?CancelTimeNew@@IJGI@X
?MediaTypeA@@IJPAXPAJG@X
?DecrementProcessOld@@IJMPAH@X
?OnAnchorOld@@IJNJJ@X
Static task
static1
Behavioral task
behavioral1
Sample
d83f5620cc3e149ec388d17ace29dae5145276ca1fe99a0985e30c23f9a459e7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d83f5620cc3e149ec388d17ace29dae5145276ca1fe99a0985e30c23f9a459e7.dll
Resource
win10v2004-20220812-en
Target
d83f5620cc3e149ec388d17ace29dae5145276ca1fe99a0985e30c23f9a459e7
Size
159KB
MD5
84fe3192c01068adaf49ac27cd2324ce
SHA1
5d724f9c6cf743daf16f7522b180b4a03825fcc8
SHA256
d83f5620cc3e149ec388d17ace29dae5145276ca1fe99a0985e30c23f9a459e7
SHA512
78a70d7c412baaf1c7cc6f58ae98539326d517ea5bbb684fc0a2be32ca746138c25e4f18d0160d0d9f98d6cb7c1e8c42dd3634dc1b753756ed8e62c2141e6661
SSDEEP
3072:qpo9LX4feNsWvpUSFC2cJaJFs0r9gkJKqDm+TAnBRjvt:A4X4feNnRFC2ckJ4f+iBRjv
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IoWriteErrorLogEntry
IoRequestDeviceEject
PsGetCurrentThreadId
CcRemapBcb
RtlTimeToSecondsSince1980
RtlFindLastBackwardRunClear
CcFastMdlReadWait
ZwDeviceIoControlFile
IoStartTimer
ObfReferenceObject
KeRemoveByKeyDeviceQueue
MmAllocateMappingAddress
ZwFreeVirtualMemory
IoIsWdmVersionAvailable
MmAllocateNonCachedMemory
MmCanFileBeTruncated
SeTokenIsAdmin
FsRtlCheckLockForWriteAccess
RtlFreeUnicodeString
KeCancelTimer
ExAllocatePoolWithQuota
IoWMIRegistrationControl
PsDereferencePrimaryToken
KeSynchronizeExecution
RtlDelete
CcPreparePinWrite
RtlInsertUnicodePrefix
ZwOpenKey
ZwCreateDirectoryObject
ExRaiseDatatypeMisalignment
FsRtlFreeFileLock
ZwMakeTemporaryObject
ObReferenceObjectByPointer
PsImpersonateClient
MmSizeOfMdl
PsIsThreadTerminating
IoSetSystemPartition
RtlxAnsiStringToUnicodeSize
ZwOpenFile
KeInitializeTimerEx
RtlInitString
CcMdlRead
RtlMultiByteToUnicodeN
PoUnregisterSystemState
IoCreateSynchronizationEvent
RtlExtendedIntegerMultiply
MmUnmapIoSpace
IoCreateFile
IoConnectInterrupt
MmUnsecureVirtualMemory
KeSetSystemAffinityThread
IoRegisterDeviceInterface
KdDisableDebugger
MmIsDriverVerifying
RtlLengthSecurityDescriptor
CcCopyWrite
IoReleaseRemoveLockAndWaitEx
IoAllocateErrorLogEntry
CcCanIWrite
IoAllocateController
IoFreeErrorLogEntry
CcFlushCache
IoRaiseHardError
KeReadStateSemaphore
IoSetDeviceInterfaceState
KeSetImportanceDpc
MmSetAddressRangeModified
IoIsOperationSynchronous
RtlTimeToSecondsSince1970
ZwEnumerateValueKey
RtlAreBitsSet
RtlRandom
FsRtlIsHpfsDbcsLegal
ObfDereferenceObject
KeDetachProcess
RtlFindClearRuns
CcUnpinDataForThread
CcPurgeCacheSection
ZwMapViewOfSection
IoSetPartitionInformation
SeCreateClientSecurity
ExSystemTimeToLocalTime
ZwOpenProcess
IoDeviceObjectType
KeQuerySystemTime
IoRemoveShareAccess
KeLeaveCriticalRegion
FsRtlNotifyUninitializeSync
ObReferenceObjectByHandle
FsRtlDeregisterUncProvider
IoIsSystemThread
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
KeSetKernelStackSwapEnable
RtlRemoveUnicodePrefix
RtlEqualString
CcSetReadAheadGranularity
RtlUnicodeStringToOemString
ZwAllocateVirtualMemory
SeSetSecurityDescriptorInfo
IoInvalidateDeviceState
RtlInitializeSid
KeDeregisterBugCheckCallback
RtlInitAnsiString
ZwUnloadDriver
ExIsProcessorFeaturePresent
SeTokenIsRestricted
