ntoskrnl[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ntoskrnl.exe
Size

11.5MB
MD5

133a2649ba183dc8e6a5669a9097fe77
SHA1

a02385b40281c1d2e0a5ba0b22231186cf27e5b4
SHA256

34eff4651d8d2305ab77eebc6dbbb94b193fa1d9382d5cab7beb60191a71a982
SHA512

0681a13e9dfa395b2c5722c2c0b1b27f3cdef529d0f176ba486a69c083e32db9db637e6618ac00cf9a520fb9b17e97f55a8620769ecc75089f54850898649981
SSDEEP

98304:kslKfIrm+oSXhkmriXD3O3Gii7EmtP+OBLKwkcz5AQAmB/wZwf1Cn/q5wQ:EfI6+oQaDJiItWOEJSqn5Zwf0n/q

Score

1^/10

Malware Config

Signatures

Files

ntoskrnl.exe
.sys windows:10 windows x64 arch:x64

8a6a24dc179d1d583e1d3b5fddaea3d6

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:b2:0e:4e:03:c4:51:34:2f:6d:24:f5:f8:0b:d7:50:ec:6b:5a:59:44:07:9a:62:13:a6:11:ff:a8:1e:3c:81
Signer

Actual PE Digest

91:b2:0e:4e:03:c4:51:34:2f:6d:24:f5:f8:0b:d7:50:ec:6b:5a:59:44:07:9a:62:13:a6:11:ff:a8:1e:3c:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ntkrnlmp.pdb

Imports

ext-ms-win-ntos-processparameters-l1-1-0

PsDestroyProcessParameterOverrides
PsGetProcessParameterOverrides

ext-ms-win-ntos-tm-l1-1-0

TmIsKTMCommitCoordinator
TmInitializeTransactionManager
TmGetTransactionId
TmFreezeTransactions
TmEndPropagationRequest
TmEnableCallbacks
TmDereferenceEnlistmentKey
TmCurrentTransaction
TmCreateEnlistment
TmCommitTransaction
TmCommitEnlistment
TmCommitComplete
TmCancelPropagationRequest
NtThawTransactions
NtSetInformationTransaction
NtSetInformationResourceManager
NtSetInformationEnlistment
NtRollbackTransaction
NtRollbackEnlistment
NtRollbackComplete
NtRecoverTransactionManager
NtRecoverResourceManager
NtRecoverEnlistment
NtRegisterProtocolAddressInformation
TmIsTransactionActive
TmInitSystemPhase2
TmInitSystem
NtCommitComplete
NtCommitEnlistment
TmPrePrepareComplete
TmRecoverEnlistment
TmRecoverResourceManager
TmRecoverTransactionManager
TmReferenceEnlistmentKey
TmRenameTransactionManager
TmRequestOutcomeEnlistment
TmRollbackComplete
TmRollbackEnlistment
TmRollbackTransaction
TmSetCurrentTransaction
TmSinglePhaseReject
NtCommitTransaction
TmShutdownSystem
NtRollforwardTransactionManager
NtSinglePhaseReject
NtCreateEnlistment
NtCreateResourceManager
NtSetInformationTransactionManager
NtRenameTransactionManager
NtCreateTransaction
TmThawTransactions
NtCreateTransactionManager
NtEnumerateTransactionObject
NtFreezeTransactions
NtGetNotificationResourceManager
NtOpenEnlistment
NtOpenResourceManager
NtOpenTransaction
NtOpenTransactionManager
NtPrePrepareComplete
TmPrePrepareEnlistment
TmPrepareComplete
TmPrepareEnlistment
TmPropagationComplete
TmReadOnlyEnlistment
TmPropagationFailed
NtReadOnlyEnlistment
NtQueryInformationTransactionManager
NtQueryInformationTransaction
NtQueryInformationResourceManager
NtQueryInformationEnlistment
NtPropagationFailed
NtPropagationComplete
NtPrepareEnlistment
NtPrepareComplete
NtPrePrepareEnlistment

