Hancitor

Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.

4 syscalls cited

NtWaitForSingleObject
Waits until a dispatcher object becomes signaled or the optional timeout expires.
NtWaitForMultipleObjects
Waits on up to MAXIMUM_WAIT_OBJECTS dispatcher objects with either WaitAny or WaitAll semantics.
NtDeleteAtom
Decrements the reference count of a global atom and removes it when the count reaches zero.
NtQueryInformationAtom
Returns metadata about a single atom or the entire global atom table — name, refcount, pin count, usage counts.