win32k24[.]sys

Sharing

Copy URL Twitter E-mail

General

Target

win32k24.sys
Size

769KB
MD5

83d4f6bfe1f83ca44ca10e804fa7c5b1
SHA1

1d26f8feaeabcc953d723835714bbb868a264773
SHA256

9b53d8d53a48bc9e7b6a0296b1014775feeb041cbcae8d756f03b6c5dd7beb1e
SHA512

d34da7336ee79e4d0a75cbf6566873e1be63068f85dbb0c1e03cd76fc323fdbd6d76b800287fa9f0a73242deb6b84775f74e259031a3970e9517ed397ed849e5
SSDEEP

12288:62BSIIHzPhBCElRIY5Wsby+vQ9JK97knPJGtjJFcoD7cRDL:zSlztDM

Score

1^/10

Malware Config

Signatures

Files

win32k24.sys
.sys windows:10 windows x64 arch:x64

cebb471ce9772b34b24ce4584d81c008

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a7:88:52:8b:46:f2:57:a3:63:34:39:10:41:9e:c1:2b:d5:da:35:f0:4f:00:1b:73:a1:e3:df:3d:84:ff:2d:59
Signer

Actual PE Digest

a7:88:52:8b:46:f2:57:a3:63:34:39:10:41:9e:c1:2b:d5:da:35:f0:4f:00:1b:73:a1:e3:df:3d:84:ff:2d:59

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

win32k.pdb

Imports

ntoskrnl.exe

ExAllocatePoolWithTag
IoGetDeviceObjectPointer
ZwLoadDriver
ZwUnloadDriver
KeDelayExecutionThread
RtlQueryRegistryValues
KeWaitForSingleObject
IofCallDriver
IoBuildDeviceIoControlRequest
ExAcquirePushLockExclusiveEx
ExReleasePushLockExclusiveEx
KeEnterCriticalRegion
ExAcquirePushLockSharedEx
ExReleasePushLockSharedEx
KeLeaveCriticalRegion
ObfDereferenceObject
ObfReferenceObject
ObfReferenceObjectWithTag
PsDetachSiloFromCurrentThread
RtlCompareUnicodeStrings
MmLoadSystemImage
KeUnstackDetachProcess
ObfDereferenceObjectWithTag
PsReleaseProcessExitSynchronization
KeStackAttachProcess
PsAcquireProcessExitSynchronization
PsSetProcessWin32Process
PsGetProcessWin32Process
MmPageEntireDriver
KeInitializeEvent
ExFreePoolWithTag
PsGetCurrentProcess
RtlRecordFeatureUsage
PsGetProcessSessionIdEx
ExAllocatePool2
RtlQueryFeatureConfigurationChangeStamp
KeAddSystemServiceTable
ExEnterCriticalRegionAndAcquireFastMutexUnsafe
IoCreateDriver
PsEstablishWin32Callouts
ExReleaseFastMutexUnsafeAndLeaveCriticalRegion
RtlInitUnicodeString
PsSetThreadWin32Thread
RtlArmFeatureUsageProviderFlushNotification
PsUnEstablishWin32Callouts
KeBugCheckEx
RtlQueryFeatureConfiguration
RtlRegisterFeatureConfigurationChangeNotification
PsGetThreadWin32Thread
RtlGetCurrentServiceSessionId
RtlRegisterFeatureUsageProvider
PsIsWin32KFilterEnabled
RtlCompareUnicodeString
RtlFindExportedRoutineByName
RtlAppendStringToString
PsIsCurrentThreadInServerSilo
PsGetHostSilo
PsAttachSiloToCurrentThread
PsQueryCurrentApiSetSchema
ZwQueryInformationJobObject
MmUnloadSystemImage

watchdog.sys

SMgrNotifySessionChange
WdLogSingleEntry0
WdLogSingleEntry1

ext-ms-win-core-win32k-flipmgr-l1-1-1

NtFlipObjectAddPoolBuffer
NtFlipObjectConsumerAcquirePresent
NtFlipObjectConsumerAdjustUsageReference
NtFlipObjectConsumerBeginProcessPresent
NtFlipObjectConsumerEndProcessPresent
NtFlipObjectConsumerPostMessage
NtFlipObjectConsumerQueryBufferInfo
NtFlipObjectCreate
NtFlipObjectDisconnectEndpoint
NtFlipObjectEnablePresentStatisticsType
NtFlipObjectOpen
NtFlipObjectPresentCancel
NtFlipObjectQueryBufferAvailableEvent
NtFlipObjectQueryEndpointConnected
NtFlipObjectQueryLostEvent
NtFlipObjectQueryNextMessageToProducer
NtFlipObjectReadNextMessageToProducer
NtFlipObjectRemoveContent
NtFlipObjectRemovePoolBuffer
NtFlipObjectSetContent
NtFlipObjectAddContent

ext-ms-win-core-win32k-surfmgr-l1-1-1

NtOpenCompositionSurfaceSectionInfo
NtOpenCompositionSurfaceRealizationInfo
NtOpenCompositionSurfaceDirtyRegion
NtQueryCompositionSurfaceFrameRate
NtCreateCompositionSurfaceHandle
NtConfirmCompositionSurfaceIndependentFlipEntry
NtBindCompositionSurface
NtQueryCompositionSurfaceBinding
NtQueryCompositionSurfaceHDRMetaData
NtQueryCompositionSurfaceRenderingRealization
NtQueryCompositionSurfaceStatistics
NtSetCompositionSurfaceAnalogExclusive
NtSetCompositionSurfaceBufferUsage
NtSetCompositionSurfaceDirectFlipState
NtSetCompositionSurfaceIndependentFlipInfo
NtSetCompositionSurfaceStatistics
NtUnBindCompositionSurface
NtValidateCompositionSurfaceHandle
NtNotifyPresentToCompositionSurface