pshed

PshedGetBootErrorPacket
PshedInitialize
PshedGetAllErrorSources
PshedAttemptErrorRecovery
PshedWriteErrorRecord
PshedBugCheckSystem
PshedFreeMemory
PshedDoPluginCtl
PshedAllocateMemory
PshedDoPfa
PshedEnableErrorSource
PshedGetInjectionCapabilities
PshedInjectError
PshedSetErrorSourceInfo
PshedSetHalEnlightenments
PshedMarkHiberPhase
PshedInitProc
PshedIsSystemWheaEnabled
PshedClearErrorRecord
PshedArePluginsPresent
PshedReadErrorRecord
PshedInitGlobal
PshedDisableErrorSource
PshedInitAvailable
PshedGetErrorSourceInfo
PshedFinalizeErrorRecord
PshedRetrieveErrorInfo

bootvid

VidInitialize
VidBitBltEx
VidDisplayString
VidSetScrollRegion
VidSetTextColor
VidCleanUp
VidBitBlt
VidScreenToBufferBlt
VidBufferToScreenBlt
VidSolidColorFill
VidResetDisplay

ext-ms-win-ntos-clipsp-l1-1-0

ClipSpInitialize

kdcom

KdSetHiberRange
KdInitialize
KdSendPacket
KdReceivePacket
KdPower

ext-ms-win-ntos-kcminitcfg-l1-1-0

CmCompleteInitMachineConfig
CmSetInitMachineConfig

ext-ms-win-ntos-ksr-l1-1-4

KsrCleanupPageDatabase
KsrInitPageDatabase
KsrFreePersistedMemory
KsrInitSystem
KsrMdlToMemoryRuns
KsrFreePersistedMemoryBlock
KsrQueryMetadata
KsrEnumeratePersistedMemory
KsrGetFirmwareInformation
KsrClaimPersistedMemory
KsrPersistMemoryWithMetadata

ext-ms-win-ntos-trace-l1-1-0

TraceInitSystem

ext-ms-win-ntos-ksecurity-l1-1-1

QueryUpdateFileEaAllowedExt

ext-ms-win-ntos-werkernel-l1-1-1

WerLiveKernelCancelReport
WerLiveKernelSubmitReport
WerLiveKernelInitSystem
WerLiveKernelCreateReport
WerLiveKernelCloseHandle
WerLiveKernelOpenDumpFile

ext-ms-win-ntos-ucode-l1-1-0

ExpMicrocodeInformationLoad
ExpMicrocodeInformationUnload
ExpMicrocodeInitialization

ext-ms-win-ntos-runlevels-l1-1-0

ExpInitializeRunLevel0

ext-ms-win-ntos-stateseparation-l1-1-0

ExpInitializeStateSeparationPhase1
ExpInitializeStateSeparationPhase0
ExpInitializeStateSeparationPhase2

ext-ms-win-fs-clfs-l1-1-0

ClfsMgmtInstallPolicy
ClfsCloseLogFileObject
ClfsMgmtDeregisterManagedClient
ClfsMgmtRegisterManagedClient
ClfsCreateLogFile
ClfsGetLogFileInformation
ClfsReadRestartArea
ClfsLsnEqual
ClfsReadLogRecord
ClfsReadNextLogRecord
ClfsTerminateReadLog
ClfsWriteRestartArea
ClfsDeleteLogByPointer
ClfsDeleteMarshallingArea
ClfsReserveAndAppendLog
ClfsLsnInvalid
ClfsFlushToLsn
ClfsLsnContainer
ClfsLsnLess
ClfsCreateMarshallingArea
ClfsAddLogContainer
ClfsLsnDifference

ci

CiInitialize

msrpc.sys

MesIncrementalHandleReset
NdrMesTypeDecode3
MesEncodeIncrementalHandleCreate
NdrMesTypeEncode3
MesDecodeBufferHandleCreate
MesHandleFree
RpcExceptionFilter

