?CancelTimeNew@@IJGI@X
?MediaTypeA@@IJPAXPAJG@X
?DecrementProcessOld@@IJMPAH@X
?OnAnchorOld@@IJNJJ@X
Static task
static1
Behavioral task
behavioral1
Sample
529cecc9892cfa5dbea44466f85a9c5ac45a8b6b38e03ef720639dd8991d8e11.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
529cecc9892cfa5dbea44466f85a9c5ac45a8b6b38e03ef720639dd8991d8e11.dll
Resource
win10v2004-20221111-en
Target
529cecc9892cfa5dbea44466f85a9c5ac45a8b6b38e03ef720639dd8991d8e11
Size
331KB
MD5
fcb9b7a2db0c457103633454f9870b20
SHA1
f5c029766610f0b057b906ba902c9729479bc097
SHA256
529cecc9892cfa5dbea44466f85a9c5ac45a8b6b38e03ef720639dd8991d8e11
SHA512
b6eab25d57a984e174e19ad34a8c60fe372536b73fd0159519dbbd4aa224284f98f3eac891bbc87ad55dc5123c98dbdad317841ffac99987f7a225f1702c28fb
SSDEEP
6144:c4X4feNnRpep/gEubrw4pmDh9jNfQJR/1l+7UuWNKH/jzIRkQ0dWihh1Bm:ckNepYrVpmt9jy1l+7xWsH/jzI2QQA
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IoWriteErrorLogEntry
IoRequestDeviceEject
PsGetCurrentThreadId
CcRemapBcb
RtlTimeToSecondsSince1980
RtlFindLastBackwardRunClear
CcFastMdlReadWait
ZwDeviceIoControlFile
IoStartTimer
ObfReferenceObject
KeRemoveByKeyDeviceQueue
MmAllocateMappingAddress
ZwFreeVirtualMemory
IoIsWdmVersionAvailable
MmAllocateNonCachedMemory
MmCanFileBeTruncated
SeTokenIsAdmin
FsRtlCheckLockForWriteAccess
RtlFreeUnicodeString
KeCancelTimer
ExAllocatePoolWithQuota
IoWMIRegistrationControl
PsDereferencePrimaryToken
KeSynchronizeExecution
RtlDelete
CcPreparePinWrite
RtlInsertUnicodePrefix
ZwOpenKey
ZwCreateDirectoryObject
ExRaiseDatatypeMisalignment
FsRtlFreeFileLock
ZwMakeTemporaryObject
ObReferenceObjectByPointer
PsImpersonateClient
MmSizeOfMdl
PsIsThreadTerminating
IoSetSystemPartition
RtlxAnsiStringToUnicodeSize
ZwOpenFile
KeInitializeTimerEx
RtlInitString
CcMdlRead
RtlMultiByteToUnicodeN
PoUnregisterSystemState
IoCreateSynchronizationEvent
RtlExtendedIntegerMultiply
MmUnmapIoSpace
IoCreateFile
IoConnectInterrupt
MmUnsecureVirtualMemory
KeSetSystemAffinityThread
IoRegisterDeviceInterface
KdDisableDebugger
MmIsDriverVerifying
RtlLengthSecurityDescriptor
CcCopyWrite
IoReleaseRemoveLockAndWaitEx
IoAllocateErrorLogEntry
CcCanIWrite
IoAllocateController
IoFreeErrorLogEntry
CcFlushCache
IoRaiseHardError
KeReadStateSemaphore
IoSetDeviceInterfaceState
KeSetImportanceDpc
MmSetAddressRangeModified
IoIsOperationSynchronous
RtlTimeToSecondsSince1970
ZwEnumerateValueKey
RtlAreBitsSet
RtlRandom
FsRtlIsHpfsDbcsLegal
ObfDereferenceObject
KeDetachProcess
RtlFindClearRuns
CcUnpinDataForThread
CcPurgeCacheSection
ZwMapViewOfSection
IoSetPartitionInformation
SeCreateClientSecurity
ExSystemTimeToLocalTime
ZwOpenProcess
IoDeviceObjectType
KeQuerySystemTime
IoRemoveShareAccess
KeLeaveCriticalRegion
FsRtlNotifyUninitializeSync
ObReferenceObjectByHandle
FsRtlDeregisterUncProvider
IoIsSystemThread
IoGetDeviceObjectPointer
RtlUnicodeStringToAnsiString
KeSetKernelStackSwapEnable
RtlRemoveUnicodePrefix
RtlEqualString
CcSetReadAheadGranularity
RtlUnicodeStringToOemString
ZwAllocateVirtualMemory
SeSetSecurityDescriptorInfo
IoInvalidateDeviceState
RtlInitializeSid
KeDeregisterBugCheckCallback
RtlInitAnsiString
ZwUnloadDriver
ExIsProcessorFeaturePresent
