DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
Static task
static1
Behavioral task
behavioral1
Sample
applicationsetup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
applicationsetup.exe
Resource
win10v2004-20220812-en
Target
Photoshop.rar
Size
4.9MB
MD5
cd7348f3adecaf7cd421b4e84b9c7c97
SHA1
b874f4d1ccbe2e8b57c215746e8068a64ed8e812
SHA256
a4bd71e774488188cad6ffcc307b3f9b1277a11e648d3e605ef522fb61a84ec7
SHA512
5a9a4abe38f8eaf73b2c6aca3c52310178440e8eff19e5a115bc196ac35321967063f352932fb5a2d2f57b4205aeac5eb5c869f60d0b2fdb3c06e4ce06a47a90
SSDEEP
98304:VZTRkU9XSib3meXktplxg7Ob0g/EITVAxyVpdJd8RcTvzr/A/vct:VXPXSrXlxg6bhEIn37d5Tvzs3c
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
sprintf
_vsnwprintf
memcmp
memcpy
memset
wcsncat
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
StringFromGUID2
ImageList_Destroy
ImageList_Create
GetSaveFileNameA
GetOpenFileNameA
GetDesktopWindow
GetWindowRect
LoadStringW
DefWindowProcW
GetWindowLongW
SetWindowLongW
DestroyWindow
InvalidateRect
MoveWindow
CreateDialogParamW
GetWindowLongPtrW
GetDlgItemInt
SetTimer
SendDlgItemMessageA
KillTimer
SendMessageA
SetDlgItemInt
GetWindowLongA
GetDlgItem
CheckDlgButton
ShowWindow
IsDlgButtonChecked
EnableWindow
SetDlgItemTextA
SetWindowLongPtrW
MessageBoxA
RtlVirtualUnwind
SetUnhandledExceptionFilter
GetCurrentProcessId
QueryPerformanceCounter
RtlCaptureContext
GetSystemTimeAsFileTime
TerminateProcess
RtlLookupFunctionEntry
GetFileSize
GetTickCount
GetCurrentThreadId
GetCurrentProcess
UnhandledExceptionFilter
FreeLibrary
GetModuleFileNameA
GetLastError
lstrlenA
MultiByteToWideChar
lstrlenW
WideCharToMultiByte
CreateFileA
DisableThreadLibraryCalls
WriteFile
GetFileAttributesA
ReadFile
CloseHandle
GetVersionExW
RegSetValueExA
RegDeleteKeyA
RegCreateKeyExA
RegCreateKeyW
RegSetValueW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteKeyW
RegCloseKey
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
KeGetCurrentIrql
KeStallExecutionProcessor
KeQueryPerformanceCounter
KfReleaseSpinLock
KfAcquireSpinLock
KeRemoveQueueDpc
memmove
KeWaitForMultipleObjects
RtlAnsiStringToUnicodeString
RtlInitAnsiString
ZwClose
RtlDeleteRegistryValue
IoOpenDeviceInterfaceRegistryKey
ZwSetValueKey
RtlInitUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
ZwCreateKey
strchr
IoOpenDeviceRegistryKey
wcsstr
KeSetEvent
ExFreePool
IoGetDeviceInterfaces
KeInitializeDpc
ZwQueryValueKey
KeSetTimer
KeCancelTimer
KeSetTimerEx
KeInitializeTimer
PsTerminateSystemThread
ObReferenceObjectByHandle
PsCreateSystemThread
ZwQueryInformationFile
ZwCreateFile
ZwReadFile
strncmp
IoGetCurrentProcess
_stricmp
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
KeTickCount
KeBugCheckEx
KeClearEvent
RtlUnwind
KeInsertQueueDpc
KeSynchronizeExecution
WRITE_REGISTER_UCHAR
WRITE_REGISTER_USHORT
WRITE_REGISTER_ULONG
READ_REGISTER_UCHAR
READ_REGISTER_USHORT
READ_REGISTER_ULONG
ExAllocatePoolWithTag
ExFreePoolWithTag
IoIsWdmVersionAvailable
IoGetDeviceProperty
IoGetDmaAdapter
IoGetAttachedDeviceReference
IoBuildSynchronousFsdRequest
ObfDereferenceObject
IofCallDriver
MmUnmapIoSpace
MmMapIoSpace
IofCompleteRequest