ext-ms-win-core-win32k-tokenmgr-l1-1-0

NtTokenManagerCreateCompositionTokenHandle
NtTokenManagerCreateFlipObjectReturnTokenHandle
NtTokenManagerCreateFlipObjectTokenHandle
NtTokenManagerConfirmOutstandingAnalogToken
NtTokenManagerGetAnalogExclusiveTokenEvent
NtTokenManagerOpenSectionAndEvents
NtTokenManagerThread
NtTokenManagerGetAnalogExclusiveSurfaceUpdates

ext-ms-win-core-win32k-dxgk-l1-1-0

NtGdiDdDDIWaitForVerticalBlankEvent
NtGdiDdDDIWaitForSynchronizationObjectFromGpu
NtGdiDdDDIWaitForSynchronizationObjectFromCpu
NtGdiDdDDIWaitForSynchronizationObject
NtGdiDdDDIWaitForIdle
NtGdiDdDDIUpdateOverlay
NtGdiDdDDIUpdateGpuVirtualAddress
NtGdiDdDDIUpdateAllocationProperty
NtGdiDdDDIUnlock2
NtGdiDdDDIUnlock
NtGdiDdDDIUnOrderedPresentSwapChain
NtGdiDdDDITrimProcessCommitment
NtGdiDdDDISubmitWaitForSyncObjectsToHwQueue
NtGdiDdDDISubmitSignalSyncObjectsToHwQueue
NtGdiDdDDIWaitForVerticalBlankEvent2
NtGdiDdDDISubmitCommand
NtGdiDdDDISignalSynchronizationObjectFromGpu2
NtGdiDdDDISignalSynchronizationObjectFromGpu
NtGdiDdDDISignalSynchronizationObjectFromCpu
NtGdiDdDDISignalSynchronizationObject
NtGdiDdDDIShareObjects
NtGdiDdDDISetYieldPercentage
NtGdiDdDDISetVidPnSourceOwner
NtGdiDdDDISetVidPnSourceHwProtection
NtGdiDdDDISetSyncRefreshCountWaitTarget
NtGdiDdDDISetStereoEnabled
NtGdiDdDDISetStablePowerState
NtGdiDdDDISetQueuedLimit
NtGdiDdDDISetProcessSchedulingPriorityClass
NtGdiDdDDISetProcessSchedulingPriorityBand
NtGdiDdDDISubmitCommandToHwQueue
NtGdiDdDDICreateContextVirtual
NtGdiDdDDISetProcessDeviceRemovalSupport
NtGdiDdDDISetMonitorColorSpaceTransform
NtGdiDdDDISetMemoryBudgetTarget
NtGdiDdDDISetHwProtectionTeardownRecovery
NtGdiDdDDISetGammaRamp
NtGdiDdDDISetFSEBlock
NtGdiDdDDISetDodIndirectSwapchain
NtGdiDdDDISetDisplayMode
NtGdiDdDDISetContextSchedulingPriority
NtGdiDdDDISetContextInProcessSchedulingPriority
NtGdiDdDDISetAllocationPriority
NtGdiDdDDIReserveGpuVirtualAddress
NtGdiDdDDIRender
NtGdiDdDDIRemoveSurfaceFromSwapChain
NtGdiDdDDIReleaseSwapChain
NtGdiDdDDIReleaseProcessVidPnSourceOwners
NtGdiDdDDIReleaseKeyedMutex2
NtGdiDdDDIReleaseKeyedMutex
NtGdiDdDDIReclaimAllocations2
NtGdiDdDDIReclaimAllocations
NtGdiDdDDIQueryVideoMemoryInfo
NtGdiDdDDIQueryVidPnExclusiveOwnership
NtGdiDdDDIQueryStatistics
NtGdiDdDDIQueryResourceInfoFromNtHandle
NtGdiDdDDIQueryResourceInfo
NtGdiDdDDIQueryRemoteVidPnSourceFromGdiDisplayName
NtGdiDdDDIQueryProtectedSessionStatus
NtGdiDdDDIQueryProtectedSessionInfoFromNtHandle
NtGdiDdDDIQueryProcessOfferInfo
NtGdiDdDDIQueryFSEBlock
NtGdiDdDDIQueryClockCalibration
NtGdiDdDDIQueryAllocationResidency
NtGdiDdDDIQueryAdapterInfo
NtGdiDdDDIPresentRedirected
NtGdiDdDDIPresentMultiPlaneOverlay3
NtGdiDdDDIPresentMultiPlaneOverlay2
NtGdiDdDDIPresentMultiPlaneOverlay
NtGdiDdDDIPresent
NtGdiDdDDIPollDisplayChildren
NtGdiDdDDIOutputDuplReleaseFrame
NtGdiDdDDIOutputDuplPresent
NtGdiDdDDIOutputDuplGetPointerShapeData
NtGdiDdDDIOutputDuplGetMetaData
NtGdiDdDDIOutputDuplGetFrameInfo
NtGdiDdDDIOpenSynchronizationObject
NtGdiDdDDIOpenSyncObjectNtHandleFromName
NtGdiDdDDIOpenSyncObjectFromNtHandle2
NtGdiDdDDIOpenSyncObjectFromNtHandle
NtGdiDdDDIOpenSwapChain
NtGdiDdDDIOpenResourceFromNtHandle
NtGdiDdDDIOpenResource
NtGdiDdDDIOpenProtectedSessionFromNtHandle
NtGdiDdDDIOpenNtHandleFromName
NtGdiDdDDIOpenKeyedMutexFromNtHandle
NtGdiDdDDIOpenKeyedMutex2
NtGdiDdDDIOpenKeyedMutex
NtGdiDdDDIOpenBundleObjectNtHandleFromName
NtGdiDdDDIOpenAdapterFromLuid
NtGdiDdDDIOpenAdapterFromHdc
NtGdiDdDDIOpenAdapterFromDeviceName
NtGdiDdDDIOfferAllocations
NtGdiDdDDINetDispStopMiracastDisplayDevice
NtGdiDdDDINetDispStartMiracastDisplayDevice
NtGdiDdDDINetDispQueryMiracastDisplayDeviceSupport
NtGdiDdDDINetDispQueryMiracastDisplayDeviceStatus
