| ntoskrnl.exe | ExReInitializeRundownProtection, ExUnregisterExtension, RtlUnicodeStringToInteger, RtlIpv6AddressToStringW, RtlIpv4AddressToStringW, RtlQueryRegistryValuesEx, ZwEnumerateKey, RtlNtStatusToDosError, KeSetCoalescableTimer, ZwNotifyChangeKey, RtlEnumerateGenericTableLikeADirectory, RtlCreateHashTableEx, RtlIpv4AddressToStringExW, RtlIpv6AddressToStringExW, qsort, ExAcquireRundownProtectionCacheAwareEx, ExReleaseRundownProtectionCacheAwareEx, PsIsThreadTerminating, KeFreeCalloutStack, KeAllocateCalloutStack, MmUserProbeAddress, MmUnlockPages, DbgPrintEx, MmLockPagableDataSection, MmProbeAndLockPages, strnlen, strcpy_s, _stricmp, RtlInitializeBitMap, wcsncmp, RtlWriteRegistryValue, ExAcquireRundownProtectionEx, ExReleaseRundownProtectionEx, RtlUnicodeStringToAnsiString, RtlInitAnsiString, KeQueryMaximumGroupCount, RtlCopyBitMap, RtlIntersectBitMaps, RtlNumberOfSetBits, KeQueryLogicalProcessorRelationship, MmUnlockPagableImageSection, RtlFindMostSignificantBit, KeGetProcessorIndexFromNumber, RtlSetGroupSecurityDescriptor, RtlCopyUnicodeString, ZwQuerySecurityAttributesToken, SeQuerySecurityAttributesTokenAccessInformation, SeCaptureSubjectContext, ExReleaseSpinLockExclusive, ExReleaseSpinLockShared, ExAcquireSpinLockShared, ExAcquireSpinLockExclusive, ExUnsubscribeWnfStateChange, ExSubscribeWnfStateChange, ExSetTimer, ExDeleteTimer, ExAllocateTimer, ExTryAcquirePushLockExclusiveEx, ExReleaseSpinLockSharedFromDpcLevel, ExQueueWorkItem, ExAcquireSpinLockSharedAtDpcLevel, ExReleasePushLockSharedEx, ExAcquirePushLockSharedEx, RtlAppendUnicodeStringToString, RtlAppendUnicodeToString, IoQueryFullDriverPath, RtlFreeAnsiString, DbgkWerCaptureLiveKernelDump, IoReuseIrp, ExpInterlockedFlushSList, ExpInterlockedPushEntrySList, InitializeSListHead, ExAcquireSpinLockExclusiveAtDpcLevel, ExReleaseSpinLockExclusiveFromDpcLevel, IoFreeIrp, IoAllocateIrp, PcwRegister, RtlCompareMemory, RtlStringFromGUID, ExRegisterExtension, RtlInt64ToUnicodeString, ExFreeToNPagedLookasideList, ExAllocateFromNPagedLookasideList, ExReleasePushLockExclusiveEx, ExAcquirePushLockExclusiveEx, ExDeleteNPagedLookasideList, ExInitializeNPagedLookasideList, RtlGetPersistedStateLocation, RtlFreeUnicodeString, RtlConvertSidToUnicodeString, PsGetCurrentProcessId, RtlValidSid, PsGetEffectiveContainerId, CmUnregisterMachineHiveLoadedNotification, CmRegisterMachineHiveLoadedNotification, RtlGetDaclSecurityDescriptor, RtlSetOwnerSecurityDescriptor, RtlMapGenericMask, ObSetSecurityObjectByPointer, PsSetCreateProcessNotifyRoutineEx2, ZwCreateFile, SeLocateProcessImageName, RtlDowncaseUnicodeString, InitSafeBootMode, KeUnstackDetachProcess, ZwDuplicateToken, KeStackAttachProcess, ZwOpenProcess, IofCompleteRequest, IoDeleteSymbolicLink, IoCreateSymbolicLink, wcsnlen, RtlQueryPackageIdentity, PsQueryProcessAttributesByToken, RtlCompareUnicodeString, SeQuerySecurityAttributesToken, SeSecurityAttributePresent, RtlSubAuthorityCountSid, SeQueryInformationToken, SeTokenFromAccessInformation, PsCreateSystemThread, _vsnwprintf, ZwCreateEvent, ZwWaitForSingleObject, PsDereferencePrimaryToken, ObCloseHandle, ZwQueryInformationToken, ObOpenObjectByPointer, PsReferencePrimaryToken, RtlCopySid, SeSrpAccessCheck, RtlLengthSecurityDescriptor, KeSetTimer, KeInitializeTimer, RtlAddAccessAllowedAce, RtlSubAuthoritySid, RtlInitializeSid, RtlLengthRequiredSid, SeAccessCheckFromState, ExAllocatePoolWithQuotaTag, ExUuidCreate, _wcsicmp, wcschr, RtlIpv6StringToAddressW, RtlIpv4StringToAddressW, ExGetPreviousMode, KeQueryInterruptTimePrecise, PsGetProcessSessionId, KeDelayExecutionThread, MmIsVerifierEnabled, KeInsertQueueDpc, IoUninitializeWorkItem, IoInitializeWorkItem, IoSizeofWorkItem, SeReportSecurityEventWithSubCategory, SeSetAuditParameter, KeGetCurrentNodeNumber, KeQueryHighestNodeNumber, RtlEqualSid, KeQueryTimeIncrement, MmBadPointer, MmSizeOfMdl, MmUnmapLockedPages, RtlVerifyVersionInfo, VerSetConditionMask, RtlNotifyFeatureUsage, RtlRbInsertNodeEx, RtlRbRemoveNode, ObLogSecurityDescriptor, RtlSetDaclSecurityDescriptor, RtlAddAccessAllowedAceEx, RtlCreateAcl, RtlLengthSid, SeExports, RtlCreateSecurityDescriptor, RtlContractHashTable, RtlExpandHashTable, KeInitializeSemaphore, ExSetTimerResolution, KeFlushQueuedDpcs, ExGetCurrentProcessorCounts, KeCancelTimer, KeSetTimerEx, KeQueryUnbiasedInterruptTime, KeInitializeTimerEx, KeSetTargetProcessorDpcEx, KeGetProcessorNumberFromIndex, KeInitializeDpc, KeExpandKernelStackAndCalloutEx, ExRundownCompleted, ExWaitForRundownProtectionRelease, ExInitializeRundownProtection, MmBuildMdlForNonPagedPool, ExAllocatePoolWithTag, RtlEndEnumerationHashTable, RtlEnumerateEntryHashTable, RtlInitEnumerationHashTable, RtlInitializeGenericTableAvl, PsGetProcessImageFileName, IoFileObjectType, PsGetThreadId, RtlLookupElementGenericTableFullAvl, KeIsExecutingDpc, ExReleaseRundownProtection, ExAcquireRundownProtection, ExNotifyCallback, ObfReferenceObject, EtwWrite, KeShouldYieldProcessor, IoBuildPartialMdl, IoAllocateMdl, MmMapLockedPagesSpecifyCache, IoFreeMdl, KeBugCheckEx, KeReleaseSemaphore, ObReferenceSecurityDescriptor, ExReleaseFastMutex, ExAcquireFastMutex, ExReleaseRundownProtectionCacheAware, ExAcquireRundownProtectionCacheAware, ExFreeCacheAwareRundownProtection, ExAllocateCacheAwareRundownProtection, ExWaitForRundownProtectionReleaseCacheAware, ExReInitializeRundownProtectionCacheAware, RtlValidSecurityDescriptor, ZwQuerySystemInformation, KeQuerySystemTimePrecise, RtlTimeToTimeFields, ExSystemTimeToLocalTime, RtlEndWeakEnumerationHashTable, RtlWeaklyEnumerateEntryHashTable, RtlInitWeakEnumerationHashTable, KeAcquireSpinLockAtDpcLevel, RtlEndStrongEnumerationHashTable, RtlStronglyEnumerateEntryHashTable, RtlInitStrongEnumerationHashTable, KeReleaseSpinLockFromDpcLevel, KeGetRecommendedSharedDataAlignment, KeBugCheck, RtlClearBits, RtlAreBitsClear, RtlFindSetBits, IoQueueWorkItem, IoAllocateWorkItem, IoFreeWorkItem, RtlClearBit, RtlTestBit, RtlFindClearBits