cng.sys

BCryptExportKey

ext-ms-win-ntos-globmerger-l1-1-0

CimfsMountBootVolume

Exports

Exports

AlpcCreateSecurityContext
AlpcGetHeaderSize
AlpcGetMessageAttribute
AlpcInitializeMessageAttribute
AsanWrapperMemcmp
BgkDisplayCharacter
BgkGetConsoleState
BgkGetCursorState
BgkSetCursor
CarCopyRuleViolationDetails
CarCreateRuleViolationDetails
CarDeleteRuleViolationDetails
CarDeregisterRuleClassConfiguration
CarDeregisterRuleOverride
CarInitializeRuleViolationDetails
CarQueryReportAction
CarQueryReportActionForTriage
CarRegisterDefaultRuleClassConfiguration
CarRegisterRuleClassConfiguration
CarRegisterRuleOverride
CarRegisterRuleOverrideAllContexts
CarRegisterRuleOverridesAllContexts
CarReportRuleViolation
CarReportRuleViolationForTriage
CarSetCustomIdInRuleOverride
CarSetCustomRuleIdRange
CcAddDirtyPagesToExternalCache
CcAsyncCopyRead
CcCanIWrite
CcCoherencyFlushAndPurgeCache
CcCopyRead
CcCopyReadEx
CcCopyWrite
CcCopyWriteEx
CcCopyWriteWontFlush
CcDeductDirtyPagesFromExternalCache
CcDeferWrite
CcErrorCallbackRoutine
CcFastCopyRead
CcFastCopyWrite
CcFastMdlReadWait
CcFlushCache
CcFlushCacheToLsn
CcGetCachedDirtyPageCountForFile
CcGetDirtyPages
CcGetFileObjectFromBcb
CcGetFileObjectFromSectionPtrs
CcGetFileObjectFromSectionPtrsRef
CcGetFlushedValidData
CcGetLsnForFileObject
CcGetNumberOfMappedPages
CcInitializeCacheMap
CcInitializeCacheMapEx
CcInitializeCacheMapEx2
CcIsCacheManagerCallbackNeeded
CcIsThereDirtyData
CcIsThereDirtyDataEx
CcIsThereDirtyLoggedPages
CcMapData
CcMdlRead
CcMdlReadComplete
CcMdlWriteAbort
CcMdlWriteComplete
CcPinMappedData
CcPinRead
CcPrepareMdlWrite
CcPreparePinWrite
CcPurgeCacheSection
CcRegisterExternalCache
CcRemapBcb
CcRepinBcb
CcScheduleReadAhead
CcScheduleReadAheadEx
CcSetAdditionalCacheAttributes
CcSetAdditionalCacheAttributesEx
CcSetBcbOwnerPointer
CcSetDirtyPageThreshold
CcSetDirtyPinnedData
CcSetFileSizes
CcSetFileSizesEx
CcSetLogHandleForFile
CcSetLogHandleForFileEx
CcSetLoggedDataThreshold
CcSetParallelFlushFile
CcSetReadAheadGranularity
CcSetReadAheadGranularityEx
CcTestControl
CcUninitializeCacheMap
CcUnmapFileOffsetFromSystemCache
CcUnpinData
CcUnpinDataForThread
CcUnpinRepinnedBcb
CcUnregisterExternalCache
CcWaitForCurrentLazyWriterActivity
CcZeroData
CcZeroDataOnDisk
CmCallbackGetKeyObjectID
CmCallbackGetKeyObjectIDEx
CmCallbackReleaseKeyObjectIDEx
CmGetBoundTransaction
CmGetCallbackVersion
CmKeyObjectType
CmRegisterCallback
CmRegisterCallbackEx
CmRegisterMachineHiveLoadedNotification
CmSetCallbackObjectContext
CmUnRegisterCallback
CmUnregisterMachineHiveLoadedNotification
DbgBreakPoint
DbgBreakPointWithStatus
DbgCommandString
DbgLoadImageSymbols
DbgPrint
DbgPrintEx
DbgPrintReturnControlC
DbgPrompt
DbgQueryDebugFilterState
DbgSetDebugFilterState
DbgSetDebugPrintCallback
DbgkLkmdRegisterCallback
DbgkLkmdUnregisterCallback
DbgkWerCaptureLiveKernelDump
DbgkWerCaptureLiveKernelDump2
DifFindThreadContextData
DifGetPluginPerDriverData
DifPluginSimplePerfControl
DifPopThreadContextData
DifPushThreadContextData
DifRegisterPlugin
DifUtilDbgPrint
EmClientQueryRuleState
EmClientRuleDeregisterNotification
EmClientRuleEvaluate
EmClientRuleRegisterNotification
EmProviderDeregister
EmProviderDeregisterEntry