NtGdiDdDDINetDispGetNextChunkInfo
NtGdiDdDDIMarkDeviceAsError
NtGdiDdDDIMapGpuVirtualAddress
NtGdiDdDDIMakeResident
NtGdiDdDDILock2
NtGdiDdDDILock
NtGdiDdDDIInvalidateCache
NtGdiDdDDIInvalidateActiveVidPn
NtGdiDdDDIGetYieldPercentage
NtGdiDdDDIGetSwapChainSurfacePhysicalAddress
NtGdiDdDDIGetSharedResourceAdapterLuidFlipManager
NtGdiDdDDIGetSharedResourceAdapterLuid
NtGdiDdDDIGetSharedPrimaryHandle
NtGdiDdDDIGetSetSwapChainMetadata
NtGdiDdDDIGetScanLine
NtGdiDdDDIGetRuntimeData
NtGdiDdDDIGetResourcePresentPrivateDriverData
NtGdiDdDDIGetProcessSchedulingPriorityClass
NtGdiDdDDIGetProcessSchedulingPriorityBand
NtGdiDdDDIGetProcessDeviceRemovalSupport
NtGdiDdDDIGetPresentHistory
NtGdiDdDDIGetPostCompositionCaps
NtGdiDdDDIGetOverlayState
NtGdiDdDDIGetMultisampleMethodList
NtDxgkCancelPresents
NtDxgkCheckSinglePlaneForMultiPlaneOverlaySupport
NtDxgkConnectDoorbell
NtDxgkCreateDoorbell
NtDxgkCreateNativeFence
NtDxgkCreateTrackedWorkload
NtDxgkDestroyDoorbell
NtDxgkDestroyTrackedWorkload
NtDxgkDispMgrOperation
NtDxgkDisplayMuxSwitchExecute
NtDxgkDisplayMuxSwitchFinish
NtDxgkDisplayMuxSwitchPrepare
NtDxgkDisplayPortOperation
NtDxgkDuplicateHandle
NtDxgkEnumAdapters3
NtDxgkEnumProcesses
NtDxgkGetAvailableTrackedWorkloadIndex
NtDxgkGetNativeFenceLogDetail
NtDxgkGetProcessList
NtDxgkGetProperties
NtDxgkGetTrackedWorkloadStatistics
NtDxgkIsFeatureEnabled
NtDxgkNotifyWorkSubmission
NtDxgkOpenNativeFenceFromNtHandle
NtDxgkOutputDuplPresentToHwQueue
NtDxgkPinResources
NtDxgkRegisterVailProcess
NtDxgkResetTrackedWorkloadStatistics
NtDxgkSetProperties
NtDxgkSubmitPresentBltToHwQueue
NtDxgkSubmitPresentToHwQueue
NtDxgkUnpinResources
NtDxgkUpdateTrackedWorkload
NtDxgkVailConnect
NtDxgkVailDisconnect
NtDxgkVailPromoteCompositionSurface
NtGdiDdDDIAbandonSwapChain
NtGdiDdDDIAcquireKeyedMutex
NtGdiDdDDIAcquireKeyedMutex2
NtGdiDdDDIAcquireSwapChain
NtGdiDdDDIAddSurfaceToSwapChain
NtGdiDdDDIAdjustFullscreenGamma
NtGdiDdDDICacheHybridQueryValue
NtGdiDdDDIChangeVideoMemoryReservation
NtGdiDdDDICheckExclusiveOwnership
NtGdiDdDDICheckMonitorPowerState
NtGdiDdDDICheckMultiPlaneOverlaySupport
NtGdiDdDDICheckMultiPlaneOverlaySupport2
NtGdiDdDDICheckMultiPlaneOverlaySupport3
NtGdiDdDDICheckOcclusion
NtGdiDdDDICheckSharedResourceAccess
NtGdiDdDDICheckVidPnExclusiveOwnership
NtGdiDdDDICloseAdapter
NtGdiDdDDIConfigureSharedResource
NtGdiDdDDICreateAllocation
NtGdiDdDDICreateBundleObject
NtGdiDdDDICreateContext
NtGdiDdDDIGetMultiPlaneOverlayCaps
NtGdiDdDDICreateDevice
NtGdiDdDDICreateHwContext
NtGdiDdDDICreateHwQueue
NtGdiDdDDICreateKeyedMutex
NtGdiDdDDICreateKeyedMutex2
NtGdiDdDDICreateOutputDupl
NtGdiDdDDICreateOverlay
NtGdiDdDDICreatePagingQueue
NtGdiDdDDICreateProtectedSession
NtGdiDdDDICreateSwapChain
NtGdiDdDDICreateSynchronizationObject
NtGdiDdDDIDDisplayEnum
NtGdiDdDDIDestroyAllocation
NtGdiDdDDIDestroyAllocation2
NtGdiDdDDIDestroyContext
NtGdiDdDDIDestroyDevice
NtGdiDdDDIDestroyHwContext
NtGdiDdDDIDestroyHwQueue
NtGdiDdDDIDestroyKeyedMutex
NtGdiDdDDIDestroyOutputDupl
NtGdiDdDDIDestroyOverlay
NtGdiDdDDIDestroyPagingQueue
NtGdiDdDDIDestroyProtectedSession
NtGdiDdDDIDestroySynchronizationObject
NtGdiDdDDIDispMgrCreate
NtGdiDdDDIDispMgrSourceOperation
NtGdiDdDDIDispMgrTargetOperation
NtGdiDdDDIEnumAdapters
NtGdiDdDDIEnumAdapters2
NtGdiDdDDIEscape
NtGdiDdDDIEvict
NtGdiDdDDIExtractBundleObject
NtGdiDdDDIFlipOverlay
NtGdiDdDDIFlushHeapTransitions
NtGdiDdDDIFreeGpuVirtualAddress
NtGdiDdDDIGetAllocationPriority
NtGdiDdDDIGetCachedHybridQueryValue
NtGdiDdDDIGetContextInProcessSchedulingPriority
NtGdiDdDDIGetContextSchedulingPriority
NtGdiDdDDIGetDWMVerticalBlankEvent
NtGdiDdDDIGetDeviceState
NtGdiDdDDIGetDisplayModeList
NtGdiDdDDIGetMemoryBudgetTarget