ZwDeleteValueKey
PsLookupThreadByThreadId
KdEnableDebugger
SeImpersonateClientEx
PoRequestPowerIrp
IoVerifyPartitionTable
HalExamineMBR
RtlUnicodeToOemN
KeStackAttachProcess
RtlGetCallersAddress
KeAttachProcess
RtlFindMostSignificantBit
IoUnregisterFileSystem
KeInitializeSpinLock
KeInitializeEvent
FsRtlFastCheckLockForRead
IoInvalidateDeviceRelations
RtlCopySid
IoDetachDevice
ExAllocatePoolWithTag
RtlDeleteNoSplay
FsRtlSplitLargeMcb
SeQueryInformationToken
IoCheckEaBufferValidity
PsGetCurrentThread
KeInitializeApc
IoGetRequestorProcessId
KeWaitForMultipleObjects
RtlGetNextRange
KeRemoveEntryDeviceQueue
IoFreeWorkItem
RtlUnicodeStringToInteger
KeQueryActiveProcessors
KeReleaseMutex
SeFreePrivileges
MmMapIoSpace
FsRtlIsTotalDeviceFailure
RtlPrefixUnicodeString
IoCreateStreamFileObjectLite
KeBugCheck
IoOpenDeviceRegistryKey
KeResetEvent
IoGetDeviceToVerify
MmBuildMdlForNonPagedPool
IoGetLowerDeviceObject
ZwEnumerateKey
ExGetExclusiveWaiterCount
IoDeleteDevice
FsRtlCheckLockForReadAccess
CcFastCopyWrite
KeInitializeSemaphore
PsTerminateSystemThread
FsRtlMdlWriteCompleteDev
IoAllocateMdl
IoAcquireVpbSpinLock
CcFastCopyRead
IoSetDeviceToVerify
RtlUnicodeToMultiByteN
IoGetDeviceProperty
RtlFillMemoryUlong
MmGetPhysicalAddress
CcGetFileObjectFromBcb
ZwSetVolumeInformationFile
RtlValidSid
ZwClose
RtlAnsiCharToUnicodeChar
PoStartNextPowerIrp
SeQueryAuthenticationIdToken
RtlAddAccessAllowedAce
KeReleaseSemaphore
ExDeletePagedLookasideList
ZwQueryKey
IoReportDetectedDevice
IoDeleteSymbolicLink
CcZeroData
DbgBreakPointWithStatus
IoGetDriverObjectExtension
MmProbeAndLockProcessPages
MmMapUserAddressesToPage
KeInitializeQueue
PoSetSystemState
KeClearEvent
IoCheckShareAccess
RtlAddAccessAllowedAceEx
MmUnmapReservedMapping
CcMdlWriteAbort
PsReturnPoolQuota
RtlTimeToTimeFields
IoSetTopLevelIrp
CcCopyRead
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeSaveFloatingPointState
MmResetDriverPaging
SeSinglePrivilegeCheck
IofCompleteRequest
RtlxOemStringToUnicodeSize
MmUnmapLockedPages
SeCaptureSubjectContext
ExGetPreviousMode
RtlCreateSecurityDescriptor
RtlCreateUnicodeString
MmAllocateContiguousMemory
ExDeleteResourceLite
KeInsertByKeyDeviceQueue
IoAllocateIrp
IoCreateDevice
MmFreePagesFromMdl
RtlAppendStringToString
PsGetProcessId
MmUnlockPages
MmUnlockPagableImageSection
IoCreateSymbolicLink
IoGetAttachedDevice
KeSetPriorityThread
MmGetSystemRoutineAddress
ObCreateObject
KePulseEvent
RtlUpcaseUnicodeString
IoGetTopLevelIrp
KeRestoreFloatingPointState
MmFreeMappingAddress
SeOpenObjectAuditAlarm
FsRtlIsNameInExpression
IoSetPartitionInformationEx
IoStartPacket
KeQueryTimeIncrement
RtlSetBits
MmHighestUserAddress
MmIsVerifierEnabled
ObReleaseObjectSecurity
KeRemoveQueue
IoFreeMdl
ZwCreateKey
ZwSetValueKey
RtlFindClearBits
ExSetResourceOwnerPointer
IoGetRequestorProcess
SeFilterToken
KeInsertHeadQueue
FsRtlGetNextFileLock
RtlClearBits
KeBugCheckEx
RtlFindNextForwardRunClear
SeReleaseSubjectContext
ExGetSharedWaiterCount
SeAccessCheck
CcUnpinData
?CancelTimeNew@@IJGI@X
?MediaTypeA@@IJPAXPAJG@X
?DecrementProcessOld@@IJMPAH@X
?OnAnchorOld@@IJNJJ@X
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