popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Lady.exe

OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 24, 2021, 11:50 p.m. June 24, 2021, 11:52 p.m.
Size 663.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c1e123df8403bf9087cce44956d6801c
SHA256 43b3fa1a455eedfc3a6084046a958b6a41074b92d94ecb5a0262911eab570f86
CRC32 5A048B55
ssdeep 12288:l9HFJ9rJxRX1uVVjoaWSoynxdO1FVBaOiRZTERfIhNkNCCLo9Ek5C/h8gbgk:vZ1xuVVjfFoynPaVBUR8f+kN10EB1
Yara
  • PE_Header_Zero - PE File Signature
  • OS_Processor_Check_Zero - OS Processor Check
  • Win32_Trojan_Gen_2_0904B0_Zero - Win32 Trojan Gen
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
46.147.242.32 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .itext
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
lady+0x978a @ 0x40978a
lady+0x8fef1 @ 0x48fef1
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757333ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x76a7b727
registers.esp: 1637628
registers.edi: 0
registers.eax: 1637628
registers.ebp: 1637708
registers.edx: 0
registers.ebx: 4229144
registers.esi: 1637784
registers.ecx: 7
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2332
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2332
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01ff0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1892
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 844
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 844
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00540000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73702000
process_handle: 0xffffffff
1 0 0
description smarctscreen.exe tried to sleep 229 seconds, actually delayed analysis time by 229 seconds
cmdline cmd.exe /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
cmdline cmd.exe /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
file C:\Users\test22\AppData\Local\Temp\Lady.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
filepath: cmd.exe
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
filepath: cmd.exe
1 1 0

CreateProcessInternalW

 thread_identifier: 2364
thread_handle: 0x00000280
process_identifier: 1892
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000290
1 1 0

CreateProcessInternalW

 thread_identifier: 2316
thread_handle: 0x000001c8
process_identifier: 2480
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000001cc
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeTakeOwnershipPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeLoadDriverPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeBackupPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRemoteShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeManageVolumePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeCreateGlobalPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeSecurityPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeTakeOwnershipPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeLoadDriverPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeBackupPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRestorePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeRemoteShutdownPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeManageVolumePrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeCreateGlobalPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtTerminateProcess

 status_code: 0x00000000
process_identifier: 1892
process_handle: 0x00000160
0 0
cmdline cmd.exe /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
cmdline attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
cmdline cmd.exe /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
cmdline attrib "C:\Users\test22\AppData\Local\Temp" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
cmdline "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
host 46.147.242.32
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00100000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00110000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00120000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00130000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00140000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00150000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00100000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00150000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00160000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00170000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00180000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00190000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00010000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00020000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit reg_value C:\Windows\system32\userinit.exe,C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\WindowsDefenfer reg_value C:\Windows\system32\WinDefender\smarctscreen.exe
file C:\Users\test22\AppData\Local\Temp\Lady.exe
mutex DCPERSFWBP
regkey HKEY_CURRENT_USER\Software\DC3_FEXEC
regkey HKEY_CURRENT_USER\Software\DC2_USERS
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x000b0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: user32.dll
base_address: 0x000c0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: Sleep
base_address: 0x000d0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: MessageBoxA
base_address: 0x000e0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: ExitThread
base_address: 0x000f0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: DeleteFileA
base_address: 0x00100000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: GetLastError
base_address: 0x00110000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: TerminateProcess
base_address: 0x00120000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: CloseHandle
base_address: 0x00130000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: OpenProcess
base_address: 0x00140000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: GetExitCodeProcess
base_address: 0x00150000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: C:\Users\test22\AppData\Local\Temp\Lady.exe
base_address: 0x001a0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: ×Isu"suF@˜Õ?wDTsuÀsuØtusu†suMtu d
base_address: 0x001b0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: U‹ìSVW‹]‹C4P‹C,PÿPÿS‰C ‹C8P‹C0PÿPÿS‰C‹C<P‹C,PÿPÿS‰C‹C@P‹C,PÿPÿS‰C‹CDP‹C,PÿPÿS‰C‹CHP‹C,PÿPÿS‰C‹CTP‹C,PÿPÿS‰C ‹CLP‹C,PÿPÿS‰C$‹CPP‹C,PÿPÿS‰C(ëÿSƒøthôÿS ‹C\PÿS„Àtå‹CXPjjÿS$‹ð…ötWVÿS(WVÿSVÿS jÿS_^[]‹ÀU‹ìÄ@ÿÿÿSV3ɉMô‰Uø‰Eü‹Eüè. ùÿ‹Eøè& ùÿu”3ÀUhFRGdÿ0d‰ …Pÿÿÿ3ɺDè+ëøÿDžPÿÿÿDDž|ÿÿÿfÇE€…@ÿÿÿP…PÿÿÿPjjhjjj‹EüèÔ ùÿPjè)ùÿ‹@ÿÿÿ‹EüèNRùÿ„Àu Eüº\RGè™ùÿ‹Eøè5Rùÿ„Àu Uø3Àèï¡ùÿEô‹UøèxùÿºdRG‹Ãèüüÿÿ‰F,ºtRG‹Ãèíüÿÿ‰F0º€RG‹ÃèÞüÿÿ‰F4ºˆRG‹ÃèÏüÿÿ‰F8º”RG‹ÃèÀüÿÿ‰F<º RG‹Ãè±üÿÿ‰F@º¬RG‹Ãè¢üÿÿ‰FDº¼RG‹Ãè“üÿÿ‰FHºÐRG‹Ãè„üÿÿ‰FTºÜRG‹Ãèuüÿÿ‰FLºèRG‹Ãèfüÿÿ‰FP‹Eôèßùÿ‹Ð‹ÃèRüÿÿ‰F\‹…Hÿÿÿ‰FXhüRGh SGèç)ùÿPèé)ùÿ‰hSGh SGèÐ)ùÿPèÒ)ùÿ‰Fh€RGh SGè¸)ùÿPèº)ùÿ‰F hˆRGh SGè )ùÿPè¢)ùÿ‰F h”RGh SGèˆ)ùÿPèŠ)ùÿ‰Fh RGh SGèp)ùÿPèr)ùÿ‰Fh¬RGh SGèX)ùÿPèZ)ùÿ‰Fh¼RGh SGè@)ùÿPèB)ùÿ‰FhÐRGh SGè()ùÿPè*)ùÿ‰F hÜRGh SGè)ùÿPè)ùÿ‰F$hèRGh SGèø(ùÿPèú(ùÿ‰F(j`j‹Îº”NG‹Ãèõûÿÿ3ÀZYYd‰hMRGEôºèùÿÃ
base_address: 0x001c0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x000b0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: user32.dll
base_address: 0x000c0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: Sleep
base_address: 0x000d0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: MessageBoxA
base_address: 0x000e0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: CreateProcessA
base_address: 0x000f0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: GetLastError
base_address: 0x00100000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: SetLastError
base_address: 0x00150000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: CreateMutexA
base_address: 0x00160000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: CloseHandle
base_address: 0x00170000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: ExitThread
base_address: 0x00180000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: OpenProcess
base_address: 0x00190000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: DCPERSFWBP
base_address: 0x001a0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: TerminateProcess
base_address: 0x001b0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: GetExitCodeProcess
base_address: 0x001c0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: SECURITY_WINDL-KETFP7Y
base_address: 0x001d0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: WaitForSingleObject
base_address: 0x001e0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: C:\Windows\SysWOW64\WinDefender\smarctscreen.exe
base_address: 0x001f0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: ×Isu"suý`uÿsuÀsursu6su©su˜Õ?w†suØtusuMtukLsu °
base_address: 0x00010000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