Exports

Exports

BRUSHOBJ_hGetColorTransform
BRUSHOBJ_pvAllocRbrush
BRUSHOBJ_pvGetRbrush
BRUSHOBJ_ulGetBrushColor
CLIPOBJ_bEnum
CLIPOBJ_cEnumStart
CLIPOBJ_ppoGetPath
CddEngCombineRgn
CddEngCopyRgn
CddEngCreateRectRgn
CddEngDeleteRgn
CddEngEqualRgn
CddEngGetRgnBox
CddEngGetRgnData
CddEngOffsetRgn
CddEngRectInRgn
CddEngSetRectRgn
DxDdCleanupDxGraphics
DxDdGetDxgkWin32kInterface
DxDdIsTearDownLddmSpriteDisabled
DxDdProcessCallout
DxDdThreadCallout
DxGetGpuUsageStatistics
DxGetProcessInterferenceCount
DxNotifyProcessFreezeCallout
DxNotifyProcessThawCallout
EngAcquireFastMutex
EngAcquireSemaphore
EngAcquireSemaphoreNoWait
EngAcquireSemaphoreShared
EngAcquireSemaphoreSharedNoWait
EngAllocMem
EngAllocPrivateUserMem
EngAllocSectionMem
EngAllocUserMem
EngAlphaBlend
EngAssociateSurface
EngBitBlt
EngBugCheckEx
EngCTGetCurrentGamma
EngCTGetGammaTable
EngCheckAbort
EngClearEvent
EngComputeGlyphSet
EngControlSprites
EngCopyBits
EngCreateBitmap
EngCreateClip
EngCreateDeviceBitmap
EngCreateDeviceSurface
EngCreateDriverObj
EngCreateEvent
EngCreateFastMutex
EngCreatePalette
EngCreatePath
EngCreateRedirectionDeviceBitmap
EngCreateSemaphore
EngCreateWnd
EngDebugBreak
EngDebugPrint
EngDeleteClip
EngDeleteDriverObj
EngDeleteEvent
EngDeleteFastMutex
EngDeleteFile
EngDeletePalette
EngDeletePath
EngDeleteSafeSemaphore
EngDeleteSemaphore
EngDeleteSurface
EngDeleteWnd
EngDeviceIoControl
EngDitherColor
EngDxIoctl
EngEnumForms
EngEraseSurface
EngFileIoControl
EngFileWrite
EngFillPath
EngFindImageProcAddress
EngFindResource
EngFntCacheAlloc
EngFntCacheFault
EngFntCacheLookUp
EngFreeMem
EngFreeModule
EngFreePrivateUserMem
EngFreeSectionMem
EngFreeUserMem
EngGetCurrentCodePage
EngGetCurrentProcessId
EngGetCurrentThreadId
EngGetDriverName
EngGetFileChangeTime
EngGetFilePath
EngGetForm
EngGetLastError
EngGetPrinter
EngGetPrinterData
EngGetPrinterDataFileName
EngGetPrinterDriver
EngGetProcessHandle
EngGetTickCount
EngGetType1FontList
EngGradientFill
EngHangNotification
EngInitializeSafeSemaphore
EngIsCddDeviceBitmap
EngIsSemaphoreOwned
EngIsSemaphoreOwnedByCurrentThread
EngIsSemaphoreSharedByCurrentThread
EngLineTo
EngLoadImage
EngLoadModule
EngLoadModuleForWrite
EngLockDirectDrawSurface
EngLockDriverObj
EngLockSurface
EngLpkInstalled
EngMapEvent
EngMapFile
EngMapFontFile
EngMapFontFileFD
EngMapModule
EngMapSection
EngMarkBandingSurface
EngModifySurface
EngMovePointer
EngMulDiv
EngMultiByteToUnicodeN
EngMultiByteToWideChar
EngNineGrid
EngPaint
EngPlgBlt
EngProbeForRead
EngProbeForReadAndWrite
EngQueryDeviceAttribute
EngQueryLocalTime
EngQueryPalette
EngQueryPerformanceCounter
EngQueryPerformanceFrequency
EngQuerySystemAttribute
EngQueryW32kCddInterface
EngReadStateEvent
EngReleaseFastMutex
EngReleaseSemaphore
EngRestoreFloatingPointState
EngSaveFloatingPointState
EngSecureMem
EngSetEvent
EngSetLastError
EngSetPointerShape
EngSetPointerTag
EngSetPrinterData
EngSort
EngStretchBlt
EngStretchBltROP
EngStrokeAndFillPath
EngStrokePath
EngTextOut
EngTransparentBlt
EngUnicodeToMultiByteN
EngUnloadImage
EngUnlockDirectDrawSurface
EngUnlockDriverObj
EngUnlockSurface
EngUnmapEvent
EngUnmapFile
EngUnmapFontFile
EngUnmapFontFileFD
EngUnsecureMem
EngUpdateDeviceSurface
EngWaitForSingleObject
EngWideCharToMultiByte
EngWritePrinter
FONTOBJ_cGetAllGlyphHandles
FONTOBJ_cGetGlyphs
FONTOBJ_pQueryGlyphAttrs
FONTOBJ_pfdg
FONTOBJ_pifi
FONTOBJ_pjOpenTypeTablePointer
FONTOBJ_pvTrueTypeFontFile
FONTOBJ_pwszFontFilePaths
FONTOBJ_pxoGetXform
FONTOBJ_vGetInfo
HT_ComputeRGBGammaTable
HT_Get8BPPFormatPalette
HT_Get8BPPMaskPalette
HeapVidMemAllocAligned
InitializeGraphicsInfrastructure
IsSysEntryApiExtSupported
NtUserInitialize
PALOBJ_cGetColors
PATHOBJ_bCloseFigure
PATHOBJ_bEnum
PATHOBJ_bEnumClipLines
PATHOBJ_bMoveTo