EmProviderRegister
EmProviderRegisterEntry
EmpProviderRegister
EtwActivityIdControl
EtwEnableTrace
EtwEventEnabled
EtwProviderEnabled
EtwRegister
EtwRegisterClassicProvider
EtwSendTraceBuffer
EtwSetInformation
EtwTelemetryCoverageReport
EtwUnregister
EtwWrite
EtwWriteEndScenario
EtwWriteEx
EtwWriteStartScenario
EtwWriteString
EtwWriteTransfer
EtwpDisableStackWalkApc
EtwpReenableStackWalkApc
ExAcquireAutoExpandPushLockExclusive
ExAcquireAutoExpandPushLockShared
ExAcquireCacheAwarePushLockExclusive
ExAcquireCacheAwarePushLockExclusiveEx
ExAcquireCacheAwarePushLockSharedEx
ExAcquireFastMutex
ExAcquireFastMutexUnsafe
ExAcquireFastResourceExclusive
ExAcquireFastResourceShared
ExAcquireFastResourceSharedStarveExclusive
ExAcquireFastResourceWithFlags
ExAcquirePushLockExclusiveEx
ExAcquirePushLockSharedEx
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExAcquireRundownProtection
ExAcquireRundownProtectionCacheAware
ExAcquireRundownProtectionCacheAwareEx
ExAcquireRundownProtectionEx
ExAcquireSharedStarveExclusive
ExAcquireSharedWaitForExclusive
ExAcquireSpinLockExclusive
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockShared
ExAcquireSpinLockSharedAtDpcLevel
ExActivationObjectType
ExAllocateAutoExpandPushLock
ExAllocateCacheAwarePushLock
ExAllocateCacheAwareRundownProtection
ExAllocateFromLookasideListEx
ExAllocateFromNPagedLookasideList
ExAllocateFromPagedLookasideList
ExAllocatePool
ExAllocatePool2
ExAllocatePool3
ExAllocatePoolWithQuota
ExAllocatePoolWithQuotaTag
ExAllocatePoolWithTag
ExAllocatePoolWithTagPriority
ExAllocateTimer
ExBlockOnAddressPushLock
ExBlockPushLock
ExCancelDpcEventWait
ExCancelTimer
ExCleanupAutoExpandPushLock
ExCleanupRundownProtectionCacheAware
ExCompositionObjectType
ExConvertExclusiveToSharedLite
ExConvertFastResourceExclusiveToShared
ExConvertPushLockExclusiveToShared
ExCoreMessagingObjectType
ExCreateCallback
ExCreateDpcEvent
ExCreatePool
ExDeleteDpcEvent
ExDeleteFastResource
ExDeleteLookasideListEx
ExDeleteNPagedLookasideList
ExDeletePagedLookasideList
ExDeleteResourceLite
ExDeleteTimer
ExDesktopObjectType
ExDestroyPool
ExDisableResourceBoostLite
ExDisownFastResource
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
ExEnterCriticalRegionAndAcquireResourceExclusive
ExEnterCriticalRegionAndAcquireResourceShared
ExEnterCriticalRegionAndAcquireSharedWaitForExclusive
ExEnterPriorityRegionAndAcquireResourceExclusive
ExEnterPriorityRegionAndAcquireResourceShared
ExEnumHandleTable
ExEnumerateSystemFirmwareTables
ExEventObjectType
ExExtendZone
ExFetchLicenseData
ExFlushLookasideListEx
ExFreeAutoExpandPushLock
ExFreeCacheAwarePushLock
ExFreeCacheAwareRundownProtection
ExFreePool
ExFreePool2
ExFreePoolWithTag
ExFreeToLookasideListEx
ExFreeToNPagedLookasideList
ExFreeToPagedLookasideList
ExGetCurrentProcessorCounts
ExGetCurrentProcessorCpuUsage
ExGetExclusiveWaiterCount
ExGetFirmwareEnvironmentVariable
ExGetFirmwareType
ExGetLicenseTamperState
ExGetPreviousMode
ExGetSharedWaiterCount
ExGetSystemFirmwareTable
ExInitializeAutoExpandPushLock
ExInitializeDeviceAts
ExInitializeFastOwnerEntry
ExInitializeFastResource
ExInitializeFastResourceAcquired
ExInitializeLookasideListEx
ExInitializeNPagedLookasideList
ExInitializePagedLookasideList