WriteProcessMemory

 buffer: U‹ìƒÄ¬SVW‹]‹C@P‹C8PÿPÿS‰C ‹CDP‹C<PÿPÿS‰C‹CTP‹C8PÿPÿS‰C‹CXP‹C8PÿPÿS‰C‹CHP‹C8PÿPÿS‰C‹CLP‹C8PÿPÿS‰C‹CPP‹C8PÿPÿS‰C4‹C`P‹C8PÿPÿS‰C,‹ClP‹C8PÿPÿS‰C(‹ChP‹C8PÿPÿS‰C0‹CdP‹C8PÿPÿS‰C ‹CpP‹C8PÿPÿS‰C$jÿS‹CxPjjÿS4ÿS=·u$‹C|PjjÿS$‹ø…ÿtVWÿS0VWÿS(WÿS,jÿS jÿS‹C\PjjÿS4‹øÿS=·tRWÿS,ÇE¼DE¬PE¼Pjjjjjj‹CtPjÿS…Àt3öhȋE¬PÿSƒèsƒÎÿ…ötèë¼hÐÿS ë²WÿS,hôÿS ë„_^[‹å]U‹ìÄ ÿÿÿSVW‰Mô‰Uø‰Eü‹Eüèëùÿ‹Eøèãùÿ‹EôèÛùÿµtÿÿÿ3ÀUh)XGdÿ0d‰ …0ÿÿÿ3ɺDèÝåøÿDž0ÿÿÿDDž\ÿÿÿfDž`ÿÿÿ‹Eüè0Mùÿ„Àu Eüº@XGè{ùÿ‹EøèMùÿ„Àu Uø3Àèќùÿ¿HXG… ÿÿÿP…0ÿÿÿPjjhjjj‹EüèOùÿPjè $ùÿ‹ ÿÿÿºTXG‹Ãè±÷ÿÿ‰F8ºdXG‹Ãè¢÷ÿÿ‰F<ºpXG‹Ãè“÷ÿÿ‰F@ºxXG‹Ãè„÷ÿÿ‰FDº„XG‹Ãèu÷ÿÿ‰FTº”XG‹Ãèf÷ÿÿ‰FHº¤XG‹ÃèW÷ÿÿ‰FLº´XG‹ÃèH÷ÿÿ‰FPºÄXG‹Ãè9÷ÿÿ‰F`ºÐXG‹Ãè*÷ÿÿ‰FdºÜXG‹Ãè÷ÿÿ‰Fp‹×‹Ãè÷ÿÿ‰FxºèXG‹Ãè÷ÿÿ‰FlºüXG‹Ãèñöÿÿ‰Fh‹Eôèjùÿ‹Ð‹ÃèÝöÿÿ‰F\ºYG‹ÃèÎöÿÿ‰FX‹EøèGùÿ‹Ð‹Ãèºöÿÿ‰Ft‹…(ÿÿÿ‰F|h$YGh4YGèO$ùÿPèQ$ùÿ‰h@YGh4YGè8$ùÿPè:$ùÿ‰FhpXGh4YGè $ùÿPè"$ùÿ‰F hxXGhPYGè$ùÿPè $ùÿ‰FhÄXGh4YGèð#ùÿPèò#ùÿ‰F,h„XGh4YGèØ#ùÿPèÚ#ùÿ‰Fh”XGh4YGèÀ#ùÿPèÂ#ùÿ‰Fh¤XGh4YGè¨#ùÿPèª#ùÿ‰Fh´XGh4YGè#ùÿPè’#ùÿ‰F4hüXGh4YGèx#ùÿPèz#ùÿ‰F0hÐXGh4YGè`#ùÿPèb#ùÿ‰F hèXGh4YGèH#ùÿPèJ#ùÿ‰F(hYGh4YGè0#ùÿPè2#ùÿ‰FhÜXGh4YGè#ùÿPè#ùÿ‰F$h€j‹Îº(SG‹Ãèöÿÿ3ÀZYYd‰h0XGEôºè,ýøÿÃ
base_address: 0x00020000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x004818f8
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 3474067 0
file C:\Windows\SysWOW64\WinDefender\smarctscreen.exe
dead_host 46.147.242.32:1604
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000188
suspend_count: 1
process_identifier: 2332
1 0 0

CreateProcessInternalW

 thread_identifier: 2228
thread_handle: 0x000002c8
process_identifier: 2852
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002d0
1 1 0

CreateProcessInternalW

 thread_identifier: 1444
thread_handle: 0x000002c8
process_identifier: 1304
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\cmd.exe
track: 1
command_line: "C:\Windows\System32\cmd.exe" /k attrib "C:\Users\test22\AppData\Local\Temp" +s +h
filepath_r: C:\Windows\System32\cmd.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x000002bc
1 1 0

CreateProcessInternalW

 thread_identifier: 2364
thread_handle: 0x00000280
process_identifier: 1892
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x000b0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: user32.dll
base_address: 0x000c0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: Sleep
base_address: 0x000d0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: MessageBoxA
base_address: 0x000e0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: ExitThread
base_address: 0x000f0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00100000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: DeleteFileA
base_address: 0x00100000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00110000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: GetLastError
base_address: 0x00110000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00120000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: TerminateProcess
base_address: 0x00120000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00130000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: CloseHandle
base_address: 0x00130000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00140000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: OpenProcess
base_address: 0x00140000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00150000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: GetExitCodeProcess
base_address: 0x00150000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001a0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: C:\Users\test22\AppData\Local\Temp\Lady.exe
base_address: 0x001a0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: ×Isu"suF@˜Õ?wDTsuÀsuØtusu†suMtu d
base_address: 0x001b0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

NtAllocateVirtualMemory

 process_identifier: 1892
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x001c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000290
1 0 0

