAAVString@@@Z
??0String@@QAE@PBD@Z
?SaveConfigFile@@YA_NPAVCRelease@@@Z
?GetDataPath@CRegAutoUpdate@@QAEPBDXZ
?Serialize@CRelease@@QAEHAAV?$basic_ifstream@DU?$char_traits@D@std@@@std@@@Z
??0CRegBase@@QAE@PBD00_N@Z
?GetSubKeys@CRegBase@@QAE_NAAV?$RT_List@VString@@AAV1@@@@Z
??1RT_File@@UAE@XZ
?DeleteValue@CRegBase@@QAE_NPBD@Z
?IsFileExisting@RT_File@@QAE_NPBD@Z
??0RT_File@@QAE@PBD@Z
?GetValues@CRegBase@@QAE_NAAV?$RT_List@VString@@AAV1@@@@Z
??0CRegBase@@QAE@PBD0_N@Z
??1DataCaching@@QAE@XZ
??1CRegProduct@@QAE@XZ
?GetComponentData@DataCaching@@QAEHPBD000000@Z
??0DataCaching@@QAE@XZ
?GetLanguage@CRegProduct@@QAEPBDXZ
?GetBuildAndVersion@CRegProduct@@QAEXPAD0@Z
?GetLength@String@@QBEHXZ
?FindCIDInList@CCIDListManager@@QAEPAU__POSITION@@ABVString@@@Z
?QueryValue@CRegBase@@QAE_NPBDPAD@Z
??YString@@QAEABV0@ABV0@@Z
??YString@@QAEABV0@PBD@Z
?IsEnabled@CRegProduct@@QAE_NXZ
??0CRegProduct@@QAE@PBD_N@Z
??4String@@QAEABV0@PBD@Z
?FreeReleaseList@@YAHAAPAV?$RT_List@PAVCRelease@@PAV1@@@@Z
?Set@RT_RESULT@@QAEHPAV1@@Z
?GetStatusCode@RT_RESULT@@QAEHXZ
?SetPhase@CRegInProgress@@QAEXH@Z
CertEnumCertificatesInStore
CertNameToStrA
CertOpenStore
CertCloseStore
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
DisableThreadLibraryCalls
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetLastError
InterlockedDecrement
MultiByteToWideChar
InterlockedCompareExchange
Sleep
InterlockedExchange
lstrlenW
GetProcessHeap
HeapFree
WideCharToMultiByte
lstrlenA
GetCurrentProcess
TerminateProcess
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
CoUninitialize
CoInitializeEx
VariantInit
SetErrorInfo
SysAllocStringLen
SysAllocString
SysStringLen
VarBstrCat
SysFreeString
CreateErrorInfo
VariantClear
GetErrorInfo
VariantChangeType
?SetCmdValue@CMsgCmdStatus@@QAEXI@Z
??1CMsgCmdStatus@@UAE@XZ
?GetBufferData@CPipeMessage@@QAEPAXXZ
??0CMsgCmdStatus@@QAE@XZ
?SetCmdStatus@CMsgCmdStatus@@QAEXH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?eof@ios_base@std@@QBE_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?open@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@XZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@XZ
strchr
strstr
__CxxFrameHandler3
_CxxThrowException
??_V@YAXPAX@Z
_strupr
strncpy
malloc
_encode_pointer
_malloc_crt
memset
_decode_pointer
strcmp
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_except_handler4_common
_unlock
__dllonexit
_lock
_onexit
_crt_debugger_hook
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__clean_type_info_names_internal
memcpy
sprintf
strcpy
strlen
_stricmp
??3@YAXPAX@Z
_initterm
??2@YAPAXI@Z
free
_encoded_null
ExecutePhase1
RestorePhase1
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE