Extended Key Usages
ExtKeyUsageCodeSigning
Static task
static1
Behavioral task
behavioral1
Sample
klupd_klif_arkmon.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
klupd_klif_arkmon.exe
Resource
win10v2004-20230703-en
Target
klupd_klif_arkmon.sys
Size
359KB
MD5
f150f1f4d18a97bfd0e9d51959c00cc4
SHA1
59365fcdcc4821ae277317b8dd3afdec58b37926
SHA256
4f1201ff5672b359331bde06bbb0daff4f9665a01b69850b1c51de1670f37409
SHA512
5995919dd2cae5c0b001d0f87c2d219f4c8e5568a8f8000e838e26c54347ae563aa5cd1e33ac97188c7f4a064fe7d1972e6557577447edc5a57cff3ae5a4d051
SSDEEP
6144:7tDlEF1mQP9GzM9EjdXmrZFabGDVq9JBS:Bz29GzM9IdqFa62LS
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
MmIsAddressValid
ObfDereferenceObject
NtBuildNumber
ExDeleteResourceLite
KeEnterCriticalRegion
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseResourceLite
ExAllocatePoolWithTag
ExFreePoolWithTag
ExInitializeResourceLite
KeLeaveCriticalRegion
RtlInitAnsiString
KeDelayExecutionThread
MmHighestUserAddress
ObfReferenceObject
PsGetProcessId
PsInitialSystemProcess
PsLookupProcessByProcessId
RtlInt64ToUnicodeString
RtlInitUnicodeString
RtlCopyUnicodeString
RtlUnicodeStringToInteger
ZwEnumerateKey
ZwQueryValueKey
PsGetCurrentThreadId
ZwClose
ZwOpenKey
ZwOpenSection
ZwDuplicateObject
PsProcessType
MmMapIoSpace
MmGetPhysicalAddress
ObReferenceObjectByHandle
MmGetVirtualForPhysical
MmGetSystemRoutineAddress
ZwTerminateProcess
ExQueueWorkItem
KeSetEvent
KeInitializeEvent
KeWaitForSingleObject
__C_specific_handler
IoGetCurrentProcess
PsGetCurrentProcessId
PsThreadType
PsGetThreadProcess
IoDeleteDevice
InitSafeBootMode
IoCreateSymbolicLink
IoRegisterBootDriverReinitialization
DbgPrint
RtlUpcaseUnicodeString
RtlUpperString
RtlInitializeGenericTable
RtlDeleteElementGenericTable
RtlInsertElementGenericTable
PsGetProcessCreateTimeQuadPart
RtlLookupElementGenericTable
ExRundownCompleted
KeSetTimer
KeInitializeDpc
RtlEqualUnicodeString
PsCreateSystemThread
ExWaitForRundownProtectionRelease
ExReInitializeRundownProtection
ExInitializeRundownProtection
KeInitializeTimer
ObOpenObjectByPointer
ExAcquireRundownProtection
ExReleaseRundownProtection
RtlUnicodeToMultiByteN
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwSetValueKey
ZwCreateKey
RtlFreeUnicodeString
KeReleaseInStackQueuedSpinLock
KeGetCurrentIrql
ExpInterlockedPopEntrySList
RtlTimeToTimeFields
ExDeleteNPagedLookasideList
ExpInterlockedPushEntrySList
KeInitializeSpinLock
ExQueryDepthSList
ZwWriteFile
ExInitializeNPagedLookasideList
KeAcquireInStackQueuedSpinLock
ExSystemTimeToLocalTime
RtlCompareUnicodeString
RtlAppendUnicodeStringToString
ObQueryNameString
IoFileObjectType
ZwOpenFile
PsGetVersion
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
KeLowerIrql
IoFreeMdl
KfRaiseIrql
MmUnmapLockedPages
MmMapLockedPagesSpecifyCache
RtlCompareMemory
IoBuildDeviceIoControlRequest
IofCompleteRequest
RtlAnsiStringToUnicodeString
FsRtlIsNameInExpression
RtlxAnsiStringToUnicodeSize
RtlxUnicodeStringToAnsiSize
RtlUnicodeStringToAnsiString
FsRtlIsDbcsInExpression
wcsrchr
RtlFreeAnsiString
ZwQuerySystemInformation
strchr
MmSystemRangeStart
RtlPrefixUnicodeString
RtlCompareString
KeStackAttachProcess
KeUnstackDetachProcess
MmUnmapIoSpace
MmGetPhysicalMemoryRanges
IoGetDeviceObjectPointer
IofCallDriver
atoi
MmIsDriverVerifying
RtlGetVersion
PsGetProcessWow64Process
PsGetProcessPeb
SeQueryAuthenticationIdToken
PsDereferencePrimaryToken
ZwQueryInformationProcess
PsGetProcessSessionId
PsGetThreadId
PsGetProcessImageFileName
PsGetProcessInheritedFromUniqueProcessId
PsReferencePrimaryToken
PsGetThreadProcessId
ZwOpenThread
PsGetThreadWin32Thread
CmUnRegisterCallback
PsGetProcessExitStatus
PsGetThreadTeb
PsGetProcessSectionBaseAddress
IoDriverObjectType
PsSetLoadImageNotifyRoutine
PsSetCreateThreadNotifyRoutine
PsSetCreateProcessNotifyRoutine
RtlVolumeDeviceToDosName
wcsstr
PsIsThreadTerminating
KeInitializeApc
MmProtectMdlSystemAddress
MmProbeAndLockProcessPages
KeInsertQueueApc
ZwCreateEvent
ZwFreeVirtualMemory
ZwOpenDirectoryObject
KeSetImportanceDpc
KeInsertQueueDpc
KeNumberProcessors
KeSetTargetProcessorDpc
isdigit
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