WriteProcessMemory

 buffer: U‹ìSVW‹]‹C4P‹C,PÿPÿS‰C ‹C8P‹C0PÿPÿS‰C‹C<P‹C,PÿPÿS‰C‹C@P‹C,PÿPÿS‰C‹CDP‹C,PÿPÿS‰C‹CHP‹C,PÿPÿS‰C‹CTP‹C,PÿPÿS‰C ‹CLP‹C,PÿPÿS‰C$‹CPP‹C,PÿPÿS‰C(ëÿSƒøthôÿS ‹C\PÿS„Àtå‹CXPjjÿS$‹ð…ötWVÿS(WVÿSVÿS jÿS_^[]‹ÀU‹ìÄ@ÿÿÿSV3ɉMô‰Uø‰Eü‹Eüè. ùÿ‹Eøè& ùÿu”3ÀUhFRGdÿ0d‰ …Pÿÿÿ3ɺDè+ëøÿDžPÿÿÿDDž|ÿÿÿfÇE€…@ÿÿÿP…PÿÿÿPjjhjjj‹EüèÔ ùÿPjè)ùÿ‹@ÿÿÿ‹EüèNRùÿ„Àu Eüº\RGè™ùÿ‹Eøè5Rùÿ„Àu Uø3Àèï¡ùÿEô‹UøèxùÿºdRG‹Ãèüüÿÿ‰F,ºtRG‹Ãèíüÿÿ‰F0º€RG‹ÃèÞüÿÿ‰F4ºˆRG‹ÃèÏüÿÿ‰F8º”RG‹ÃèÀüÿÿ‰F<º RG‹Ãè±üÿÿ‰F@º¬RG‹Ãè¢üÿÿ‰FDº¼RG‹Ãè“üÿÿ‰FHºÐRG‹Ãè„üÿÿ‰FTºÜRG‹Ãèuüÿÿ‰FLºèRG‹Ãèfüÿÿ‰FP‹Eôèßùÿ‹Ð‹ÃèRüÿÿ‰F\‹…Hÿÿÿ‰FXhüRGh SGèç)ùÿPèé)ùÿ‰hSGh SGèÐ)ùÿPèÒ)ùÿ‰Fh€RGh SGè¸)ùÿPèº)ùÿ‰F hˆRGh SGè )ùÿPè¢)ùÿ‰F h”RGh SGèˆ)ùÿPèŠ)ùÿ‰Fh RGh SGèp)ùÿPèr)ùÿ‰Fh¬RGh SGèX)ùÿPèZ)ùÿ‰Fh¼RGh SGè@)ùÿPèB)ùÿ‰FhÐRGh SGè()ùÿPè*)ùÿ‰F hÜRGh SGè)ùÿPè)ùÿ‰F$hèRGh SGèø(ùÿPèú(ùÿ‰F(j`j‹Îº”NG‹Ãèõûÿÿ3ÀZYYd‰hMRGEôºèùÿÃ
base_address: 0x001c0000
process_identifier: 1892
process_handle: 0x00000290
1 1 0

CreateProcessInternalW

 thread_identifier: 2824
thread_handle: 0x00000434
process_identifier: 844
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\WinDefender\smarctscreen.exe
track: 1
command_line: "C:\Windows\system32\WinDefender\smarctscreen.exe"
filepath_r: C:\Windows\system32\WinDefender\smarctscreen.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000440
1 1 0

CreateProcessInternalW

 thread_identifier: 2672
thread_handle: 0x00000084
process_identifier: 3028
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\attrib.exe
track: 1
command_line: attrib "C:\Users\test22\AppData\Local\Temp\Lady.exe" +s +h
filepath_r: C:\Windows\system32\attrib.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

CreateProcessInternalW

 thread_identifier: 2772
thread_handle: 0x00000084
process_identifier: 1632
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\attrib.exe
track: 1
command_line: attrib "C:\Users\test22\AppData\Local\Temp" +s +h
filepath_r: C:\Windows\system32\attrib.exe
stack_pivoted: 0
creation_flags: 524288 (EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 1
process_handle: 0x00000088
1 1 0

NtResumeThread

 thread_handle: 0x0000014c
suspend_count: 1
process_identifier: 1892
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 844
1 0 0

CreateProcessInternalW

 thread_identifier: 2316
thread_handle: 0x000001c8
process_identifier: 2480
current_directory:
filepath:
track: 1
command_line: notepad
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000b0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: kernel32.dll
base_address: 0x000b0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: user32.dll
base_address: 0x000c0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: Sleep
base_address: 0x000d0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: MessageBoxA
base_address: 0x000e0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000f0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: CreateProcessA
base_address: 0x000f0000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0

NtAllocateVirtualMemory

 process_identifier: 2480
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00100000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000001cc
1 0 0

WriteProcessMemory

 buffer: GetLastError
base_address: 0x00100000
process_identifier: 2480
process_handle: 0x000001cc
1 1 0