PATHOBJ_bPolyBezierTo
PATHOBJ_bPolyLineTo
PATHOBJ_vEnumStart
PATHOBJ_vEnumStartClipLines
PATHOBJ_vGetBounds
RtlAnsiCharToUnicodeChar
RtlCaptureContext
RtlCopyMemory
RtlCopyMemoryNonTemporal
RtlFillMemory
RtlLookupFunctionEntry
RtlMoveMemory
RtlMultiByteToUnicodeN
RtlPcToFileHeader
RtlRaiseException
RtlRestoreContext
RtlUnicodeToMultiByteN
RtlUnicodeToMultiByteSize
RtlUnwind
RtlUnwindEx
RtlUpcaseUnicodeChar
RtlUpcaseUnicodeToMultiByteN
RtlVirtualUnwind
RtlZeroMemory
STROBJ_bEnum
STROBJ_bEnumPositionsOnly
STROBJ_bGetAdvanceWidths
STROBJ_dwGetCodePage
STROBJ_fxBreakExtra
STROBJ_fxCharacterExtra
STROBJ_vEnumStart
SysEntryGetDispatchTableValues
SysEntryGetDispatchTableValuesFilter
SysEntryGetW32pArgumentTable
SysEntryGetW32pArgumentTableFilter
SysEntryGetW32pServiceLimit
SysEntryGetW32pServiceLimitFilter
SysEntryGetW32pServiceTable
SysEntryGetW32pServiceTableFilter
SysEntryPsEstablishWin32Callouts
SysEntryPsUnEstablishWin32Callouts
SysEntryRegisterWin32kBaseDriverUnload
SysEntrySMgrNotifySessionChange
VidMemFree
W32GetDCompSessionState
W32GetDebugState
W32GetHeapSessionState
W32GetInputMonitorSessionState
W32GetMaxSessionCount
W32GetReferencedSessionProcessWithTag
W32GetSessionState
W32GetSiloSessionState
W32GetUserCoreMessagingSessionState
W32GetUserGdiSessionState
W32GetUserInputMgrSessionState
W32GetUserSessionState
W32GetWin32kApiSetTable
W32GetWin32kBaseApiSetTable
W32GetWin32kFullApiSetTable
W32GetWin32kSysSessionState
W32RegisterSessionProcess
W32UnregisterSessionProcess
W32pArgumentTable
W32pArgumentTableFilter
W32pServiceLimit
W32pServiceLimitFilter
W32pServiceTable
W32pServiceTableFilter
WNDOBJ_bEnum
WNDOBJ_cEnumStart
WNDOBJ_vSetConsumer
XFORMOBJ_bApplyXform
XFORMOBJ_iGetFloatObjXform
XFORMOBJ_iGetXform
XLATEOBJ_cGetPalette
XLATEOBJ_hGetColorTransform
XLATEOBJ_iXlate
XLATEOBJ_piVector
__C_specific_handler
__chkstk
__win32kstub_NtBindCompositionSurface
__win32kstub_NtCloseCompositionInputSink
__win32kstub_NtCompositionInputThread
__win32kstub_NtCompositionSetDropTarget
__win32kstub_NtCompositorNotifyExitWindows
__win32kstub_NtConfigureInputSpace
__win32kstub_NtConfirmCompositionSurfaceIndependentFlipEntry
__win32kstub_NtCreateCompositionInputSink
__win32kstub_NtCreateCompositionSurfaceHandle
__win32kstub_NtCreateImplicitCompositionInputSink
__win32kstub_NtDCompositionAddCrossDeviceVisualChild
__win32kstub_NtDCompositionBeginFrame
__win32kstub_NtDCompositionBoostCompositorClock
__win32kstub_NtDCompositionCommitChannel
__win32kstub_NtDCompositionCommitSynchronizationObject
__win32kstub_NtDCompositionConfirmFrame
__win32kstub_NtDCompositionConnectPipe
__win32kstub_NtDCompositionCreateAndBindSharedSection
__win32kstub_NtDCompositionCreateBufferCollection
__win32kstub_NtDCompositionCreateChannel
__win32kstub_NtDCompositionCreateConnection
__win32kstub_NtDCompositionCreateSharedResourceHandle
__win32kstub_NtDCompositionCreateSynchronizationObject
__win32kstub_NtDCompositionDestroyChannel
__win32kstub_NtDCompositionDestroyConnection
__win32kstub_NtDCompositionDuplicateHandleToProcess
__win32kstub_NtDCompositionDuplicateSwapchainHandleToDwm
__win32kstub_NtDCompositionEnableMMCSS
__win32kstub_NtDCompositionGetBatchId
__win32kstub_NtDCompositionGetChannels
__win32kstub_NtDCompositionGetConnectionBatch
__win32kstub_NtDCompositionGetDeletedResources
__win32kstub_NtDCompositionGetFrameId
__win32kstub_NtDCompositionGetFrameIdFromBatchId
__win32kstub_NtDCompositionGetFrameLegacyTokens
__win32kstub_NtDCompositionGetFrameStatistics
__win32kstub_NtDCompositionGetFrameSurfaceUpdates
__win32kstub_NtDCompositionGetStatistics
__win32kstub_NtDCompositionGetTargetStatistics
__win32kstub_NtDCompositionNotifySuperWetInkWork
__win32kstub_NtDCompositionProcessChannelBatchBuffer