ExInitializePushLock
ExInitializeResourceLite
ExInitializeRundownProtection
ExInitializeRundownProtectionCacheAware
ExInitializeRundownProtectionCacheAwareEx
ExInitializeZone
ExInterlockedAddLargeInteger
ExInterlockedAddUlong
ExInterlockedExtendZone
ExInterlockedInsertHeadList
ExInterlockedInsertTailList
ExInterlockedPopEntryList
ExInterlockedPushEntryList
ExInterlockedRemoveHeadList
ExIsFastResourceContended
ExIsFastResourceHeld
ExIsFastResourceHeldExclusive
ExIsManufacturingModeEnabled
ExIsProcessorFeaturePresent
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
ExIsSoftBoot
ExLocalTimeToSystemTime
ExMoveFastResourceOwnershipWithFlags
ExNotifyBootDeviceRemoval
ExNotifyCallback
ExQueryDepthSList
ExQueryFastCacheDevLicense
ExQueryPoolBlockSize
ExQueryTimerResolution
ExQueryWnfStateData
ExQueueDpcEventWait
ExQueueWorkItem
ExRaiseAccessViolation
ExRaiseDatatypeMisalignment
ExRaiseException
ExRaiseHardError
ExRaiseStatus
ExRawInputManagerObjectType
ExReInitializeRundownProtection
ExReInitializeRundownProtectionCacheAware
ExRealTimeIsUniversal
ExRegisterBootDevice
ExRegisterCallback
ExRegisterExtension
ExReinitializeFastResource
ExReinitializeResourceLite
ExReleaseAutoExpandPushLockExclusive
ExReleaseAutoExpandPushLockShared
ExReleaseCacheAwarePushLockExclusive
ExReleaseCacheAwarePushLockExclusiveEx
ExReleaseCacheAwarePushLockSharedEx
ExReleaseDisownedFastResource
ExReleaseDisownedFastResourceExclusive
ExReleaseDisownedFastResourceShared
ExReleaseFastMutex
ExReleaseFastMutexUnsafe
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
ExReleaseFastResource
ExReleaseFastResourceExclusive
ExReleaseFastResourceShared
ExReleasePushLockEx
ExReleasePushLockExclusiveEx
ExReleasePushLockSharedEx
ExReleaseResourceAndLeaveCriticalRegion
ExReleaseResourceAndLeavePriorityRegion
ExReleaseResourceForThreadLite
ExReleaseResourceLite
ExReleaseRundownProtection
ExReleaseRundownProtectionCacheAware
ExReleaseRundownProtectionCacheAwareEx
ExReleaseRundownProtectionEx
ExReleaseSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockShared
ExReleaseSpinLockSharedFromDpcLevel
ExRundownCompleted
ExRundownCompletedCacheAware
ExSecurePoolUpdate
ExSecurePoolValidate
ExSemaphoreObjectType
ExSetFirmwareEnvironmentVariable
ExSetLicenseTamperState
ExSetResourceOwnerPointer
ExSetResourceOwnerPointerEx
ExSetTimer
ExSetTimerResolution
ExShareAddressSpaceWithDevice
ExShareUltraSpaceWithDevice
ExSizeOfAutoExpandPushLock
ExSizeOfRundownProtectionCacheAware
ExSubscribeWnfStateChange
ExSvmBeginDeviceReset
ExSvmFinalizeDeviceReset
ExSystemExceptionFilter
ExSystemTimeToLocalTime
ExTimedWaitForUnblockPushLock
ExTimerObjectType
ExTryAcquireAutoExpandPushLockExclusive
ExTryAcquireAutoExpandPushLockShared
ExTryAcquireCacheAwarePushLockExclusiveEx
ExTryAcquireCacheAwarePushLockSharedEx
ExTryAcquirePushLockExclusiveEx
ExTryAcquirePushLockSharedEx
ExTryAcquireSpinLockExclusiveAtDpcLevel
ExTryAcquireSpinLockSharedAtDpcLevel
ExTryConvertPushLockSharedToExclusiveEx
ExTryConvertSharedSpinLockExclusive
ExTryQueueWorkItem
ExTryToAcquireFastMutex
ExTryToAcquireResourceExclusiveLite
ExTryToConvertFastResourceSharedToExclusive
ExUnblockOnAddressPushLockEx
ExUnblockPushLockEx
ExUnregisterCallback
ExUnregisterExtension
ExUnsubscribeWnfStateChange
ExUpdateLicenseData
ExUuidCreate
ExVerifySuite
ExWaitForRundownProtectionRelease
ExWaitForRundownProtectionReleaseCacheAware
ExWaitForUnblockPushLock
ExWindowStationObjectType
ExfAcquirePushLockExclusive
ExfAcquirePushLockShared
ExfReleasePushLock
ExfReleasePushLockExclusive
ExfReleasePushLockShared
ExfTryAcquirePushLockShared
ExfTryToWakePushLock
ExfUnblockPushLock
ExpInterlockedFlushSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
FirstEntrySList
FsRtlAcknowledgeEcp
FsRtlAcquireEofLock
FsRtlAcquireFileExclusive
FsRtlAcquireHeaderMutex
FsRtlAddBaseMcbEntry
FsRtlAddBaseMcbEntryEx
FsRtlAddLargeMcbEntry
FsRtlAddMcbEntry
FsRtlAddToTunnelCache
FsRtlAddToTunnelCacheEx
FsRtlAllocateAePushLock
FsRtlAllocateExtraCreateParameter
FsRtlAllocateExtraCreateParameterFromLookasideList
FsRtlAllocateExtraCreateParameterList
FsRtlAllocateFileLock
FsRtlAllocatePool
FsRtlAllocatePoolWithQuota
FsRtlAllocatePoolWithQuotaTag
FsRtlAllocatePoolWithTag
FsRtlAllocateResource
FsRtlAreNamesEqual
FsRtlAreThereCurrentOrInProgressFileLocks
FsRtlAreThereWaitingFileLocks
FsRtlAreVolumeStartupApplicationsComplete
FsRtlBalanceReads
FsRtlCancellableWaitForMultipleObjects
FsRtlCancellableWaitForSingleObject
FsRtlChangeBackingFileObject
FsRtlCheckLockForOplockRequest
FsRtlCheckLockForReadAccess
FsRtlCheckLockForWriteAccess
FsRtlCheckOplock
FsRtlCheckOplockEx
FsRtlCheckOplockEx2
FsRtlCheckOplockForFsFilterCallback
FsRtlCheckUpperOplock
FsRtlCopyRead
FsRtlCopyWrite
FsRtlCreateSectionForDataScan
FsRtlCurrentBatchOplock
FsRtlCurrentOplock
FsRtlCurrentOplockH
FsRtlDedupChangeInit
FsRtlDedupChangeLogOverwriteOrFree
FsRtlDedupChangeLogWrite
FsRtlDedupChangeUninit
FsRtlDeleteExtraCreateParameterLookasideList
FsRtlDeleteKeyFromTunnelCache
FsRtlDeleteTunnelCache
FsRtlDeregisterUncProvider
FsRtlDisallowLegacyFilterOnDevice
FsRtlDismountComplete
FsRtlDissectDbcs
FsRtlDissectName
FsRtlDoesDbcsContainWildCards
FsRtlDoesNameContainWildCards
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlFastUnlockSingle
FsRtlFindExtraCreateParameter
FsRtlFindInTunnelCache
FsRtlFindInTunnelCacheEx
FsRtlFreeAePushLock
FsRtlFreeExtraCreateParameter
FsRtlFreeExtraCreateParameterList
FsRtlFreeFileLock
FsRtlGetCurrentProcessLoaderList
FsRtlGetEcpListFromIrp
FsRtlGetFileNameInformation
FsRtlGetFileSize
FsRtlGetIoAtEof
FsRtlGetNextBaseMcbEntry
FsRtlGetNextExtraCreateParameter
FsRtlGetNextFileLock
FsRtlGetNextLargeMcbEntry
FsRtlGetNextMcbEntry
FsRtlGetSectorSizeInformation
FsRtlGetSupportedFeatures
FsRtlGetVirtualDiskNestingLevel
FsRtlHeatInit
FsRtlHeatLogIo
FsRtlHeatLogTierMove
FsRtlHeatUninit
FsRtlIncrementCcFastMdlReadWait
FsRtlIncrementCcFastReadNoWait
FsRtlIncrementCcFastReadNotPossible
FsRtlIncrementCcFastReadResourceMiss
FsRtlIncrementCcFastReadWait
FsRtlInitExtraCreateParameterLookasideList
FsRtlInitializeBaseMcb
FsRtlInitializeBaseMcbEx
FsRtlInitializeEofLock
FsRtlInitializeExtraCreateParameter
FsRtlInitializeExtraCreateParameterList
FsRtlInitializeFileLock
FsRtlInitializeLargeMcb
FsRtlInitializeMcb
FsRtlInitializeOplock
FsRtlInitializeTunnelCache
FsRtlInsertExtraCreateParameter
FsRtlInsertPerFileContext
FsRtlInsertPerFileObjectContext