KeReleaseMutex
KeWaitForSingleObject
KeInitializeMutex
_vsnprintf
KeInitializeSpinLock
KeInitializeEvent
memcpy
RtlCompareMemory
memset
InterlockedDecrement
InterlockedIncrement
KeDelayExecutionThread
InterlockedExchange
_wcslwr
MmGetSystemRoutineAddress
IoConnectInterrupt
IoDisconnectInterrupt
KeQueryActiveProcessors
KsAcquireDevice
KsCreateFilterFactory
KsReleaseDevice
KsFilterFactoryUpdateCacheData
KsDeviceRegisterAdapterObject
KsGetOuterUnknown
KsInitializeDriver
KsGetDeviceForDeviceObject
KsStreamPointerClone
KsPinAcquireProcessingMutex
KsPinReleaseProcessingMutex
KsStreamPointerDelete
KsPinGetParentFilter
KsGetFilterFromIrp
KsGetDevice
KsPinGetAndGate
KsPinAttemptProcessing
KsGetPinFromIrp
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerAdvance
KsStreamPointerUnlock
_KsEdit
KsPinGetReferenceClockInterface
BdaValidateNodeProperty
BdaInitFilter
BdaCreateFilterFactoryEx
BdaCommitChanges
BdaGetChangeState
BdaCheckChanges
BdaStartChanges
BdaFilterFactoryUpdateCacheData
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_WDM_DRIVER
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_wcslwr
ExFreePool
IoGetDeviceInterfaces
ZwQueryValueKey
KeSetEvent
KeReleaseMutex
KeSetTimer
KeCancelTimer
ObfDereferenceObject
PsTerminateSystemThread
KeWaitForSingleObject
ZwQueryInformationFile
strncmp
KeInitializeMutex
KeInitializeTimer
KeInitializeDpc
wcsstr
PsCreateSystemThread
_stricmp
IoWriteErrorLogEntry
IoAllocateErrorLogEntry
IofCallDriver
IoBuildDeviceIoControlRequest
IoCancelIrp
memmove
IoAllocateIrp
IoFreeIrp
KeInsertQueueDpc
KeRemoveQueueDpc
KeTickCount
KeBugCheckEx
IoIsWdmVersionAvailable
RtlUnwind
IoOpenDeviceRegistryKey
strchr
ZwCreateKey
RtlStringFromGUID
RtlFreeUnicodeString
ZwSetValueKey
IoOpenDeviceInterfaceRegistryKey
RtlInitAnsiString
RtlAnsiStringToUnicodeString
ExAllocatePoolWithTag
ExFreePoolWithTag
IofCompleteRequest
KeClearEvent
KeWaitForMultipleObjects
ZwWriteFile
KeInitializeEvent
RtlInitUnicodeString
ZwCreateFile
ZwReadFile
ObReferenceObjectByHandle
ZwClose
IoGetDeviceProperty
KeDelayExecutionThread
toupper
_vsnprintf
KeInitializeSpinLock
InterlockedDecrement
InterlockedIncrement
memset
InterlockedExchange
memcpy
IoGetCurrentProcess
RtlCompareMemory
KeStallExecutionProcessor
KfReleaseSpinLock
KeGetCurrentIrql
KfAcquireSpinLock
KsInitializeDriver
KsGetDeviceForDeviceObject
KsAcquireDevice
KsCreateFilterFactory
KsReleaseDevice
KsFilterFactoryUpdateCacheData
KsPinGetAndGate
KsPinAttemptProcessing
KsStreamPointerClone
KsStreamPointerDelete
KsPinAcquireProcessingMutex
KsPinReleaseProcessingMutex
KsGetPinFromIrp
KsPinGetParentFilter
KsGetFilterFromIrp
KsGetDevice
_KsEdit
KsPinGetLeadingEdgeStreamPointer
KsStreamPointerAdvance
KsStreamPointerUnlock
KsPinGetReferenceClockInterface
USBD_ParseConfigurationDescriptorEx
USBD_CreateConfigurationRequestEx
BdaFilterFactoryUpdateCacheData
BdaValidateNodeProperty
BdaGetChangeState
BdaCommitChanges
BdaCheckChanges
BdaStartChanges
BdaInitFilter
BdaCreateFilterFactoryEx
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
_CorExeMain
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