__win32kstub_NtDCompositionRegisterThumbnailVisual
__win32kstub_NtDCompositionRegisterVirtualDesktopVisual
__win32kstub_NtDCompositionReleaseAllResources
__win32kstub_NtDCompositionRemoveCrossDeviceVisualChild
__win32kstub_NtDCompositionSetBlurredWallpaperSurface
__win32kstub_NtDCompositionSetChannelCommitCompletionEvent
__win32kstub_NtDCompositionSetChannelConnectionId
__win32kstub_NtDCompositionSetChildRootVisual
__win32kstub_NtDCompositionSetDebugCounter
__win32kstub_NtDCompositionSuspendAnimations
__win32kstub_NtDCompositionSyncWait
__win32kstub_NtDCompositionSynchronize
__win32kstub_NtDCompositionTelemetrySetApplicationId
__win32kstub_NtDCompositionUpdatePointerCapture
__win32kstub_NtDCompositionWaitForChannel
__win32kstub_NtDCompositionWaitForCompositorClock
__win32kstub_NtDesktopCaptureBits
__win32kstub_NtDuplicateCompositionInputSink
__win32kstub_NtDxgkCancelPresents
__win32kstub_NtDxgkCheckSinglePlaneForMultiPlaneOverlaySupport
__win32kstub_NtDxgkConnectDoorbell
__win32kstub_NtDxgkCreateDoorbell
__win32kstub_NtDxgkCreateNativeFence
__win32kstub_NtDxgkCreateTrackedWorkload
__win32kstub_NtDxgkDestroyDoorbell
__win32kstub_NtDxgkDestroyTrackedWorkload
__win32kstub_NtDxgkDispMgrOperation
__win32kstub_NtDxgkDisplayMuxSwitchExecute
__win32kstub_NtDxgkDisplayMuxSwitchFinish
__win32kstub_NtDxgkDisplayMuxSwitchPrepare
__win32kstub_NtDxgkDisplayPortOperation
__win32kstub_NtDxgkDuplicateHandle
__win32kstub_NtDxgkEnumAdapters3
__win32kstub_NtDxgkEnumProcesses
__win32kstub_NtDxgkGetAvailableTrackedWorkloadIndex
__win32kstub_NtDxgkGetNativeFenceLogDetail
__win32kstub_NtDxgkGetProcessList
__win32kstub_NtDxgkGetProperties
__win32kstub_NtDxgkGetTrackedWorkloadStatistics
__win32kstub_NtDxgkIsFeatureEnabled
__win32kstub_NtDxgkNotifyWorkSubmission
__win32kstub_NtDxgkOpenNativeFenceFromNtHandle
__win32kstub_NtDxgkOutputDuplPresentToHwQueue
__win32kstub_NtDxgkPinResources
__win32kstub_NtDxgkRegisterVailProcess
__win32kstub_NtDxgkResetTrackedWorkloadStatistics
__win32kstub_NtDxgkSetProperties
__win32kstub_NtDxgkSubmitPresentBltToHwQueue
__win32kstub_NtDxgkSubmitPresentToHwQueue
__win32kstub_NtDxgkUnpinResources
__win32kstub_NtDxgkUpdateTrackedWorkload
__win32kstub_NtDxgkVailConnect
__win32kstub_NtDxgkVailDisconnect
__win32kstub_NtDxgkVailPromoteCompositionSurface
__win32kstub_NtEnableOneCoreTransformMode
__win32kstub_NtFlipObjectAddContent
__win32kstub_NtFlipObjectAddPoolBuffer
__win32kstub_NtFlipObjectConsumerAcquirePresent
__win32kstub_NtFlipObjectConsumerAdjustUsageReference
__win32kstub_NtFlipObjectConsumerBeginProcessPresent
__win32kstub_NtFlipObjectConsumerEndProcessPresent
__win32kstub_NtFlipObjectConsumerPostMessage
__win32kstub_NtFlipObjectConsumerQueryBufferInfo
__win32kstub_NtFlipObjectCreate
__win32kstub_NtFlipObjectDisconnectEndpoint
__win32kstub_NtFlipObjectEnablePresentStatisticsType
__win32kstub_NtFlipObjectOpen
__win32kstub_NtFlipObjectPresentCancel
__win32kstub_NtFlipObjectQueryBufferAvailableEvent
__win32kstub_NtFlipObjectQueryEndpointConnected
__win32kstub_NtFlipObjectQueryLostEvent
__win32kstub_NtFlipObjectQueryNextMessageToProducer
__win32kstub_NtFlipObjectReadNextMessageToProducer
__win32kstub_NtFlipObjectRemoveContent
__win32kstub_NtFlipObjectRemovePoolBuffer
__win32kstub_NtFlipObjectSetContent
__win32kstub_NtGdiAbortDoc
__win32kstub_NtGdiAbortPath
__win32kstub_NtGdiAddEmbFontToDC
__win32kstub_NtGdiAddFontMemResourceEx
__win32kstub_NtGdiAddFontResourceW
__win32kstub_NtGdiAddInitialFonts
__win32kstub_NtGdiAddRemoteFontToDC
__win32kstub_NtGdiAddRemoteMMInstanceToDC
__win32kstub_NtGdiAlphaBlend
__win32kstub_NtGdiAngleArc
__win32kstub_NtGdiAnyLinkedFonts
__win32kstub_NtGdiArcInternal
__win32kstub_NtGdiBRUSHOBJ_DeleteRbrush