SeTokenIsRestricted
ZwDeleteValueKey
PsLookupThreadByThreadId
KdEnableDebugger
SeImpersonateClientEx
PoRequestPowerIrp
IoVerifyPartitionTable
HalExamineMBR
RtlUnicodeToOemN
KeStackAttachProcess
RtlGetCallersAddress
KeAttachProcess
RtlFindMostSignificantBit
IoUnregisterFileSystem
KeInitializeSpinLock
KeInitializeEvent
FsRtlFastCheckLockForRead
IoInvalidateDeviceRelations
RtlCopySid
IoDetachDevice
ExAllocatePoolWithTag
RtlDeleteNoSplay
FsRtlSplitLargeMcb
SeQueryInformationToken
IoCheckEaBufferValidity
PsGetCurrentThread
KeInitializeApc
IoGetRequestorProcessId
KeWaitForMultipleObjects
RtlGetNextRange
KeRemoveEntryDeviceQueue
IoFreeWorkItem
RtlUnicodeStringToInteger
KeQueryActiveProcessors
KeReleaseMutex
SeFreePrivileges
MmMapIoSpace
FsRtlIsTotalDeviceFailure
RtlPrefixUnicodeString
IoCreateStreamFileObjectLite
KeBugCheck
IoOpenDeviceRegistryKey
KeResetEvent
IoGetDeviceToVerify
MmBuildMdlForNonPagedPool
IoGetLowerDeviceObject
ZwEnumerateKey
ExGetExclusiveWaiterCount
IoDeleteDevice
FsRtlCheckLockForReadAccess
CcFastCopyWrite
KeInitializeSemaphore
PsTerminateSystemThread
FsRtlMdlWriteCompleteDev
IoAllocateMdl
IoAcquireVpbSpinLock
CcFastCopyRead
IoSetDeviceToVerify
RtlUnicodeToMultiByteN
IoGetDeviceProperty
RtlFillMemoryUlong
MmGetPhysicalAddress
CcGetFileObjectFromBcb
ZwSetVolumeInformationFile
RtlValidSid
ZwClose
RtlAnsiCharToUnicodeChar
PoStartNextPowerIrp
SeQueryAuthenticationIdToken
RtlAddAccessAllowedAce
KeReleaseSemaphore
ExDeletePagedLookasideList
ZwQueryKey
IoReportDetectedDevice
IoDeleteSymbolicLink
CcZeroData
DbgBreakPointWithStatus
IoGetDriverObjectExtension
MmProbeAndLockProcessPages
MmMapUserAddressesToPage
KeInitializeQueue
PoSetSystemState
KeClearEvent
IoCheckShareAccess
RtlAddAccessAllowedAceEx
MmUnmapReservedMapping
CcMdlWriteAbort
PsReturnPoolQuota
RtlTimeToTimeFields
IoSetTopLevelIrp
CcCopyRead
RtlAnsiStringToUnicodeString
KeDelayExecutionThread
KeSaveFloatingPointState
MmResetDriverPaging
SeSinglePrivilegeCheck
IofCompleteRequest
RtlxOemStringToUnicodeSize
MmUnmapLockedPages
SeCaptureSubjectContext
ExGetPreviousMode
RtlCreateSecurityDescriptor
RtlCreateUnicodeString
MmAllocateContiguousMemory
ExDeleteResourceLite
KeInsertByKeyDeviceQueue
IoAllocateIrp
IoCreateDevice
MmFreePagesFromMdl
RtlAppendStringToString
PsGetProcessId
MmUnlockPages
MmUnlockPagableImageSection
IoCreateSymbolicLink
IoGetAttachedDevice
KeSetPriorityThread
MmGetSystemRoutineAddress
ObCreateObject
KePulseEvent
RtlUpcaseUnicodeString
IoGetTopLevelIrp
KeRestoreFloatingPointState
MmFreeMappingAddress
SeOpenObjectAuditAlarm
FsRtlIsNameInExpression
IoSetPartitionInformationEx
IoStartPacket
KeQueryTimeIncrement
RtlSetBits
MmHighestUserAddress
MmIsVerifierEnabled
ObReleaseObjectSecurity
KeRemoveQueue
IoFreeMdl
ZwCreateKey
ZwSetValueKey
RtlFindClearBits
ExSetResourceOwnerPointer
IoGetRequestorProcess
SeFilterToken
KeInsertHeadQueue
FsRtlGetNextFileLock
RtlClearBits
KeBugCheckEx
RtlFindNextForwardRunClear
SeReleaseSubjectContext
ExGetSharedWaiterCount
SeAccessCheck
CcUnpinData
?CancelTimeNew@@IJGI@X
?MediaTypeA@@IJPAXPAJG@X
?DecrementProcessOld@@IJMPAH@X
?OnAnchorOld@@IJNJJ@X
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