?InstallSectionA@@YGPAFE<V
?CopyMonitorExW@@YGPAEPAI<V
?LoadListItemNew@@YGPAGEPAHE<V
?LoadMutexEx@@YGPAFDGPAGN<V
?AddScreenEx@@YGHPAM<V
?PutFilePath@@YGMMN<V
Static task
static1
Behavioral task
behavioral1
Sample
6f80ade78d11f66f1834161b464f3240ab8f23044e7c874ecbcbb1d9275f8861.dll
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
6f80ade78d11f66f1834161b464f3240ab8f23044e7c874ecbcbb1d9275f8861.dll
Resource
win10v2004-20221111-en
Target
6f80ade78d11f66f1834161b464f3240ab8f23044e7c874ecbcbb1d9275f8861
Size
70KB
MD5
0a8eaaade9a719163fa6432afd5c1792
SHA1
bc89e7b223e0ef76cfa59c92232394219ec3585e
SHA256
6f80ade78d11f66f1834161b464f3240ab8f23044e7c874ecbcbb1d9275f8861
SHA512
e4c5e08cebbf62314fa528e1d04296ec0a3368e53890c2d8f8c09953aa00506bce0be53cb61549848c6d6e278031d656d1667b1c4c192adadcbf1df80f48ee77
SSDEEP
1536:OX/s5ydxo3GNlK48vDLZbvm9aNaXmeNVX5hG2KIL9J:OX/98uZ+J8aSLjjR
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
KeRemoveByKeyDeviceQueue
ZwOpenSymbolicLinkObject
KeWaitForSingleObject
IofCallDriver
RtlCharToInteger
PsCreateSystemThread
SeOpenObjectAuditAlarm
IoUpdateShareAccess
IoConnectInterrupt
ZwSetVolumeInformationFile
ZwOpenProcess
IoAllocateWorkItem
CcMdlReadComplete
RtlFreeAnsiString
PsImpersonateClient
KeBugCheck
KdDisableDebugger
KeSetTimerEx
ExAcquireFastMutexUnsafe
ZwDeviceIoControlFile
FsRtlNotifyInitializeSync
SeQueryAuthenticationIdToken
CcPurgeCacheSection
RtlFindUnicodePrefix
SeTokenIsAdmin
SeReleaseSubjectContext
ExRaiseAccessViolation
IoCreateStreamFileObjectLite
DbgBreakPoint
FsRtlIsTotalDeviceFailure
ExRegisterCallback
RtlUpcaseUnicodeString
MmMapLockedPages
IoCheckShareAccess
KeClearEvent
RtlCopyString
KeInitializeTimer
IoIsOperationSynchronous
ProbeForWrite
RtlEqualUnicodeString
RtlAddAccessAllowedAceEx
RtlTimeToSecondsSince1970
IoDeleteDevice
IoWriteErrorLogEntry
RtlCopyUnicodeString
IoRegisterDeviceInterface
CcMdlWriteComplete
ZwCreateDirectoryObject
KeQuerySystemTime
CcFastCopyWrite
RtlClearAllBits
IoAllocateMdl
KeDelayExecutionThread
DbgPrompt
IoAcquireVpbSpinLock
ZwReadFile
RtlCreateAcl
RtlWriteRegistryValue
KeSetBasePriorityThread
ZwOpenSection
ExAllocatePoolWithQuotaTag
IoMakeAssociatedIrp
CcCanIWrite
IoGetDeviceProperty
IoGetLowerDeviceObject
KeInsertQueue
CcPreparePinWrite
IoReleaseVpbSpinLock
IoBuildSynchronousFsdRequest
ExSetTimerResolution
MmProbeAndLockPages
RtlFindLongestRunClear
IoGetRelatedDeviceObject
RtlUnicodeToOemN
MmUnlockPages
IoSetDeviceInterfaceState
SeTokenIsRestricted
CcGetFileObjectFromBcb
VerSetConditionMask
RtlTimeFieldsToTime
MmBuildMdlForNonPagedPool
PsChargeProcessPoolQuota
ZwFreeVirtualMemory
FsRtlCheckLockForWriteAccess
ZwQueryVolumeInformationFile
ZwNotifyChangeKey
ExSetResourceOwnerPointer
RtlCreateRegistryKey
RtlDeleteElementGenericTable
MmPageEntireDriver
KeCancelTimer
RtlClearBits
FsRtlFreeFileLock
ZwCreateKey
IoReadPartitionTable
RtlFillMemoryUlong
KeQueryInterruptTime
SeSinglePrivilegeCheck
IoInitializeIrp
KeSaveFloatingPointState
RtlDeleteNoSplay
RtlEqualString
ObGetObjectSecurity
KeUnstackDetachProcess
RtlInitString
MmFreeMappingAddress
IoBuildPartialMdl
RtlEnumerateGenericTable
RtlValidSid
KeQueryActiveProcessors