__win32kstub_NtGdiBRUSHOBJ_hGetColorTransform
__win32kstub_NtGdiBRUSHOBJ_pvAllocRbrush
__win32kstub_NtGdiBRUSHOBJ_pvGetRbrush
__win32kstub_NtGdiBRUSHOBJ_ulGetBrushColor
__win32kstub_NtGdiBeginGdiRendering
__win32kstub_NtGdiBeginPath
__win32kstub_NtGdiBitBlt
__win32kstub_NtGdiCLIPOBJ_bEnum
__win32kstub_NtGdiCLIPOBJ_cEnumStart
__win32kstub_NtGdiCLIPOBJ_ppoGetPath
__win32kstub_NtGdiCancelDC
__win32kstub_NtGdiChangeGhostFont
__win32kstub_NtGdiCheckBitmapBits
__win32kstub_NtGdiClearBitmapAttributes
__win32kstub_NtGdiClearBrushAttributes
__win32kstub_NtGdiCloseFigure
__win32kstub_NtGdiColorCorrectPalette
__win32kstub_NtGdiCombineRgn
__win32kstub_NtGdiCombineTransform
__win32kstub_NtGdiComputeXformCoefficients
__win32kstub_NtGdiConfigureOPMProtectedOutput
__win32kstub_NtGdiConvertMetafileRect
__win32kstub_NtGdiCreateBitmap
__win32kstub_NtGdiCreateBitmapFromDxSurface
__win32kstub_NtGdiCreateBitmapFromDxSurface2
__win32kstub_NtGdiCreateClientObj
__win32kstub_NtGdiCreateColorSpace
__win32kstub_NtGdiCreateColorTransform
__win32kstub_NtGdiCreateCompatibleBitmap
__win32kstub_NtGdiCreateCompatibleDC
__win32kstub_NtGdiCreateDIBBrush
__win32kstub_NtGdiCreateDIBSection
__win32kstub_NtGdiCreateDIBitmapInternal
__win32kstub_NtGdiCreateEllipticRgn
__win32kstub_NtGdiCreateHalftonePalette
__win32kstub_NtGdiCreateHatchBrushInternal
__win32kstub_NtGdiCreateMetafileDC
__win32kstub_NtGdiCreateOPMProtectedOutput
__win32kstub_NtGdiCreateOPMProtectedOutputs
__win32kstub_NtGdiCreatePaletteInternal
__win32kstub_NtGdiCreatePatternBrushInternal
__win32kstub_NtGdiCreatePen
__win32kstub_NtGdiCreateRectRgn
__win32kstub_NtGdiCreateRoundRectRgn
__win32kstub_NtGdiCreateServerMetaFile
__win32kstub_NtGdiCreateSessionMappedDIBSection
__win32kstub_NtGdiCreateSolidBrush
__win32kstub_NtGdiDDCCIGetCapabilitiesString
__win32kstub_NtGdiDDCCIGetCapabilitiesStringLength
__win32kstub_NtGdiDDCCIGetTimingReport
__win32kstub_NtGdiDDCCIGetVCPFeature
__win32kstub_NtGdiDDCCISaveCurrentSettings
__win32kstub_NtGdiDDCCISetVCPFeature
__win32kstub_NtGdiDdCreateFullscreenSprite
__win32kstub_NtGdiDdDDIAbandonSwapChain
__win32kstub_NtGdiDdDDIAcquireKeyedMutex
__win32kstub_NtGdiDdDDIAcquireKeyedMutex2
__win32kstub_NtGdiDdDDIAcquireSwapChain
__win32kstub_NtGdiDdDDIAddSurfaceToSwapChain
__win32kstub_NtGdiDdDDIAdjustFullscreenGamma
__win32kstub_NtGdiDdDDICacheHybridQueryValue
__win32kstub_NtGdiDdDDIChangeVideoMemoryReservation
__win32kstub_NtGdiDdDDICheckExclusiveOwnership
__win32kstub_NtGdiDdDDICheckMonitorPowerState
__win32kstub_NtGdiDdDDICheckMultiPlaneOverlaySupport
__win32kstub_NtGdiDdDDICheckMultiPlaneOverlaySupport2
__win32kstub_NtGdiDdDDICheckMultiPlaneOverlaySupport3
__win32kstub_NtGdiDdDDICheckOcclusion
__win32kstub_NtGdiDdDDICheckSharedResourceAccess
__win32kstub_NtGdiDdDDICheckVidPnExclusiveOwnership
__win32kstub_NtGdiDdDDICloseAdapter
__win32kstub_NtGdiDdDDIConfigureSharedResource
__win32kstub_NtGdiDdDDICreateAllocation
__win32kstub_NtGdiDdDDICreateBundleObject
__win32kstub_NtGdiDdDDICreateContext
__win32kstub_NtGdiDdDDICreateContextVirtual
__win32kstub_NtGdiDdDDICreateDCFromMemory
__win32kstub_NtGdiDdDDICreateDevice
__win32kstub_NtGdiDdDDICreateHwContext
__win32kstub_NtGdiDdDDICreateHwQueue
__win32kstub_NtGdiDdDDICreateKeyedMutex
__win32kstub_NtGdiDdDDICreateKeyedMutex2
__win32kstub_NtGdiDdDDICreateOutputDupl
__win32kstub_NtGdiDdDDICreateOverlay
__win32kstub_NtGdiDdDDICreatePagingQueue
__win32kstub_NtGdiDdDDICreateProtectedSession
__win32kstub_NtGdiDdDDICreateSwapChain
__win32kstub_NtGdiDdDDICreateSynchronizationObject
__win32kstub_NtGdiDdDDIDDisplayEnum
__win32kstub_NtGdiDdDDIDestroyAllocation
__win32kstub_NtGdiDdDDIDestroyAllocation2
__win32kstub_NtGdiDdDDIDestroyContext
__win32kstub_NtGdiDdDDIDestroyDCFromMemory

