← Back to malware index
Cronos sleep mask
Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.
5 syscalls cited
- NtContinue
Restores a CPU CONTEXT into the current thread and resumes execution at CONTEXT.Rip.
- NtAlertResumeThread
Resumes a suspended thread and simultaneously alerts it so any pending APCs are delivered.
- NtWaitForMultipleObjects
Waits on up to MAXIMUM_WAIT_OBJECTS dispatcher objects with either WaitAny or WaitAll semantics.
- NtCreateTimer
Creates a kernel timer object that can be armed later with NtSetTimer.
- NtSetTimer
Arms a timer object with a due time, optional period and an optional APC routine fired on expiry.