SePrivilegeCheck
KeInsertQueueDpc
IoRegisterFileSystem
IoSetPartitionInformation
FsRtlIsFatDbcsLegal
IoQueryFileInformation
IoStartTimer
IoAllocateErrorLogEntry
ZwDeleteValueKey
RtlLengthSecurityDescriptor
RtlCompareString
KeSynchronizeExecution
FsRtlNotifyUninitializeSync
SeLockSubjectContext
ZwSetSecurityObject
MmSizeOfMdl
RtlFreeUnicodeString
RtlSubAuthoritySid
RtlCreateUnicodeString
KeInitializeDpc
KeReleaseMutex
IoCheckQuotaBufferValidity
IoSetTopLevelIrp
IoSetThreadHardErrorMode
ObMakeTemporaryObject
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
ExAllocatePoolWithTag
ZwQueryKey
RtlInitializeBitMap
RtlCopyLuid
IoInitializeTimer
IoGetDeviceObjectPointer
PsReturnPoolQuota
SeFreePrivileges
ProbeForRead
SeUnlockSubjectContext
ZwOpenKey
RtlSetDaclSecurityDescriptor
RtlCopySid
RtlFindSetBits
IoCreateDevice
PoSetSystemState
ExDeletePagedLookasideList
RtlOemToUnicodeN
CcUnpinRepinnedBcb
CcPinRead
PsGetCurrentProcess
ZwQueryObject
MmUnlockPagableImageSection
RtlValidSecurityDescriptor
MmUnmapLockedPages
IoReleaseRemoveLockAndWaitEx
IoReportResourceForDetection
FsRtlFastCheckLockForRead
IoGetTopLevelIrp
KeLeaveCriticalRegion
PsGetThreadProcessId
ZwWriteFile
MmAddVerifierThunks
IoCreateFile
IoStopTimer
IoSetHardErrorOrVerifyDevice
FsRtlAllocateFileLock
KeRestoreFloatingPointState
MmAllocateMappingAddress
KeRemoveQueueDpc
KeInitializeDeviceQueue
KeBugCheckEx
ExFreePool
RtlCreateSecurityDescriptor
MmSecureVirtualMemory
PsGetCurrentProcessId
IoWMIRegistrationControl
CcMapData
IoGetDeviceInterfaces
RtlAppendStringToString
IoAllocateAdapterChannel
FsRtlIsDbcsInExpression
IoDeleteSymbolicLink
IoGetAttachedDeviceReference
KeWaitForMultipleObjects
RtlFindLeastSignificantBit
ExRaiseStatus
RtlSetAllBits
KeReadStateTimer
RtlUnicodeStringToOemString
KeRemoveQueue
KeResetEvent
IoIsSystemThread
MmForceSectionClosed
KeRundownQueue
KeDeregisterBugCheckCallback
KeGetCurrentThread
RtlMultiByteToUnicodeN
CcUnpinData
MmMapUserAddressesToPage
IoWMIWriteEvent
MmSetAddressRangeModified
KeAttachProcess
IoFreeMdl
RtlVerifyVersionInfo
WmiQueryTraceInformation
RtlInt64ToUnicodeString
RtlInitializeUnicodePrefix
RtlGetCallersAddress
RtlCheckRegistryKey
RtlDelete
IoGetDiskDeviceObject
PsLookupThreadByThreadId
CcUninitializeCacheMap
MmCanFileBeTruncated
MmFreePagesFromMdl
RtlDowncaseUnicodeString
ObfReferenceObject
IoSetDeviceToVerify
SeAssignSecurity
PsGetProcessId
IoWritePartitionTableEx
IoFreeIrp
RtlRemoveUnicodePrefix
MmAllocatePagesForMdl
IoCheckEaBufferValidity
KeStackAttachProcess
IoGetStackLimits
IoCreateStreamFileObject
ExLocalTimeToSystemTime
IoFreeErrorLogEntry
ExAllocatePool
DbgBreakPointWithStatus
IoFreeWorkItem
IoGetCurrentProcess
IoReportDetectedDevice
CcRepinBcb
IoReadPartitionTableEx
CcRemapBcb
IoSetShareAccess
PoUnregisterSystemState
ZwFsControlFile
RtlFindLastBackwardRunClear
RtlVolumeDeviceToDosName
PsGetVersion
KeSetEvent
ZwOpenFile
ObQueryNameString
ExDeleteNPagedLookasideList
ObCreateObject
?InstallSectionA@@YGPAFE<V
?CopyMonitorExW@@YGPAEPAI<V
?LoadListItemNew@@YGPAGEPAHE<V
?LoadMutexEx@@YGPAFDGPAGN<V
?AddScreenEx@@YGHPAM<V
?PutFilePath@@YGMMN<V
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