Sections

.text
Size: 424KB - Virtual size: 423KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

fothk
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 20KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

TABLERO
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 4KB - Virtual size: 858B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.edata
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

GFIDS
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cebb471ce9772b34b24ce4584d81c008

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5fCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

a7:88:52:8b:46:f2:57:a3:63:34:39:10:41:9e:c1:2b:d5:da:35:f0:4f:00:1b:73:a1:e3:df:3d:84:ff:2d:59Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntoskrnl.exe

watchdog.sys

ext-ms-win-core-win32k-flipmgr-l1-1-1

ext-ms-win-core-win32k-surfmgr-l1-1-1

ext-ms-win-core-win32k-tokenmgr-l1-1-0

ext-ms-win-core-win32k-dxgk-l1-1-0

Exports

Exports

Sections

.text Size: 424KB - Virtual size: 423KB

fothk Size: 4KB - Virtual size: 4KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 44KB - Virtual size: 52KB

.pdata Size: 56KB - Virtual size: 55KB

.idata Size: 20KB - Virtual size: 16KB

TABLERO Size: 20KB - Virtual size: 17KB

PAGE Size: 4KB - Virtual size: 858B

.edata Size: 84KB - Virtual size: 81KB

INIT Size: 4KB - Virtual size: 1KB

GFIDS Size: 12KB - Virtual size: 8KB

.rsrc Size: 4KB - Virtual size: 1024B

.reloc Size: 32KB - Virtual size: 29KB

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

a7:88:52:8b:46:f2:57:a3:63:34:39:10:41:9e:c1:2b:d5:da:35:f0:4f:00:1b:73:a1:e3:df:3d:84:ff:2d:59
Signer

.text
Size: 424KB - Virtual size: 423KB

fothk
Size: 4KB - Virtual size: 4KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 44KB - Virtual size: 52KB

.pdata
Size: 56KB - Virtual size: 55KB

.idata
Size: 20KB - Virtual size: 16KB

TABLERO
Size: 20KB - Virtual size: 17KB

PAGE
Size: 4KB - Virtual size: 858B

.edata
Size: 84KB - Virtual size: 81KB

INIT
Size: 4KB - Virtual size: 1KB

GFIDS
Size: 12KB - Virtual size: 8KB

.rsrc
Size: 4KB - Virtual size: 1024B

.reloc
Size: 32KB - Virtual size: 29KB