Sections

.rdata
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 460KB - Virtual size: 456KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.edata
Size: 108KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PROTDATA
Size: 4KB - Virtual size: 1B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

GFIDS
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Pad1
Size: - Virtual size: 584KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGE
Size: 4.0MB - Virtual size: 4.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGELK
Size: 156KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

POOLCODE
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEKD
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEVRFY
Size: 204KB - Virtual size: 201KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEHDLS
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGEBGFX
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

TRACESUP
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

PAGECMRC
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

KVASCODE
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

RETPOL
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INITKDBG
Size: 104KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

MINIEX
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 600KB - Virtual size: 599KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Pad2
Size: - Virtual size: 340KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 56KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ALMOSTRO
Size: 8KB - Virtual size: 174KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CACHEALI
Size: 4KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEDATA
Size: 12KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGEVRFD
Size: 40KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INITDATA
Size: 4KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Pad3
Size: - Virtual size: 396KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

CFGRO
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Pad4
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 240KB - Virtual size: 239KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 44KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8a6a24dc179d1d583e1d3b5fddaea3d6

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

91:b2:0e:4e:03:c4:51:34:2f:6d:24:f5:f8:0b:d7:50:ec:6b:5a:59:44:07:9a:62:13:a6:11:ff:a8:1e:3c:81Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ext-ms-win-ntos-processparameters-l1-1-0