, IoWriteErrorLogEntry, IoAllocateErrorLogEntry, ExAcquireResourceSharedLite, RtlSetBits, ExDeleteResourceLite, RtlSetBit, RtlClearAllBits, ExInitializeResourceLite, PsGetProcessStartKey, PsGetProcessSequenceNumber, KeLeaveCriticalRegion, ExReleaseResourceLite, ExAcquireResourceExclusiveLite, KeReleaseInStackQueuedSpinLockFromDpcLevel, KeAcquireInStackQueuedSpinLock, KeAcquireInStackQueuedSpinLockAtDpcLevel, KeTestSpinLock, KfRaiseIrql, ExFreePoolWithTag, KeLowerIrql, ExAllocatePool2, RtlPrefixUnicodeString, KeInitializeSpinLock, PsQueryProcessCommandLine, PsGetProcessId, KeReleaseInStackQueuedSpinLock, ZwOpenKey, KeQueryActiveProcessorCountEx, ZwClose, KeWaitForSingleObject, KeInitializeEvent, IoWMIRegistrationControl, ZwQueryValueKey, IofCallDriver, IoCreateDevice, EtwRegister, MmGetSystemRoutineAddress, PsGetCurrentProcess, EtwUnregister, RtlUnregisterFeatureConfigurationChangeNotification, RtlGetVersion, ObReferenceObjectByHandle, EtwWriteTransfer, RtlQueryFeatureConfigurationChangeStamp, KeReleaseMutex, IoGetDeviceObjectPointer, IoBuildDeviceIoControlRequest, IoDeleteDevice, RtlInitUnicodeString, ObfDereferenceObject, KeInitializeMutex, KeEnterCriticalRegion, ObDereferenceSecurityDescriptor, SeReleaseSubjectContext, SeUnlockSubjectContext, SeOpenObjectAuditAlarmForNonObObject, IoGetFileObjectGenericMapping, SeAccessCheck, SeLockSubjectContext, SeCaptureSubjectContextEx, RtlDeleteHashTable, RtlCreateHashTable, RtlRemoveEntryHashTable, RtlInsertEntryHashTable, RtlGetNextEntryHashTable, RtlLookupEntryHashTable, KeAcquireSpinLockRaiseToDpc, ExFreeToLookasideListEx, KeReleaseSpinLock, ExAllocateFromLookasideListEx, ExDeleteLookasideListEx, ExAllocatePool3, ExInitializeLookasideListEx, KeGetCurrentProcessorNumberEx, KeQueryDpcWatchdogInformation, IoIs32bitProcess, PsGetThreadProcess, PsGetThreadTeb, KeGetCurrentIrql, __C_specific_handler, KeSetEvent, KeQueryMaximumProcessorCountEx, PcwAddInstance, PcwUnregister, PoRegisterPowerSettingCallback, ExRegisterCallback, ExCreateCallback, PoUnregisterPowerSettingCallback, ExUnregisterCallback, KeIsAttachedProcess, __chkstk, EtwSetInformation, RtlQueryFeatureConfiguration, RtlRegisterFeatureConfigurationChangeNotification, ZwQueryLicenseValue, KeReadStateEvent, IoQueueWorkItemEx, ZwOpenEvent, wcscmp |
| NETIO.SYS | NetioUnInitializeNetBufferListLibrary, NetioSetTriageBlock, NetioRegisterProcessorAddCallback, NetioUnRegisterProcessorAddCallback, NetioInitializeNetBufferListLibrary, RtlInvokeStartRoutines, RtlInvokeStopRoutines, NetioAllocateAndInitializeStackBlock, NetioFreeStackBlock, NetioStackBlockProcessorAddHandler, WfpNblInfoGet, WfpStartStreamShim, WfpStopStreamShim, NetioAllocateMdl, NetioDereferenceNetBufferList, KfdIsLayerEmpty, WfpStreamEndpointCleanupBegin, WfpStreamInspectSend, WfpStreamInspectDisconnect, WfpStreamInspectReceive, WfpStreamInspectRemoteDisconnect, NetioInsertWorkQueue, KfdRegisterRscIncompatCalloutNotify, KfdRegisterUsoIncompatCalloutNotify, KfdRegisterUroIncompatCalloutNotify, NetioInitializeWorkQueue, NetioNcmSignalNcContextWorkQueueRoutine, NetioNcmInitializeState, NetioNcmCleanupState, NetioShutdownWorkQueue, RtlCompute37Hash, NsiAllocateAndGetTable, NsiFreeTable, NetioNcmFastCheckIsAoAcCapable, NetioNcmQueryRtcPortRange, NetioNcmIsOwningProcessRtcApp, NetioNcmQueryRtcPortHint, NetioNcmStoreRtcPortHint, NsiReferenceDefaultObjectSecurity, NmrRegisterProvider, NmrDeregisterProvider, NmrWaitForProviderDeregisterComplete, NsiGetAllParameters, NmrRegisterClient, NmrDeregisterClient, NmrWaitForClientDeregisterComplete, NmrClientDetachProviderComplete, NmrClientAttachProvider, NmrProviderDetachClientComplete, NetioNcmGetAllNotificationChannelContextParameters, NetioNcmNotificationChannelContextRequest, NetioOpenKey, NetioQueryValueKey, NetioCloseKey, NetioRegSyncDefaultChangeHandler, NetioRegSyncInterface, NetioNcmHandlePatternEviction, NetioNcmStoreRtcPortRange, RtlInitializeToeplitzHash, RtlCleanupToeplitzHash, NetioAllocateNetBufferMdlAndDataPool, NetioAllocateNetBufferListNetBufferMdlAndDataPool, NetioFreeNetBufferMdlAndDataPool, NetioFreeNetBufferListNetBufferMdlAndDataPool, NetioNcmFastActiveReferenceRequest, RtlIndicateTimerWheelEntryTimerStart, RtlResumeTimerWheel, RtlIsTimerWheelSuspended, NetioFreeMdl, NetioFreeNetBufferList, NetioExtendNetBuffer, NetioNrtIsPktTaggingEnabled, NetioAllocateAndReferenceNetBufferListNetBufferMdlAndData, NetioAllocateNetBufferMdlAndData, NetioDereferenceNetBufferListChain, NetioFreeNetBuffer, NetioNcmTlObjectRequest, NetioNrtDisassociateContext, RtlComputeToeplitzHash, NetioNcmPatternCoalescingRequired, NetioNcmNotifyRedirectOnInterface, KfdIsTfoIncompatibleFilterPresent, NetioNrtAssociateContext, RtlInsertElementGenericTableBasicAvl, RtlDeleteElementGenericTableBasicAvl, RtlInitializeTimerWheelEntry, NetioNrtIsTrackerDevice, RtlSuspendTimerWheel, RtlGetNextExpirationTimerWheelTick, RtlCleanupTimerWheelEntry, RtlUpdateCurrentTimerWheelTick, RtlGetNextExpiredTimerWheelEntry, RtlReturnTimerWheelEntry, RtlCopyMdlToMdlIndirect, NetioAdvanceToLocationInNetBuffer, TlDefaultRequestQueryDispatch, TlDefaultRequestMessage, TlDefaultRequestQueryDispatchEndpoint, NetioAllocateOpaquePerProcessorContext, NetioFreeOpaquePerProcessorContext, RtlCleanupTimerWheel, RtlInitializeTimerWheel, RtlInitializeTimerWheelEnumeration, RtlEnumerateNextTimerWheelEntry, RtlEndTimerWheelEnumeration, RtlCopyMdlToBuffer, NetioFreeNetBufferAndNetBufferList, RtlCopyBufferToMdl, NetioAllocateAndReferenceNetBufferAndNetBufferList, NetioCopyNetBufferListInformation, NetioCompleteCopyNetBufferListChain, NetioAllocateAndReferenceCopyNetBufferListEx, TlDefaultRequestListen, TlDefaultRequestConnect, TlDefaultRequestCancel, NetioReferenceNetBufferList, TlDefaultRequestIoControl, NetioAdvanceNetBufferList, NetioPhIsIcmpErrorForIcmpMessage, FeGetWfpGlobalPtr, FwppStreamInject, FwppStreamContinue, FwppCopyStreamDataToBuffer, FwppAdvanceStreamDataPastOffset, FwppTruncateStreamDataAfterOffset, FwppDiscardClonedStreamData, WfpNblInfoDispatchTableSet, NsiGetParameterEx, KfdRegisterLayerEventNotify, WfpNblInfoDispatchTableClear, KfdSetWfpPerProcContextPtr, IPsecGwDispatchTableInit, KfdDeregisterLayerEventNotify, KfdAleAcquireFlowHandleForFlow, KfdClassify, KfdAleReleaseFlowHandleForFlow, KfdCheckClassifyNeededAndUpdateEpoch, NetioRetreatNetBufferList, KfdReleaseCachedFilters, KfdClassify2, NetioFreeCloneNetBufferList, NetioAllocateAndReferenceCloneNetBufferListEx, KfdReleaseTerminatingFilters, KfdIsV4OutTransportFastEmpty, KfdIsV6OutTransportFastEmpty, KfdIsV4InTransportFastEmpty, KfdIsV6InTransportFastEmpty, FeCopyIncomingValues, KfdDirectClassify, KfdIsLsoOffloadPossibleV4, KfdIsLsoOffloadPossibleV6, KfdGetOffloadEpoch, KfdCheckOffloadFastLayers, KfdDiagnoseEvent, KfdAuditEvent, NetioLookupvSwitchForwardFlow, NetioRefreshFlow, NetioCreatevSwitchForwardFlow, NetioReleaseFlow, NetioLookupForwardFlow, NetioCreateForwardFlow, WfpNblInfoClearFlags, WfpNblInfoSetFlags, NetioFlowAssociateContext, NetioFlowRetrieveContext, NetioFlowRemoveContext, NetioInitializeFlowsManager, NetioUnInitializeFlowsManager, KfdAleInitializeFlowHandles, KfdAleUninitializeFlowHandles, KfdAleNotifyFlowDeletion, FwppStreamDeleteDpcQueue, NetioNrtDereferenceRecord, WfpCalloutDiagTraceConnectRedirectClassify, FeReleaseCalloutContextList, NsiSetAllParameters, KfdAleAcquireEndpointContextFromFlow, WfpCalloutDiagTraceQueryConnectionRedirectState, KfdBfeEngineAccessCheck, NetioNrtReferenceRecord, WfpStreamIsFilterPresent, NetioNrtIsProxyInRecord, NetioNrtIsIpInRecord, NetioNrtWppLogRecord, WfpCalloutDiagTraceSetRedirectRecords, KfdToggleFilterActivation, KfdEnumLayer, KfdGetNextFilter, KfdDerefFilterContext, KfdFreeEnumHandle, MatchCondition, KfdAleRemoveFlowContextTable, KfdAleInitializeFlowTable, WfpCalloutDiagTraceRedirectedAuthConnect, KfdGetLayerCountWithIndexType, FwppLogVpnEvent, WfpInitializeLeastRecentlyUsedList, WfpLruEntryDeferredCleanupRoutine, KfdGetLayerCacheEpoch, WfpUninitializeLeastRecentlyUsedList, WfpProcessLruEntryCleanup, WfpLruQueueLruCleanupWorkItemForContext, WfpRemoveEntryLru, WfpInsertEntryLru, KfdFindFilterById, KfdReleaseFilterContext, KfdGetLayerActionFromEnumTemplate, KfdCheckAndCacheConnectBypass, KfdQueueLruCleanupWorkItem, KfdCheckConnectBypass, KfdCheckAndCacheAcceptBypass, KfdCheckAcceptBypass, KfdIsDiagnoseEventEnabled, NetioParseIpFieldsFromNetBuffer, NsiRegisterChangeNotificationEx, WskDeregister, WskRegister, WskReleaseProviderNPI, WskCaptureProviderNPI, NsiDeregisterChangeNotification, NsiRegisterChangeNotification, NetioPhCreateArpPacket, NetioInitializeNetBufferListContext, NetioInitializeNetBufferListAndFirstNetBufferContext, NetioNcmTrackIsLegitimateWake, NetioNcmStoreBaseSupportedSlots, NetioPhAllocatePacket, NetioPhCreateNaPacket, NetioPhGetNdLinkLayerOptionAddress, NetioPhParseIpv6TlvNdOption, NetioCompleteNetBufferListChain, WfpTransferReassemblyContextForFragments, WfpTransferReassemblyContextUponCompletion, NetioAllocateAndReferenceFragmentNetBufferList, WfpSetConfigureParametersDecodeHelper, WfpNrptTriggerDecodeHelper, WfpSetDisconnectDecodeHelper, WfpSetVpnTriggerSecurityDescriptorDecodeHelper, WfpSetVpnTriggerFilePathsDecodeHelper, WfpDecodedBufferFreeHelper, WfpSetVpnTriggerSidsDecodeHelper, IoctlKfdSetBfeEngineSd, IoctlKfdResetState, IoctlKfdQueryLayerStatistics, IoctlKfdAbortTransaction, IoctlKfdCommitTransaction, IoctlKfdDeleteCache, IoctlKfdAddCache, IoctlKfdBatchUpdate, IoctlKfdDeleteIndex, IoctlKfdAddIndex, SetWfpDeviceObject, NetioGetStatsForQoSFlow, NetioDeleteQoSFlow, NetioCreateQoSFlow, NetioAssociateQoSFlowWithNbl, NetioPdcActivateNetwork, FwpmEventProviderFireNetEvent0, FwpmEventProviderIsNetEventTypeEnabled0, FwpmEventProviderDestroy0, FwpmEventProviderCreate0, KfdIsActiveCallout, WfpNblInfoCleanup, KfdAleUpdateEndpointContextStatus, WfpNblInfoAlloc, WfpPacketTagCountIncrement, WfpNblInfoDestroyIfUnused, NetioAllocateAndReferenceNetBufferList, NetioAllocateNetBuffer, WfpFreeReassemblyContext, WfpCreateReassemblyContext, NetioNcmActiveReferenceRequest, NetioInitializeNetBufferListContextPrimitive, NetioCompleteNetBufferAndNetBufferListChain, NetioPhClampMssOnIpPkt, NsiSetParameter, PtGetNumNodes, PtCreateTable, PtDestroyTable, NetioNrtGetIfIndex, NetioQueryNetBufferListTrafficClass, RtlCopyMdlToMdl, NetioPhChecksumIpDatagramWithInitialChecksum, NetioPhComputePseudoHeaderChecksum, NetioAllocateAndReferenceVacantNetBufferListEx, WfpNblInfoSet, NetioExpandNetBuffer, NetioUpdateNetBufferListContext, NetioCompleteCloneNetBufferListChain, NetioAllocateAndReferenceVacantNetBufferList, NetioAllocateAndReferenceCloneNetBufferList, PtGetNextShorterMatch, PtGetLongestMatch, PtGetKey, PtDeleteEntry, PtInsertEntry, PtGetExactMatch, PtSetData, PtGetData, PtEnumOverTable, NsiSetObjectSecurity, NsiResetPersistentSetting, NsiGetParameter |
| NDIS.SYS | NdisCloseNDKAdapter, NdisOpenNDKAdapter, NdisCancelDirectOidRequest, NdisDirectOidRequest, NdisOidRequest, NdisIfDeregisterInterface, NdisIfRegisterInterface, NdisIfAllocateNetLuidIndex, NdisIfDeregisterProvider, NdisIfFreeNetLuidIndex, NdisIfRegisterProvider, NdisSetThreadObjectCompartmentId, NdisSendNetBufferLists, NdisReturnNetBufferLists, NdisCancelSendNetBufferLists, NdisConvertNdisStatusToNtStatus, NdisIfQueryBindingIfIndex, NdisGetRssProcessorInformation, NdisAllocateFragmentNetBufferList, NdisCloseAdapterEx, NdisCompleteNetPnPEvent, NdisRegisterProtocolDriver, NdisDeregisterProtocolDriver, NdisAllocateNetBufferListContext, NdisAllocateCloneNetBufferList, NdisFreeCloneNetBufferList, NdisFreeNetBufferListPool, NdisAllocateNetBufferListPool, NdisGetThreadObjectCompartmentScope, NdisFreeRWLock, NdisAllocateRWLock, NdisFreeGenericObject, NdisAllocateGenericObject, NdisGetSessionToCompartmentMappingEpochAndZero, NdisAcquireRWLockRead, NdisAcquireRWLockWrite, NdisReleaseRWLock, NdisFreeFragmentNetBufferList, NdisCopyReceiveNetBufferListInfo, NdisCopySendNetBufferListInfo, NdisAdvanceNetBufferListDataStart, NdisOpenAdapterEx, NdisFreeNetBufferListContext, NdisGetDataBuffer, NdisFreeNetBufferList, NdisGetProcessObjectCompartmentId, NdisAdjustNetBufferCurrentMdl, NdisGetThreadObjectCompartmentId, NdisAdvanceNetBufferDataStart, NdisRetreatNetBufferDataStart |
