← Back to malware index
Royal ransomware
Attributions are based on open-source threat reports. A family appearing here means at least one syscall record cites it; absence does not imply non-use.
3 syscalls cited
- NtNotifyChangeDirectoryFile
Registers an asynchronous notification request for filesystem changes within an opened directory handle.
- NtSetSystemPowerState
Transitions the system into the requested sleep, hibernate or working power state.
- NtInitiatePowerAction
Requests the power manager to perform a system-wide power action (sleep, hibernate, shutdown, reboot).