ext-ms-win-ntos-tm-l1-1-0

pshed

bootvid

ext-ms-win-ntos-clipsp-l1-1-0

kdcom

ext-ms-win-ntos-kcminitcfg-l1-1-0

ext-ms-win-ntos-ksr-l1-1-4

ext-ms-win-ntos-trace-l1-1-0

ext-ms-win-ntos-ksecurity-l1-1-1

ext-ms-win-ntos-werkernel-l1-1-1

ext-ms-win-ntos-ucode-l1-1-0

ext-ms-win-ntos-runlevels-l1-1-0

ext-ms-win-ntos-stateseparation-l1-1-0

ext-ms-win-fs-clfs-l1-1-0

ci

msrpc.sys

cng.sys

ext-ms-win-ntos-globmerger-l1-1-0

Exports

Exports

Sections

.rdata Size: 832KB - Virtual size: 831KB

.pdata Size: 460KB - Virtual size: 456KB

.idata Size: 12KB - Virtual size: 8KB

.edata Size: 108KB - Virtual size: 105KB

PROTDATA Size: 4KB - Virtual size: 1B

GFIDS Size: 44KB - Virtual size: 40KB

Pad1 Size: - Virtual size: 584KB

.text Size: 4.5MB - Virtual size: 4.5MB

PAGE Size: 4.0MB - Virtual size: 4.0MB

PAGELK Size: 156KB - Virtual size: 155KB

POOLCODE Size: 8KB - Virtual size: 4KB

PAGEKD Size: 24KB - Virtual size: 23KB

PAGEVRFY Size: 204KB - Virtual size: 201KB

PAGEHDLS Size: 12KB - Virtual size: 9KB

PAGEBGFX Size: 28KB - Virtual size: 26KB

TRACESUP Size: 8KB - Virtual size: 6KB

PAGECMRC Size: 4KB - Virtual size: 3KB

KVASCODE Size: 12KB - Virtual size: 9KB

RETPOL Size: 4KB - Virtual size: 2KB

INITKDBG Size: 104KB - Virtual size: 102KB

MINIEX Size: 12KB - Virtual size: 9KB

INIT Size: 600KB - Virtual size: 599KB

Pad2 Size: - Virtual size: 340KB

.data Size: 56KB - Virtual size: 1.1MB

ALMOSTRO Size: 8KB - Virtual size: 174KB

CACHEALI Size: 4KB - Virtual size: 36KB

PAGEDATA Size: 12KB - Virtual size: 78KB

PAGEVRFD Size: 40KB - Virtual size: 101KB

INITDATA Size: 4KB - Virtual size: 113KB

Pad3 Size: - Virtual size: 396KB

CFGRO Size: 12KB - Virtual size: 8KB

Pad4 Size: - Virtual size: 2.0MB

.rsrc Size: 240KB - Virtual size: 239KB

.reloc Size: 44KB - Virtual size: 41KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

91:b2:0e:4e:03:c4:51:34:2f:6d:24:f5:f8:0b:d7:50:ec:6b:5a:59:44:07:9a:62:13:a6:11:ff:a8:1e:3c:81
Signer

.rdata
Size: 832KB - Virtual size: 831KB

.pdata
Size: 460KB - Virtual size: 456KB

.idata
Size: 12KB - Virtual size: 8KB

.edata
Size: 108KB - Virtual size: 105KB

PROTDATA
Size: 4KB - Virtual size: 1B

GFIDS
Size: 44KB - Virtual size: 40KB

Pad1
Size: - Virtual size: 584KB

.text
Size: 4.5MB - Virtual size: 4.5MB

PAGE
Size: 4.0MB - Virtual size: 4.0MB

PAGELK
Size: 156KB - Virtual size: 155KB

POOLCODE
Size: 8KB - Virtual size: 4KB

PAGEKD
Size: 24KB - Virtual size: 23KB

PAGEVRFY
Size: 204KB - Virtual size: 201KB

PAGEHDLS
Size: 12KB - Virtual size: 9KB

PAGEBGFX
Size: 28KB - Virtual size: 26KB

TRACESUP
Size: 8KB - Virtual size: 6KB

PAGECMRC
Size: 4KB - Virtual size: 3KB

KVASCODE
Size: 12KB - Virtual size: 9KB

RETPOL
Size: 4KB - Virtual size: 2KB

INITKDBG
Size: 104KB - Virtual size: 102KB

MINIEX
Size: 12KB - Virtual size: 9KB

INIT
Size: 600KB - Virtual size: 599KB

Pad2
Size: - Virtual size: 340KB

.data
Size: 56KB - Virtual size: 1.1MB

ALMOSTRO
Size: 8KB - Virtual size: 174KB

CACHEALI
Size: 4KB - Virtual size: 36KB

PAGEDATA
Size: 12KB - Virtual size: 78KB

PAGEVRFD
Size: 40KB - Virtual size: 101KB

INITDATA
Size: 4KB - Virtual size: 113KB

Pad3
Size: - Virtual size: 396KB

CFGRO
Size: 12KB - Virtual size: 8KB

Pad4
Size: - Virtual size: 2.0MB

.rsrc
Size: 240KB - Virtual size: 239KB

.reloc
Size: 44KB - Virtual size: 41KB