| cng.sys | BCryptHashData, BCryptFinishHash, BCryptDestroyHash, BCryptDecrypt, BCryptGetProperty, BCryptCreateHash, BCryptHash, SystemPrng, BCryptDestroyKey, BCryptGenRandom, BCryptGenerateSymmetricKey, BCryptEncrypt, BCryptOpenAlgorithmProvider, BCryptCloseAlgorithmProvider, BCryptSetProperty |
| FLTMGR.SYS | FltGetFileNameInformationUnsafe, FltReleaseFileNameInformation |
| fwpkclnt.sys | IPsecDriverInitiateAcquire, IPsecDriverExpire, IPsecDriverSaOffloaded, IPsecDriverProcessClearTextResponse, FwppBfeStateGetResetCount0, FwppDispatchDevCtl0, FwpsRequestEndpointDeleteNotification0, FwpsCancelEndpointDeleteNotification0, FwpsForceReclassifyLayer0, FwpsFreeNetBufferList0, FwpsReassembleForwardFragmentGroup0, FwppvSwitchFreeVmSwitchNblInfo, FwpsFreeCloneNetBufferList0, FwpsReleaseClassifyHandle0, FwpsApplyModifiedLayerData0, FwpsAcquireWritableLayerDataPointer0, FwpsAcquireClassifyHandle0, FwpsClassifyOptionSet0, FwpmBfeStateUnsubscribeChanges0, FwpmBfeStateSubscribeChangesWithoutDevice0, FwpsFlowAssociateContext0, FwpmEngineClose0, FwpmEngineOpen0, FwppVpnTriggerEventFire0, FwpmSecureSocketDeleteByKeyAsync0, FwpmSecureSocketAddAsync0, FwppvSwitchGetDestinationInterface, FwppvSwitchGetDestinationArray, FwppvSwitchCopyVmSwitchNblInfo, FwppDereferencevSwitchNblContext, FwppReferencevSwitchNblContext, FwpsInjectNetworkReceiveAsync0, FwppAllocateNetioCloneNetBufferList, FwpsNetBufferListRetrieveContext0, FwppGetvSwitchNblContext, FwppProcessorAddHandler, FwpsIPSecGetPacketListSecurityInformation, FwppNetBufferListAssociateContext, FwpsQueryPacketInjectionState0, FwpsInjectionHandleDestroy0, FwpsInjectionHandleCreate0, FwpsInjectTransportSendAsync1, FwpsConstructIpHeaderForTransportPacket0, FwpsAllocateCloneNetBufferList0, FwpsTcpIpDispatchTableAndGlobalsSet0, FwpsTcpIpDispatchTableClear0, FwppNetBufferListEventNotify, FwpsCalloutUnregisterByKey0, FwpsCalloutRegisterWithoutDevice0, FwpsProxiedEndpointUnRegisterForExitingEndpoint, FwpsProxiedEndpointClassifiableFieldGet, FwpsProxiedEndpointMetadataValueGet, FwpsProxiedEndpointRegisterForExitingEndpoint, FwpsProxiedEndpointWasRedirectedToProxy |
| HAL.dll | KeQueryPerformanceCounter |
| ksecdd.sys | AcquireCredentialsHandleW, FreeContextBuffer, InitializeSecurityContextW, AcceptSecurityContext, QuerySecurityContextToken, DeleteSecurityContext, FreeCredentialsHandle |
| msrpc.sys | NdrMesTypeEncode3, NdrMesTypeDecode3, RpcBindingUnbind, RpcBindingCreateW, RpcBindingFree, RpcBindingBind, I_RpcExceptionFilter, NdrClientCall3, MesDecodeBufferHandleCreate, MesHandleFree, MesEncodeDynBufferHandleCreate |
Edit tour
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library Node